Intrinsic Dimension Estimation for Robust Detection of AI-Generated Texts
Authors: Eduard Tulchinskii
Kristian Kuznetsov
Kushnareva Laida
Daniil Cherniavskii
Sergey Nikolenko
Evgeny Burnaev
Serguei Barannikov
Irina Piontkovskaya
Venue: NeurIPS 2023 poster (2023)
Keywords: generated texts detection
intrinsic dimension
TDA
Persistent Homology
ChatGPT
TL;DR: We use intrinsic dimensionality value, obtained by Persistent Homology Dimension estimation, as a scoring function, separating generated and natural texts.

Abstract: Rapidly increasing quality of AI-generated content makes it difficult to distinguish between human and AI-generated texts, which may lead to undesirable consequences for society. Therefore, it becomes increasingly important to study the properties of human texts that are invariant over text domains and various proficiency of human writers, can be easily calculated for any language, and can robustly separate natural and AI-generated texts regardless of the generation model and sampling method. In this work, we propose such an invariant of human texts, namely the intrinsic dimensionality of the manifold underlying the set of embeddings of a given text sample. We show that the average intrinsic dimensionality of fluent texts in natural language is hovering around the value $9$ for several alphabet-based languages and around $7$ for Chinese, while the average intrinsic dimensionality of AI-generated texts for each language is $\approx 1.5$ lower, with a clear statistical separation between human-generated and AI-generated distributions. This property allows us to build a score-based artificial text detector. The proposed detector's accuracy is stable over text domains, generator models, and human writer proficiency levels, outperforming SOTA detectors in model-agnostic and cross-domain scenarios by a significant margin.

Intrinsic Dimension Estimation for Robust Detection of AI-Generated Texts
Eduard Tulchinskii', Kristian Kuznetsov', Laida Kushnareva', Daniil Cherniavskii
Sergey Nikolenko Evgeny Burnaev Serguei Barannikov Irina Piontkovskaya
Skolkovo Institute of Science and Technology, Russia;
2 Al Foundation and Algorithm Lab, Russia;
Artificial Intelligence Research Institute (AIRI). Russia; Russia:"NNRS, Université Paris Cité, France; St. Petersburg Department of the Steklov Institute of Mathematics, Russia
Abstract
Rapidly increasing quality of Al-generated content makes it difficult to distinguish between human and Al-generated texts, which may lead to undesirable conse- quences for society. Therefore, becomes increasingly important study the properties of human texts that are invariant over different text domains and varying proficiency of human writers, can be easily calculated for any language, and can robustly separate natural and Al- Al-generated texts regardless of the generation model and sampling method. In this work, we propose such an invariant for human- written texts, namely the intrinsic dimensionality of the manifold underlying the set of embeddings for a given text sample. We show that the average intrinsic dimensionality of fluent texts in natural language is hovering around the value 9 for several alphabet-basse languages and around 7 for Chinese, while the average intrinsic dimensionality of Al-generated texts for each language is = 1.5 lower, and Al-generated distri- build score-based artificial text detector. The
with a clear statistical separation between buman-generann butions. This property allows proposed detector's 's accuracy is stable over text domains, generator models, and human writer proficiency levels, outperforming SOTA detectors in model-agnostie and cross-domain scenarios by a significant margin. We release code and date
1 Introduction
Modern large language models (LLMs) generate human-looking texts increasingly well, which may also lead worrisome consequences [Fagni et al. 2021 Adelani et al., 2020 Stokei-Walker 2022]. Hence, the ability to detect Al Al-generated texts (artificial text detection, ATD) becomes crucial for media, education, politics, creative industries and other spheres of human social activities. A straightforward idea would be to train classifier to detect artificial text; many such classifiers exist [Zellers al. Gehrmann et al. 2019 Solaiman et al., 2019]. but most of them are designed to detect samples of individual generation models, either using the model itself [Mitchel et al. 2023 or training on dataset of its generations. This leads to poor generalization
new models and unknown data domains. Another idea, known as watermarking. is to inject some detectable artifacts into model generations; for instance, [Kirchenbauer et al.) [2023] propose to intentionally inject statistical skew that can be detected in text sample. However, later works showed that watermark detectors can be broken by adversarial attacks, e.g., by text perturbations or paraphrasing (He et al.) 2023]. Since text generation is constantly evolving. Sadasivan et al. (2023) claim that perfect artificial text detection impossible; Krishna et al. [2023] address this statement and propose retrieval-basee detector that could be implemented by text generation service providers: they should store the hash
github. com
37th Conference on Neural Information Processing Systems (NcurIPS 2023).

---

value of every text generated by their model and retrieve it by request. This approach works even for a perfect text generator indistinguishable from human writing, but it does not apply to publicly available models, and plenty of them already exist.
14
don't
have
12
10
8
lenguego
model
6
everything
opinion
4
Human GPT-3.5
(a) Al generated
(b) human written
(c)
Figure 1: Real and artificial text have different intrinsic dimension: (a-b) idea; (c) actual results.
In this work, we show that the intrinsic dimension of text samples can serve as a helpful score function allowing separate artificial and generated texts in very general setting, without additional knowledge about the generator. The only assumption is that generation is good enough to create fluent grammatical samples of length 200 words. We propose method based persistent homology dimension theory, which allows to estimate the dimension of text samples with high accuracy, and show that the proposed fimension-basee classifier outperforms other artificial text detectors with large margin in the general-purposs setup, for a very wide class of generators.
Many works have estimated the intrinsic dimension of data representations [Pope et al., 2021 Barannikov et al., 2021], neural network weights [Ansuini et al. 2019]. or parameters needed to adapt some downstream task (Aghajanyan et al. 2021]. but these objects are very complex. Even we are certain that a dataset fits into some surface in a high- high-dimensional feature space, is not easy to estimate its dimension due to various kinds of noise (natural irregularities, measurement noise, numerical approximations) and the ambiguity of estimating a surface from a sparse set of points.
We estimate the geometry of every text sample as separate object. Since texts generated by modern L.MS are fluent and usually do not contain grammatical, syntactical, or local semantic inconsistencies, we are interested in global sample geometry rather than properties that could be detected over short text spans. We show that the persistent dimension estimator provides an excellent way to deal with textual data: it turns out that real texts have higher intrinsic dimension than artificial ones (Fig. [ We propose an efficient method to implement the estimator and evaluate its classification ability in various settings, proving its robustness for artificial texts detection and showing that it works equally well across a number of different languages.
Our main contributions are thus follows: (1) we propose to estimate the intrinsic dimensionality of natural language texts with the persistent homology dimension estimator and develop an efficient algorithm for computing it; (2) we show that the intrinsic dimension serves as good score for artificial text detection for modern LLMs; cross-domain and cross- moosl settings our method outperforms other general purpose classifiers by large margin, is robust to adversarial attacks, and works for all considered languages; (3) we show that our text detector reduces the bias against non-native speakers in comparison to available ATD models; (4) we release multilingual dataset of generations produced by GPT-3.5 and natural texts from the same domain order to enable further ATD research. Below, Section revieww related work, Section introduuss instrinsic dimension and its estimation with persistent homology, Section presents our experimental evaluation, Section 6 discusses the limitations, and Section concludes the paper.
4 applics it to artificial text detection, Section [
Related work
Artificial text detection (ATD) becomes increasingly important with modern LLMs. GPT-2 RRdffodd jet al, 2019) was accompanied by a work by [Solaiman al. [2019) on potential dangers and defences against them; the best ATD classifier there was based supervised fine-tuning of RoBERTa Liu ct al.)

---

2019]. Supervised approaches can work well for other generative models and data domains (Krishna et al, 2023 Guo al., 2023 He et al. 2023] but they do not generalize to other text domains, generation models, and even sampling strategies [Bakhtin et al.) 2019, Solliman et al., 2019]. In the zero-shot setting, [Solaiman et al. (2019) threshold the average log- log-probability score of a sample calculated by some pretrained language model (LM). DetectGPT [Mitchell et al. [023] treats log- probability calculation as a function, estimates its curvature in a small neighbourhood of the text, and shows that this curvature score is smaller for artificial texts (there are "flat" regions around them); however, DetectGPT needs the likelihood to come from the same LM as the sample.
We focus on developing an ATD model that could generalized to unseen text generation models and domains. Zellers et al. [2019] detect generated texts perfectly with a discriminator model built on top of the generator, but the quality drops significantly when the generator changes, even with supervised adaptation; a similar "model detects itself" setup was adopted by Mitchell et al. [003).. Solaiman et al. [2019] show that a simple score-based approach by the likelihood score works well in the "model detects itself" setting but does not generalize to different generator and discriminator; as for transferability, they show that supervised classifier generalizes well when it is trained on the output of a more complex model and transferred to a less complex one but not in the reverse direction. Bakhtin et al. [019]] consider different types of generalization: in-domain (train and test generators are the same), cross-corpus (train and text generators fine-tuned on different corpora), and cross-architecture (train and test generators have different architectures but the same training corpora); their model shows good in-domain generalization ability, handles relatively well cross-aie cooos-architecture
generalization, but loses quality in corpus generalization. Mitchell et al. [023] demonstrate the stability of their method over text domains compared to supervised models, which are better on in-domain data but lose efficiency in cross-domain setting. Finally, Krishna et al.
2023) show all
methods failing dramatically against the DIPPER paraphrase attack (except for a lower- pewr-pperooming
approach developed for text quality ranking (Krishna et al., (2022) ) We also note work by Liang et al. (2223) who show the bias of artificial text detectors against non-native speakers and show that all existing detectors can be broken by generating texts with controllable complexity.
Geometrical and topological methods have shown their usefulness for analysing the intrinsic dimen- sionality of data representations. Some works focus data manifolds (Pope et al.) |021 Barannikov ctt al. 2021] and others consider hidden representations and other parts of neural networks and investigate through the lens of intrinsic dimensionality. [i et al. [2018) define the intrinsic dimension of objective landscape by tracking the subspace dimension and performance of a neural network, while Zhu et al. [2018] use manifold dimension directly to regularize the model. Ansuini al.) 2019 apply TwoNN to internal representations in CNNs and establish a connection to the model's generalization ability. [Birdal al. [202]] show that the generalization error of these models can be bounded via persistent homology dimension. Vision transformers were also investigated by Xue et al.
[2022] and Magai and Ayzenberg [2022]. Moreover. intrinsic dimensionality has been connected
to the generalization of Transtormer-basee LLMs (Aghajanyan et al.) 2021]. Valeriani et al. [2023] analyze the intrinsic dimensionality of large Transformer- models. Topological properties the inner representations of Transformer-baat based models (Vaswani et al. 2017). including BERT (Devlin
et al., [019]] and HuBERT (Hsu et al., [021]. have been successfully applied for solving a wide variety of tasks, from artificial text detection [Kushnareva et al. [2021] and acceptability judgement (Cherniavski et al. 2022) to speech processing [Tulchinskii et al. 2023).
3 Intrinsic dimension and persistent homology dimension
Informally speaking, the intrinsic dimension of some subset S C RR" is the number of degrees of freedom that a point moving inside has. This means that in a small neighbourhood of every point, the set S can be described as a function of d parameters, d < n, and this number cannot be reduced. This idea is formalized in the notion of d'dimensional manifold in IR:: it is a subset M C R" such that for every point E M there exists open neighborhood which is equivalent to an open ball in Rd for some value d. Importantly, if M is a connected set then d should be the same for all its points, so we can talk about the dimension of the entire manifold.
Data representations often use excessive numbers of features, some of which are highly correlated. This overparametrization has been noticed many times [Hein and Audibert (005) Kuleshov et al. 2017 [Pope et al., 202T], and the idea that real data lies (approximately) on some low-dimensional manifold in the feature space is known as the manifold hypothesis [Goodfellow et al. 2016). However,
3

---

there are obstacles to estimating the intrinsic dimension of a dataset. First, a real dataset can be combination of sets of different dimensions. Second, data can be noisy and may contain outliers. Moreover, real data can have a complicated hierarchical structure, so different approximation methods lead to different intrinsic dimension values. For an analogy, consider the observations of a single spiral galaxy that consists of separate points (stars, planets etc.) but forms compact 3- 3-dimensional manifold. At some level of approximation the galaxy looks like a disk, which is 2-dimensional, but if we take closer look we discover the structure of 3-dimensional core and basically 1 1-dimensional arms. Moreover, if we add observations over time, the dataset will consist of I-dimensional trajectories of individual points that exactly correspond to well-defined mathematical trajectories (the noise here comes only from measurement errors); these trajectories form an approximate 3-dimensional cylinder in 4-dimensional space with much higher level of noise around its borders. As a result, the dimension of the entire object can be estimated by any number from 1 to 4 depending on the detector's sensitivity noise and outliers, preference for global or local features, and the way to average the values of the non-uniform distribution of the points.
Thus, it is natural that there exist several different methods for intrinsic dimension (ID) estimation, and we have to choose the one most suitable for the task at hand. For example, many ID estimators are based on constructing a global mapping of the data into lower-dimensional linear subspace, with either linear projection (e.g., PCA), kernel-based methods, or distance- preaaerrrng nonlinear transformations. However, in our preliminary experiments these types of dimension estimation seemed to be losing information that was key for artificial text detection.
We focus on the persistent homology dimension estimator (PHD) [Schweinhart 2021). which belongs to the class of fractal dimension approaches. Consider a ball of radius r inside a d-dimensional manifold M. As r grows, the volume of the ball increases proportionally to rd. Let æ1,,.., .N be points uniformly sampled from M. Then the expected number of points in a ball of radius r also changes as rd with r. Naturally, real datasets usually do not correspond to uniform distribution of points, but this issue can be overcome by considering the asymptotic behaviour of the number of points in an r-ball as + 0. In this case, it suffices for the data distribution to be smooth and therefore close to uniform in the neighbourhood of every point. Accurate straightforward estimation of d based the above observation is not cample-efficient but there exist several approximate approaches, including the MLE dimension that evaluates the data likelihood [Levina and Bickel 2004). the TwoNN dimension that uses the expected ratio of distances from given point its two nearest neighbours (Facco et al. 2017]. and MADA [Farahmand et al.] 2007) that uses the first order expansion of the probability mass function. We also report MLE-based results as its performance is comparable to PHD in some tasks.
We propose to use persistence homology dimension (PHD) that has several appealing properties compared to other fractal intrinsic dimension estimators. First, the above methods operate locally while PHD combines local and global properties of the dataset. Second, according to our experiments, this method is sample-efficient and redundant to noise (see below). Third, it has a solid theoretical background that connects topological data analysis, combinatorics, and fractal geometry [Adams
et al.
2020 Birdal et al.) 2021 Jaquette and Schweinhart 2020. [Schweinhart] 2021].
The formal definition of PHD is based on the concept of persistent homology for set of points in metric space, which is a basic notion of topological data analysis (TDA) [Chazal and Michel
2017 Barannikov] 1994 2021]. TDA aims to recover the underlying continuous shape for set of points by filling in the gaps between them that are smaller than some threshold and studying the topological features of the resulting object as increases. Each persistent homology PH, in sequence O-dimensional features
PH,, PH, is defined by the set of featuurs of dimension connected components, 1-dimensional features are non-tre trivial cycles, 2-dimension features are tunnels, etc. For each feature we calculate its "lifespan", a pair (tbirth tdeath), where tbirth is the minimal threshold where the feature arises, and Edeath is the threshold where it is destroyed.
features
Following Adams et al.) [2020), we introduce the persistent homology dimension as follows. Con- sider a set of points X !........ ØN} C I We define the a-weighted sum as Ex ExePH,(x) [ where /(7) = Ieeath (7) - bbirth (7) is the lifespan of feature 7. For i = 0, E
can be expressed in terms of the minimal spanning tree (MST) of X: its edges map to lifespans of O-dimensional features 7 E PHo(X) [Bauer 202 Birdal et al. 202 J. Thus, the definition of Ed (X) is equivalent to (X) = ><eMsT(X) e where |e| is the length of edge e.

---

Without noise
Noise 0.15-U(-0.5,00
Naise 0.3-U'- U/-0.5,0.35
45
MADA
40
TwoNh
Mean N Erotr
38
PHidim
30
28-
20-
200
400
600
800
1000
200
400
500
800
1000
200
400
600
800
1030
sampless
sasmpllss
sasmpless
Figure 2: A comparison ID estimators with noise on artificial datasets; lower better.
There is classical result on the growth rate of (X) Steele 1988]: if zi. 0 < OC are independent random variables with distribution having compact support in Ed then with probability one (X) ~ On d=o as n + oc, where equivalence means that the ratio of the terms tends to one. It shows that EG tends to infinity with N if and only if < d. Now one define the intrinsic dimension based on MST as the minimal value of a for which the score is bounded for finite samples of points from M (Schweinhart 2021]
dimMsT (M) inf EC such that (X) S C for every finite X M),
and PH dimension
dimpu(M) inf [d] 3C such that (X) S C for every finite X C MM.
We now see that (MIMss((M) dimpH(MM) for any manifold M. This fact, together with the growth rate result above, provides a sample-efficient way to estimate dimp (M) [Birdal et al. 202I]: sample subsets X,,, {....... Lp... C M of n, elements for a growing sequence of n., for every subset find its MST and calculate E. (X.,), and then estimate the exponent of the growth rate of the resulting sequence by linear regression between log E (Xn;) and log n, since we know that log E (Xm..) ~ (1 2) logn; n. Ö as n. Co.
Next, we show empirically that our method of ID estimation via PHD approximates the real dimension of manifold well and well suited for the conditions mentioned earlier: presence of noise and small number of samples. To compare with other ID estimators, we utilize a benchmark by [Campadelli al. 2015) designed specifically for the evaluation of ID estimation methods and used the seikit- dimensions library [Bac et al. 2021 with efficient implementations of 12 different approaches to II) estimation, popular for different tasks. We evaluated many of these approaches on artificial datasets from Bac et al. [021]) 1000 samples each, without noise. Choosing three "winners" MLEF, TwoNN, and MADA.-W we have evaluated their sample efficiency and noise tolerance in comparison with our implementation of the PHD estimator. Fig. 2 shows the results: PHD is the only method tolerant to noise, and it does not degrade when data scarce. outperforms all other methods the noisy setup for any sample size. The second-bes method is MLE, which performs relatively well on small samples (200-500) in noisy settings and has a small variance. Below we will show that as a result, MLE is also applicable to artificial text detection, but it lags a little behind PHD average.
Methodology
We consider consistent text samples of medium size, with length s 300 tokens; we assume that each text contains a complete thought or is devoted to single topic. We estimate the dimension of each text sample, considering as a separate manifold. To do this, we obtain contextualized embeddings for every token in the text by pretrained Transfromer encoder. In our experiments, we use RoBERTa-base (Liu et al. 2019 for English and XLMM-R [Goyal et al. 2021] for other languages. Fach embedding is numerical vector of a fixed length, so we view it as point in the Fuclidean space. We drop the artificial first and last tokens (<CLS> and <SEP>) and evaluate the persistent homology dimension of the resulting point cloud using the growth rate theorem (see Section 3)
5

---

Table 1: Intrinsic dimensions of English texts of different genres.
Wikipedia articles
Fiction stories (Reddit)
Question answering (Stack Exchange)
PHD
9.491 = 1.010 11.827 = 0.768
9.212 + 1.288
9.594 + 1.29
MLE
11.553 1.197
12.131 = 1.004
Intrinsic dimension (PHD) of English texts generated by different models
Natural texts
GPT-3.5-177 (davinci-0003)
GPT2-1.58
OPT-13B
10
12
14
Figure 3: Boxplots of PHD distributions for different generative models in comparison to human- written text on Wikipedia data. Embeddings are obtained from RoBERTa-base.
Given set of points S. |S| = n,, we first sample subsets S; C -Si=l,..... whose sizes Ri, nig uniformly distributed in [1, r2). For each S; we calculate its persistent score (S:) (just E(S)) below); this can done with classical MST algorithm in linear time. Then we prepare a dataset consisting of l pairs D {(log r4, log E(S,)) and apply linear regression to approximate this set by a line. Now the dimension d can be estimated as I-x' where x is the slope of the fitted line.
In general, method for PHD calculation is similar the the computational scheme proposed by Birdal et al. [2021]. But since we are dealing with sets that are much smaller and less uniformly distributed, their algorithm becomes unstable, with variance up to 35% of the value from different random seeds; moreover, if one of the subsets S; slips into local density peak and has an unusually low persistence score, the algorithm may even produce meaningless answer (e.g., negative d).
To overcome this issue, we add several rounds of sampling and averaging to improve the stability of calculation. We estimate the expectation [ [s)) (E() for given n; instead of direct calculation of E(S)) for single sample. For that, perform the whole process of computing d several times, averaging the results. Details of our sampling schema can be found in the Appendix.
Finally, we construct simple single-feature classifier for artificial text detection with PHD as the feature, training logistic regression on some dataset of real and generated texts.
5 Experiments
Datasets. Our main dataset of human texts is Wiki40b [Guo et al. 2020]. We measured intrinsic dimension of fiction stories on the target split of the WritingPrompts dataset [Fan al., 2018). collection of short texts written by Reddit users. For multilingual text detection experiments, we generated new WikiM dataset for 10 languages by GPT3.5-turbo (ChatGPT). We use the header and first sentence from a Wikipedia page as the prompt and ask the model to continue. In cross-domain and paraphrase robustness experiments, we use Wiki and Reddit datasets (3k samples each) (Krishna et al. 2023) that use two consecutive sentences (Wiki) the question (Reddit) as prompt and generate texts by GPT2-XL, OРT13b, and GPT3.5 (text-davinci-003: Following their pipeline for Reddit, we have also generated StackExchange dataset by GPT3.5 (text-davinci-003) the third domain. We select questions posted after 2019-08-01 from non-technical categories, where both question and answer have rating more then 10, and clean them removing HTML artifacts. In order to assess the bias in our estimator, we use the data provided by Liang et al. 2023
Intrinsic dimensionality of real and generated texts. First, we observe an intriguing fact: the intrinsic dimension of natural texts mostly concentrated between values 9 and 10, while the dimension of generated texts is lower and is approximately equal to 8, regardless of the generator. shows that this value stable across different text genres but slightly varies for different languages: it is approximately equal to 9 + 1 for most European languages,
This is illustrated in Figure 3 Table [

---

Intrinsic dimension (PHD) of texts in different languages
Chinese
Japanese
Metnamese
Arabic
French
Russian
Ukranian
English
German
Polish
Spanish
Italian
10
11
12
13
14
Figure 4: Boxplots of PHD distributions in different languages on Wikipedia data. Embeddings obtained from XLM-RRBERTaa-baa (multilingual).
Intrinsic dimension (PHD) of embeddings from different Language Models
DistiBERT-oase
BeRT-oase
XLM-Re3IRTaasase
Rc3ERTe-ease
RoBERlb-large
9
10
11
12
13
14
Figure 5: Boxplots of PHD distributions obtained by different LMs on English Wikipedia data.
slightly larger for Italian and Spanish (>= 10 + 1), and lower for Chinese and Japanese (s= 7 1); details are shown in Fig. 4 But we always observe a clear difference between this distribution and generated texts on the same language (see Appendix for more experiments).
Next, check how the PHD estimation depends the base model that calculation. Fig. deemonssttsss that PHD changes slightly with the change of the base LM, decreasing for models with fewer parameters. RoBERTa-bass embeddings provide the best variance for PHD estimation, so we use this model for all further experiments in English, and XLM-R of the same size for multilingual experiments.
for text embedding
Artificial text detection. We show that intrinsic dimension can lead a robust method artificial text detection. In all experiments below, use the one-fcature thresholding classifier (see Section 4
Comparison with universal detectors. First, we show that our detector is the best among general- purpose methods designed to detect texts of any domain, generated by any Al model, without access to the generator itself. Such methods are needed, e.g., for plagiarism detection. To be applicable real life, the algorithm should provide high artificial text detection rate while avoiding false accusations of real authors. Besides, it should resistant to adversaries who transform the content generated by popular AI models to reduce the chance to be caught.
Here we adopt the experimental settings by Krishna et al. [023 and use the baseline results presented there. We compare PHD and MLE with two general- purpose detectors: GPTZero (Tian 2023), targeted to detect the texts generated by contemporary LLMs (GPT-3, GPT-4, ChatGPT, BARD), and OpenAl detector [OpenAl 2023 announced together with the ChatGPT model in order to reduce its expected social harm. Our third baseline DetectGPT [Mitchell al. [023]. which is state of the art thresholding classifier that evaluates text samples by the probability curvature obtained
generator model. works best when the base model coincides with the generator model ("model detects itself") but the authors claim that it can generalize to cross-model setup with reasonable quality. RankGen [Krishna al. 2022] a method originally developed for ranking hypotheses during text generation; demonstrates surprising ability to handle adversarial attacks.

---

Table Artificial text detection (accuracy at 1% FPR) for open-ended generation using Wikipedia prompts. DIPPER was run with Lex=60, Order-60.
Existing Solutions OpenAl
Our methods
Generator
DetectGPT
GPTZero
RankGen
PHD
MLE
GPT-2
70.3*
21.6
13.9
13.5
25.2
23.8
+ DIPPER
4.6
14.8
1.2
28.5
27.6
19.7
OPT
14.3
11.3
8.7
3.2
28.0
26.7
DIPPER
0.3
10.0
1.0
13.5
30.2
22.1
GPT-3.5
0.0
30.0
7.1
1.2
40.0
46.7
DIPPER
0.0
15.6
1.8
7.3
41.2
33.3
Following Krishna et al. 2023 we report the detection accuracy with false positive rate (FPR) fixed at 1%. Table shows that our PHD-based classifier outperforms all baselines with a large margin: +10% for GIT--355, + +14 for OPT. Note that DetectGPT uses GPT-2 as the base model, which explains its results for GPT-2. PHD is also invulnerable to the DIPPER paraphrasing attack (Krishnal al. 2023]. When generated texts are transformed by DIPPER, they lose some characteristic features of the generator, which causes a dramatic drop in quality for most detectors; but for the PHD classifier the accuracy of artificial text detection even increases slightly after this perturbation. Interestingly, the MLE dimension estimator also works quite well for this task, and even achieves 6% better detection for GPT-3.5 generations; but its adversarial robustness is significantly worse.
Cross-domain and cross-model performance. Table 3 shows that our ID estimation is stable across text domains; consequently, our proposed PHD text detector is robust domain transfer. We compare the cross-domain ability of PHD with a supervised classifier obtained by fine-tuning RoBERTa- base with linear classification head on its CLS token, a supervised classification approach used previously for artificial texts detection with very high in-domain accuracy [Solaiman et al. 2019 Guo al. 2023 He al. 2023]. We split data into train / validation test sets in proportion 80%/100% 10%. Table 3 reports the results of the classifier's 's transfer between three datasets of different text stylestllonse long-form answers collected from Reddit, Wikipedia-style texts, and answers from StackExchange using data generated by GPT-3.5 (text-davinci-003. Although supervised classification is virtually perfect on in-domain data, fails cross-domain evaluation, while the PHD classifier is not influenced by domain transfer. On average, the PHD classifier slightly outperforms the supervised baseline, while being much more stable. Table also reports cross-mode transfer ability, where the classifier is trained on the output of one generation model and tested on another. We consider generations of GPT-2, OPT, and GPT-3.5 (text-davinci-003) in the Wikipedia domain and observe that the PHD classifier, again, is perfectly stable. This time, RoBERTa- classifier handles the domain shift much better and outperforms PHD on average, but has a higher cross- cross-domain generalization gap. This means that we expect the PHD classifier to be more robust to entirely new AI models.
supervised
PHD-based classification for other languages. Table 4 presents the results of PHD-based artificial text detection for Wikipedia style texts generated by ChatGPT in 10 languages. Text embeddings were obtained with XLM-RoBLL Roo--RooETTaaaaa we report the area under ROC-curve (ROC-AUC). We see that both ID classifiers provide solid results for all considered languages, with the average quality of 0.78 for PHD and 0.8 for MLE; MLE performs better for almost all languages. The worst quality is on Chinese and Japanese (PHD 0.71 and 0.74, MIEE 0.65 and 0.75 respectively). the best is for Spanish and Italian (PHD 0.83, MLE 0.85 for both). Note that the best and worst classified languages are those with the largest and smallest ID values in Fig. 4 we leave the investigation of this phenomenon for further research.
the multilingual version of RoBERTa. As quality metric
Non-native speaker bias. Finally, we show how our model helps to mitigate the bias present in ML-based artificial text detectors. We follow Liang et al. (2023) who demonstrate that current artificial text detectors are often too hard on texts written by non-native speakers. We use OpenAl and GPTZero as the baselines (see Appendix for more results) and PHD and MLE classifiers, choosing the thresholds was chosen on data unrelated to this task, as the equal error classifier on introductions of Wikipedia articles (real vs GPT-3.5-tuubbe -ttrbo) where it achieved EER of 26.8% for PHD and 22.5% for MLE. On the left, Fig. shows false positive rates (FPR) for three sets of student essays: TOEFI essays by non-native speakers (red), same texts processed by GPT-4 asked to improve the text (grey),
8

---

Table 3: Cross-domain and cross cross-model accuracy of PHD and RoBERTa-baan classifiers on data from three different domains and three different models; classes are balanced in training and evaluation.
RoBERTa-cls
Intrinsic Dimension (PHD)
Train \ Eval
Wikipedia
Reddit StackExchange
Wikipedia Reddit StackExchange
Wikipedia
0.990
0.535
0.690
0.843
0.781
0.795
Reddit
0.388
0.997
0.457
0,855
0.776
0.773
StackFxchange
0.525
0.473
0.999
0.834
0.778
0.800
Train Eval
GPT2
OPT
GPT3.5
GPT2
OPT
GPT3.5
GPT2
0.992
0.993
0.933
0.769
0.759
0.832
OPT
0.988
0.997
0.967
0.769
0.763
0.837
GPT3.5
0.937
0.982
0.990
0.759
0.757
0.843
Table 4: Quality of artificial text detection in different languages (ROC-AUC) for ChatGPT text.
Language:
en-zh
en
fr
de
it
jp
pl
ru
uk
PHD
0.709
0.781
0.790
0.767
0.831
0.737
0.794
0.777
0.833
0.768
MLE
0.650
0.770
0.804
0.788
0,852
0.753
0.850
0.816
0.853
0.821
Human written mis classified Al
Correctly classified as Al-generated
OpenA
4.0%
58.0%
OpenA
10.0%
41.00 0%
ChalGPT-3,5
0.0%
prompt design
GPTZero
1.0%
19.0%
52.0%
GPTZero
1.0%
14.0%
PHD
7.7%
26.4%
Roal TOBEL Essays
72.4%
0.0%
33.0%
GPT polishing
MLE
0.0%
10.7%
Admission Essays
Real US College
MLE
57.2%
73.1%
20
40
60
80
100
0
20
40
60
80
100
Figure 6: Comparison of GPT detectors in non-standard environment. Left: bias against non-native English writing samples (the lower is better). Right: effect of the prompt design on performance (the higher is better).
and native speakers (blue). First, blue bars are almost invisible for all detectors because the FPR for a native speaker is very small (< 1%) while non-native speakers can be wrongly accused by OpenAl and GPTZero in 58% and 52% of the cases respectively. The PHD classifier reduces this discriminating rate by 2x, showing FPR 26% for non-native speakers. After GPT-4 polishing, this rate further decreases to 7.7% compared to 19% for GPTZero. Interestingly, OpenAl also deals with GPT-4 polished texts suprisingly well, its FPR drops by 15x. The MLE detector also demonstrates less biased behaviour compared to baselines, but worse than PHD.
On the right, Fig. 6 shows the true positive rates (TPR) of these methods essays generated by ChatGPT. Red bars show that our classifiers greatly outperform baselines. Grey bars demonstrate the robustness of ID detectors changes in generation style via prompt design. If an adversary asks ChatGPT to generate a text with some predefined level of complexity ("use simple words", or "more complex words"), baseline systems fail to correctly recognize such texts while both ID classifiers still yield high detection rates.
Analysis of edge cases. We noticed interesting tendency among the human- written passages with the lowest ID (misclassified as Al-generated). seems that most of these examples contain a lot of addresses, geographical names, proper nouns; some texts, however, hypothesize that it can be related to an unusually high number of rare tokens or numbers in the text and that PH dimension estimation is overall less correct on short texts. Besides, Davinci- Davinci-generated texts with the highest ID (misclassified as numan-writter with the most certainty) are also often quite short. We leave a more comprehensive analysis of such failure cases for future work.
typical but very short. We
We provide examples of both types of misclassified texts in Appendix of the PHD of artificially created texts made from random tokens and texts composed by repeating the
F Moreover, we show bar plots

---

One can see that the simplest samples have the lowest ID, and the highest values of ID correspond completely random texts. This supports the general understanding of ID as the number of degrees of freedom in the data.
same token in Figure 11
6 Limitations and broader impact
We see three main limitations of our method, First, is stochastic in nature. PH dimensions of texts from the same generator vary widely, and the estimation algorithm is stochastic well, which adds noise, while rerolling the estimation several times would slow down the method. Second, "out of the box" our method can detect only "good" (fluent) generators with relatively small temperature of generation. The PH dimension of "bad" or high-temperatuur generators is actually higher on average than for real texts, the detector will need to be recalibrated. Third, we have only evaluated our approach on several relatively high-resource languages and we do not know how the method transfers to low-resoure languages; this is direction for future work. Nevertheless, a new tool for recognizing fake content without discriminating non-native speakers, which is also much more robust to model change and domain change than known tools.
method provides
7 Conclusion
In this work, we have introduced a novel approach to estimating the intrinsic dimension of a text sample. We find that this dimension is approximately the same for all human-written samples in given language, while texts produced by modern LLMs have lower dimension on average, which allows us construct an artificial text detector. Our comprehensive experimental study proves the robustness of this classifier to domain shift, model shift, and adversarial attacks. We believe that we have discovered new interesting feature of neural text representations that warrants further study.
Acknowledgments and Disclosure of Funding
The work of Evgeny Burnaev was supported by the Russian Foundation for Basic Research grant 21-51-12005 NNIO_a.
References
H. Adams, M. Aminian, E. Farnell, M. Kirby, J. Mirth, R. Neville, C. Peterson, and C. Shonkwiler. A fractal dimension for measures via persistent homology. In Topological Data Analysis: The Abel Symposium 2018, pages 1-31. Springer, 2020.
D. I. Adelani, H. Mai, F. Fang. H. H. Nguyen, J. Yamagishi, and I. Echizen. Generating sentiment- sentiment-preservigg preserving fake online reviews using neural language models and their human-an and machine- based detection. In Advanced Information Networking and Applications: Proceedings of the 34th International Conference Advanced Information Networking and Applications (AINA-2020), pages 1341-1354. Springer, 2020.
A. Aghajanyan, S. Gupta, and I.. Zeutlemyer. Intrinsic dimensionality explains the effectiveness of language model fine-tuning. In Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the l 1th International Joint Conference on Natural Languag Processing (Volume Long Pupers), pages 7319-7328, Online, Aug. 2021. Association for Computational Linguistics. doi: 10.18663/v111 1/202/ acl-long. 568. URL http::: ptttp:://aclanthooggg org/ 2021. acn-long, 568
L. Albergante, J. Bac, and A. Zinovyev. Estimating the effective dimension of large biological datasets using fisher separability analysis. pages 8, 07 2019, doi: 10.1 119/1I....20199...010 90188..4
L. Amsaleg, O. Chelly, T. Furon, S. Girard, M. Houle, K.-i. Kawarabayashi, and M. Nett. Extreme-value- theoretic estimation of local intrinsic dimensionality, Data Mining and Knoweledge Discovery, 32(2);1-38, November 2018 doi: 10. 10.1007/s100 100-006000000----66666
L. Amsaleg, O. Chelly, M. Houle, K.-i. Kawarabayashi, M. Radovanovic, and W. Treeratanajaru. Intrinsic dimensionality estimation within tight localities. pages 181-189, 05 2019. ISBN 978-1-61197-567-3 doi: 10. 19111777197811111776772111111
A. Ansuini, A. Laio. J. H. Macke, and D. Zoccolan. Intrinsic dimension of data representations in deep neural networks. Advances in Neural Information Processing Systems, 32, 2019.
10

---

J. Bac, E. M. Mirkes, A. N. Gorban, I. Tyukin, and A. Zinovyev. Scikit-dimension: python package for intrinsic dimension estimation. Entropy, 23(10):136, 2021. 2021.
A. Bakhtin, S. Gross, M. Ott, Y. Deng. M. Ranzato, and A. Szlam. Real or fake? learning to discriminate machine from human generated text. arXiv preprint arXiv:1906.0333 03351, 2019.
S. Barannikov. The framed Morse complex and its invariants. Advances in Soviet Mathematics, 21:93-115, 1994.
S. Barannikov. Canonical Forms = Persistence Diagrams. Tutorial. In European Workshop Computational Geometry (EuroCG 2021), 2021.
S. Barannikov, 1. Trofimov, G. Sotnikov, E. Trimbach, A. Korotin, A. Filippov, and E. Burnaev. Manifold topology divergence: framework for comparing data manifolds. In Advances in Neural Information Processing Systems, volume 34, pages 7294 7305, 2021. URL htttps://proceedingg nwwrips....... .c/ pdf
U. Bauer. Ripser: efficient computation of Vietoris-Ripp persistence barcodes. Appl. Comput. Topol., 5(3): 391 491-423, 2021. ISSN 2367-1726. doi: 10. 10.1007//414463///0 10.10077/44--6--00---00011---111 URL org/ 1007/
141468-021-0000
Birdal, A. Lou, L. Guibas, and U. Simsekli. Intrinsic dimension, persistent homology and generalization in neural networks. Advances in Neural Information Processing Systems, 34:6776-6789, 2021.
Campadelli, F. Casiraghi, Ceruti, and Rozza, Intrinsic dimension estimation: Relevant techniques and benchmark framework. Mathematical Problems in Engineering, 2015:1-21, 2015. 2015.
R. Cangelosi A. Goriely. Component retention principal component analysis with application to edna microaray data. Biology Direct, 2, Jamuary 2007. doi: 10. 765-765665----
K. Carter, Raich, and A. Hero. On local intrinsic dimension estimation and applications. Signal Processing. IEEE Trunsactions on, 58:650 - 663, 03 2010. doi: 10. 11100/TSP.20022337222..
Chazal and Michel. An introduction topological data analysis: fundamental and practical aspects for data scientists. arXiv preprint vrXiv:1710.04000 2017.
D. Cherniavskii, Tulchinskii, V. Mikhailov. I. Proskurina, L. Kushnareva, Artemova, Barannikov, Piontkovskaya, D. Piontkovski, and E. Burnaev. Acceptability judgements via examining the topology of attention maps. In Findings of the Association for Computational Linguistics: EMNLP 2022, pages 807107, Abu Dhabi, United Arab Emirates, Dec. 2022, Association for Computational Linguistics. URL https://aclaanthology org 2022. findings- emnlp.7
J. Devlin, M.-W. Chang, K. Lee, and K. Toutanova. BERT: Pre-training of deep bidirectional transformers language understanding. In Proceedings of the 2019 Conference the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume / (Long and Short Pupers), pages 4171-4186, Minneapolis, Minnesota, June 2019. Association for Computational Linguistics. doi: 10. 10.18853/v1/NII 1/N19-1423. URL htt.:: htttps::/aclanttoollgg..o wwwpgg..oo............. 11///11919111 1423
E. Facco, M. d' L'Ericc,, A. Rodriguez, and A. Laio. Estimating the intrinsic dimension of datasets by minimal neighborhood information. Scientific Reports, 7, 09 2017. doi: 10.
T. Fagni, F. Falchi, M. Gambini, A. Martella, and M. Tesconi. Tweepfake: About detecting deepfake tweets. Plas one, 16(5)ee021441,, 2021.
A. Fan, M. Lewis, and D. Yann. Hierarchical neural story generation. arXiv preprint arXiv: 1805.0483: 2018.
A.-m. Farahmand, C. Szepesvári, and J.-Y. J.-Y. Audibert. Manifold-adaptive dimension estimation. volume 227, pages (65-272,00 06 2007. doi: 10. 21144/127349..12255533
Gehrmann, Strobelt, and A. M. Rush. Gltr: Statistical detection and visualization of generated text. In Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics: System Demonstrations, pages 111-116 2019.
L. Goodfellow, Y. Bengio, and A. Courville. Deep Learning. deeplearningbook. org
MIT Press, 2016.
http://we //ww
N. Goyal, J. Du. M. Ott. G. Anantharaman, and A. Conneau. Larger-scale transformers for multilingual masked language modeling. In Proceedings of the 6th Workshop on Representation Learning for NLP PRepL4NLP-202111 pages 23,33, 2021.

---

P. Grassberger and I. Procaccia. Measuring the strangeness of strange attractors. volume 9, pages 189-208, 1983. doi: 10. 2019.885440.
B. Guo, X. Zhang, Z. Wang. M. Jiang. J. Nie, Y. Ding. J. Yue, and Y. Wu. How close is ChatGPT human experts? comparison corpus, evaluation, and detection. arXiv preprint arXiv:2301. 075977 2023.
M. Guo, Dai, D. Vrandečié, and R. AI-Rfou. Wiki-40B: Multilingual language model dataset. In Proceedings of the Twelfth Language Resources and Evaluation Conference, pages 2440-2452, Mar- seille, France, May 2020. European Language Resources Association. ISBN 979-10-95546-3444 URL
orgoorgg//0 1rec- 197
X. He, X. Shen, Z. Chen, M. Backes, and Y. Zhang. Mgtbench: Benchmarking machine- generated text detection. arXiv preprint arXtv:2303. 14822, 2023.
M. Hein and J.-Y. Audibert. Intrinsic dimensionality estimation of submanifolds in rd. In Proceedings of the 22nd International Conference Machine Learning, ICML '05. page 289-296, New York, NY, USA, 2005. Association for Computing Machinery. ISBN 1595931805. doi: 10. 000001..11122355 URL
https:/ org/oo. 1tt.1114/11122555 1102388
W.-N. Hsu, B. Bolte, Y.H.. Tsai, K. Lakhotia, R. Salakhutdinov, and A. Mohamed. Hubert: Self-supervised speech representation learning by masked prediction of hidden units. JEEE/ACM Transactions on Audio, Speech, and Language Processing, PP:1-1, 10 2021. doi: 10. 1090TTALL.22221.322222
J. Jaquette and B. Schweinhart. Fractal dimension estimation with persistent homology: comparative study. Communications in Nonlinear Science and Numerical Simulation, 84:105163, 2020.
J. Kirchenbauer. J. Geiping. Y. Wen, Katz, I. Miers, and T. Goldstein. A watermark for large language models. arXiv preprint arXiv:2301. 102222 2023,
K. Krishna, Y. Chang, J. Wieting, and M. lyyer. Rankgen: Improving generation with large ranking models. arXiv preprint arXiv:2205.00 09726, 2022.
K. Krishna, Song. M. Karpinska, Wieting, and M. lyyer. Paraphrasing evades detectors of ai ai-generated text, but retrieval is an effective defense. arXiv preprint arXiv:2303. 13408, 2023.
A. Kuleshov, A. Bernstein, E. Burnaev, and Y. Yanovich. Machine learning in appearance based robot self- localization. In 2017 16th IEEE International Conference on Machine Learning and Applications (ICMLA), pages 1020-12,2200 2017.
doi: 10.1 OB//CMM...2011.00-17
L. Kushnareva, D. Cherniavskii, V. Mikhailov, E. Artemova, S. Barannikov, A. Bernstein. I. Piontkovskayaa, D. Piontkovski, and E. Burnaev. Artificial text detection via examining the topology of attention maps. In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, pages 635 649, Online and Punta Cana, Dominican Republic, Nov, 2021. 1. Association for Computational Linguistics. doi: 10. NL.18633vv/2222 wwmppp www.lmmmin.500. URL UtLptttss///ccaatthoo
org/202111222 emmlp main. .50
E. Levina and P. Bickel. Maximum likelihood estimation of intrinsic dimension. volume 17, 01 2004.
C. Li, H. Farkhoor, R. Liu, and J. Yosinski. Measuring the intrinsic dimension of objective landscapes. In ICLR (Poster), 2018. WtLphttss////peneeee
W. Liang, M. Yuksekgonul, Y. Mao. E. Wu, and J. Zou, GPT detectors are biased against non-native english writers. In ICLR 2023 Workshop Trustworthy and Reliable Large-Scale Machine Learning Models, 2023.
Y. Liu, M. Ott, N. Goyal, J. Du, M. Joshi, D. Chen, O. Levy, M. Lewis, L. Zettlemoyer, and V. Stoyanov. Roberta: A robustly optimized bert pretraining approach. arXiv preprint arXiv: /907. 16692, 2019.
G. Magai and A. Ayzenberg. Topology and geometry of data manifold in deep learning. arXiv preprint arXiv: 2022.
Mitchell, Y. Lee, A. Khazatsky, C. Manning, and C. Finn. DetectGPT: Zero-shot machine machine-generated text detection using probability curvature. arXiv preprint arXiv:230). 2023.
OpenAl. AI text classifier, 2023. URL/tttss://platoooo wwtpaaffrooooppnaai.oo com/ tettt/tt-teetteee caa.aaaeeeet--ettceccsiiieeeee Accessed: 2023-05-16.
P. Pope. C. Zhu, A. Abdelkader, M. Goldblum, and T. Goldstein. The intrinsic dimension of images and its impact on learning. In International Conference on Learning Representations, 2021. URL https //openreview. net xett:foruum//dxxx.111192222
12

---

A. Radford, J. Wu, R. Child, D. Luan, D. Amodei, and I. Sutskever. Language models are unsupervised multitask learners. 2019.
V. S. Sadasivan, A. Kumar, S. Balasubramanian, W. Wang, and S. Feizi. Can ai-generated text he reliably detected?? arXiv preprint arXiv:2303.11156 2023. 2023.
B. Schweinhart. Persistent homology and the upper box dimension. Discrete & Computational Geometry, 65(2):
331-364, 2021.
I. Solaiman, M. Brundage, J. Clark, A. Askell, A. Herbert- J. Wu, A. Radford, G. Krueger, J. W. Kim, S. Kreps, al. Release strategies and the social impacts of language models, arXiv preprint 1rXiv:190..092000 2019.
J. M. Steele. Growth rates of euclidean minimal spanning with power weighted edges. The Annals of Probability, 16(4):1777-17877 1988.
C. Stokel-Walker. Al bot ChatGPT writes smart essays-should academeiss worry? Nature, 2022.
E. Tian. GPTZero: An AT text detector, 2023. URL. hattps://gptzert me/
Accessed: 2023-05-16.
E. Tulchinskii, K. Kuznetsov, L. Kushnareva, D. Chemiavskii, S. Barannikov, Piontkovskaya, S. Nikolenko, and E. Burnavv. Topological data analysis for speech processing. In Proc. INTERSPEECH 2023, pages 311-315, 2023. doi: 10221457/meespcchh22222--1-
Valeriani, D. Doimo, F. Cuturello, A. Laio, A. Ansuini, and A. Cazzaniga. The geometry of hidden representations large transformer models. CoRR, abs/2302.00294, 2023. URL https:/:p////oooorg 18550/arXiv 2302. 2302.00294
A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, Kaiser, and Polosukhin. Attention is all you need. In Guyon, U. V. Luxburg, S. Bengio, H. Wallach, R. Fergus, S. Vish- wanathan, and R. Garnett, editors, Advances in Neural Information Processing Systems. volume 30. Curran Associates, Inc., 2017. URL https: htttps::/proceeedinng wttp://pp..cpppppp.aaa/ea/////pp
3f5ee4456///611115ccccccaaaa3 Paper. pdf
F. Xue, B. Yang, Y. Qi, and J. Xin. Searching intrinsic dimensions of vision transformers. arXiv preprint arXiv: 2204. 07722, 2022.
R. Zellers, A. Holtzman, HL Rashkin, Y. Bisk, A. Farhadi, F. Roesner, and Y. Choi. Defending against neural fake news. Advances in neural information processing systems, 32, 2019.
W. Zhu, Q Qiu. J. Huang. R. Calderbank, G. Sapiro, and I. Daubechies. Ldmnet: Low dimensional manifold regularized neural networks. 2018 IEEE/CVF Conference on Computer Vision and Puttern Recognition, pages 2743-2751, 2018. doi: 00.1109/CVP..2018.000
13

---

(a) Point cloud concentrated around straight line: PHD R 1.0
(b) Point cloud concentrated around two curved intertwined lined; PHD & 1.5
Figure 7: Example of the difference between intrinsic dimensionality (PHD) of point clouds for different geometric shapes. The point cloud concentrated around a more complex structure (76) has larger PHD than a point cloud concentrated around simpler structure 77a).
A Theory
A.1 Formal definitions of persistent homologies
persistent homology sequence of homology groups and linear maps parameterized by filtration value. Formally speaking, given filtered chain complex (K, @) with filtration values
An < X2 <... < An, we have a sequence of chain complexes: Kx, S Kx2 S Kxz _... C Kx, = K. For each Ag. the i-th homology group (Kx,) denotes the factor vector space H2(K),) ker 0 ketp/ / im Øl x((0- The inclusion K2, S Kxy+= induces linear map fjstt H((K))) 7
H (K By definition, the persistent homology PH; the filtered chain complex the collection of homology groups H; (K,,) and linear maps between them: PH, = {H; (Kx,). faattr Jrrr
By the structure theorem of persistent homology, a filtered chain complex (K, is decomposed into the unique direct sum of standard filtered chain complexes of types [(bp, dp) and I(hp), where I(b, d) is the filtered complex spanned linearly by two elements eb, ed; de, with filtrations es E 1. Ed 1 ((+11) b < and (h) the filtered complex spanned by single element de, = with filtration 6₁ E (()) [Barannikov 1994]. This collection of filtered complexes ((pp,d)) and T(hp)) from the decomposition of is called the ith Persistence Barcode of the filtered complex K. It is represented as the multiset of the intervals [b,, dpl and [h,, +-0). In Section 3 when speak loosely about the persistent homology PH,, we actually mean the ith persistence barcode. In particular, the summation Σxeth, is the summation over the multiset of intervals constituting the ith persistence barcode.
A.2 Equivalence between PS)(S) and MST(S)
For the reader's convenience, we provide a sketch the equivalence between the Oth persistence barcodes and the set of edges in the minimal spanning tree (MST).
First, recall the process of constructing the O-dimensional persistence barcode [Adams et al.) 2020). Given set of points S, we consider simplicial complex K consisting of points and all edges between them (we not need to consider faces of higher order to compute Ho):
{ &y) 3 |st, 8j E S}. Each element in the filtration KNn C Kr,, C K22 C ... C Kx = K contains edges shorter
than the threshold dg: KA, = (S} ((8,, 1,),,, 8j E S,11s; - s,ll < Ax The (1thh persistence barcode is the collection of lifespans of O-dimensional features, which correspond to connected
14

---

components, evaluated with growths of the threshold X. Let us define step-by-step algorithm for evaluating the features' lifespans. We start from À when each point connected component, so all the features are born. We add edges to the complex in increasing order. On each step, we are given a set of connected components and queue of the remaining edges ordered by length. the next edge of length À connects two connected components to each other, we claim the death of the first component and add a new lifespan (0, A) to the persistence barcode; otherwise, we just remove the edge from the queue since its addition to the complex does not influence the Oth barcode.
Now we can notice that this algorithm corresponds exactly to the classical Prim't algorithm for MST construction, where the appearance of new bar (0, A) corresponds to adding an edge of length À to the MST.
B Algorithm for computing the PHD
In Section of the paper, we describe general scheme for the computation of persistence homology dimension (PHD). Here we give more detailed explanation the algorithm.
Input: a set of points S with |S| = n.
Output: (S).
1. Choose ni; (i- ((-()) + á for i I,...k; hence, n1 â and ni n. Value of k may be varied, but we found that k = 8 is a good trade-off between speed of computation and variance of PHD estimation for our data (our sets of points vary between 50 and 510 in size). As for ît, we always used ñi = 40.
I
2. For each in 1, k
(a) Sample J subsets s(1)) .... s of size n.- For all experiments took J 7.
(b) For each s(1) calculate the sum of lengths of intervals in the Oth persistence barcode (s(
(c) Denote by E(S.) the median of EJ (. EL.
3. Prepare a dataset consisting of k pairs D = {log nu; log E(S))) and apply linear regression to approximate this by a line. Let x be the slope of the fitted line.
4. Repeat steps 2-3 two more times for different random seeds, thus obtaining three slope values K1, K2, fi,, and take the final Ky as their average.
5. Estimate the dimension d as T-PF
C A Additional experiments
C.1 Choice of parameters in the formula for PHD
As we have mentioned in Section 3 we estimate the value of persistent homology dimension from the slope of the linear regression between log F% (Xn,) and log n.. Thus, the exact value of PHD of a text actually depends on the non-negative parameter a. The theory requires it to be chosen to be less than the intrinsic dimension of the text, and in all our experiments we fix
1.0.
Figure shows how the exact value of the PHD for natural and generated texts (of approximately the same length) depends on the choice of a. Setting = 1.0 seems to yield reasonable performance, but further investigation of this issue needed.
For a e [0.5; 2.5] our results, in general, lie in line with the experiments by Birdal et al. 2022 where performance of dimp with a varying between 0.5 and 2.5 was studied on different types of data.
C.2 Effect of paraphrasing on intrinsic dimension
As we show Section using paraphrasing tools has little effect on the PHDD-based detector's 's ability to capture the differences between generated and natural texts. Here we show how such tampering
15

---

Effect of parameter a on the dimension estimation
13
Natural text
12
Generated text
11
PHD
10
0.1
03
0.5
07
9
11
13
17
19
21
23
25
27
29
31
33
35
37
41
4.3
45
α
Figure 8: PHD estimates various a for a natural and generated texts.
Table 5: Effect of paraphrasing on the intrinsic dimension of the text. Here we can see an uncommon example of data where MLE and PHD behave differently: paraphrasing does not present much trouble for PHD (its quality even increases marginally), but the performance of the MLE-based detector drops significantly, especially for GPT-3.5.
DIPPER parameters
Lex 20
Lex 40
Lex 60
Method
Original
Lex 20
Lex 40
Lex 60
Order 60
Order 60
Order 60
PHD
7.30
7.33
7.35
7.42
7.45
7.51
7.51
+1.66
+1.69
+116
+1.69
+1.78
#1.76
+1.72
MLE
9.68
9.91
9.90
9.97
9.95
10.00
10.01
+131
+1.22
1.24
#122
#121
#1.18
#1.15
with generated sentences affects their intrinsic dimension. Table Sableeppreeee presents the mean values of PHD and MLE after applying DIPPER with different parameters the generation of GPT-3.5 Davinci. Where the value of Order (re-ordering rate) is not specified, means the was left at the default value O. Both parameters, Lex (lexical diversity rate) and Order, vary from information we refer to the original paper on DIPPER Krishna et al. 2023
100; for additional
Increased lexical diversity entails slight growth in both mean PHD and mean MLE that, in theory, should make our detectors less efficient. In the case PHD-based detector we do not observe this decrease in performance, probably due to the mean shift being indeed rather small and caused mostly by the right tail of the distribution the texts that a high chance of evading detection even before paraphrasing.
Meanwhile, increasing the re-ordering rate from 0 to 60 has almost no noticeable impact.
C.3 Non-native speaker bias
Here we present full results for our experiments on the bias of ML-baaed artificial text detectors. Figure presentss baseline results for all detectors studied by Liang et al. 2023) that were not included into the main text of the paper.
C.4 Intrinsic dimension of texts in different languages
Figure TO presents the PHD of natural and generated texts in different languages on Wikipedia data. Embeddings were obtained from the same multilingual model FLM-RoBERTa-base
16

---

Human-written mis-classified Al
Correctly classified Al-generated
Origina-
iity ai
76.0%
Origina
lity.ai
28.0%
59.0%
Quil.org 1.0%
75.0%
Quil.org
24.0%
57.0%
Sapling
13.0%
58.0%
Sapling
58.0%
68.0%
OpenAl
OpenAl
10.0%
Crosspiag
5.0%
52.0%
Cresspiag
37.0%
CharGiPT-S.S
prompe design
GPTZero
19.0%
52.0%
GPTZero
1.0%
14.0%
48.0%
ZeroGPT
10.0%
ZeroGPT
1.0%
51.0%
26.4%
PHD
7.7%
Real TOFFL Essays
Essays
33.0%
GPT polishing
MLE
10.7%
Real US Co College
Admission Essays
MLE
100
Figure 9: Comparison of GPT detectors in non-standard environment. Left: bias against non-native English writing samples (lower is better). Right: effect of the prompt design on performance (higher better).
Intrinsic dimension (PHD) of texts in different languages
Chinese
Centeraledd
Natural
Japanese
French
Spanish
Russian
Ukrainian
German
Italian
Polish
5
8
9
10
11
12
13
14
Figure 10: Boxplots PHD distributions different languages on Wikipedia data. Emheddings are obtained from XL.MRRBEERTa--e (multilingual).
D Examples of generated texts
Table 6 provides examples of original text and text generated by ChatGPT.
E Examples of misclassified texts
Table provides examples of misclassified human-written texts, while Table shows misclassified texts generated by ChatGPT.
F Various Intrinsic Dimension estimators
Table 2 presents average intrinsic dimension estimations obtained by various algorithms for texts of different genres.
17

---

Table 6: Examples of original text and text generated by ChatGPT. The common prompt parts are highlighted in bold.
Original (English)
Generated (English)
USS Mills (DE-383)
USS Mills (DE-383)
World War II North Atlantic operations After shakedown out of Bermuda, Mills trained nucleus crews for frigates and de- stroyer escorts off Norfolk, Virginia, until 10 January 1944 when she began transat- lantic convoy escort duty. On her second voyage into the Mediterranean, Mills' con- voy was attacked before dawn April 1944, 56 miles west of Algiers by German torpedo bombers. SS Jared Ingersoll, a Liberty ship, was hit and set blazing. Mills picked up sur- vivors who had abandoned ship, and sent boarding party to extinguish her fires. British tug HMS Mindfull and Mills then towed Jared Ingersoll to Algiers.
World War North Atlantic operations After shakedown out of Bermuda, Mills trained nucleus crews for frigates and de- stroyer escorts off Norfolk, Virginia, until 10 January 1944 when she began transat- lantic convoy escort duty. The Mills es- corted her first two convoys in January and February from New York City the United Kingdom, making four round trip crossings by May 1944. During her North Atlantic op- erations, Mills successfully thwarted several attacks by German U-boats, and carried out rescue operations for nearby ships in distress. She also participated in sweeping the area for mines in preparation for the Normandy inva- sion.
Original (Spanish)
Generated (Spanish)
Currulao
Currulao
Instrumentos
Instrumentos
Si la música involuera el uso de una chir- imia que es popular en la costa norte, es- pecíficamente en el Chocó: Tambor tamb- ora, Cununos ("macho") y "hembra") ") y un clarinete. Esta agrupación también puede in- cluir un eufonio que, en algunos casos, reem- plaza acompaña
Si la música involucra el uso de una chir- imia que es popular en costa norte, es- peeíficamente en el Chocó: Tambor tamb- ora, Cununos ("macho") y "hembra"), y un clarinete. El currulao es una danza musical tradicional originaria de la región de la costa Pacífica de Colombia, la cual deriva de la mezela de las culturas africana, indígena española. El sonido del currulao único y se distingue por el uso de instrumentos que otorgan ritmo y cadencia característicos.
saxofón. Si se trata de un grupo de marimba que es popular en el sur de la región, especfficamente Chocó, Valle del Cauca, Cauca y Nariño: la marimba de chonta, los cununos ("hembra") "macho"), guasá y el tambor bajo.
del
Original (Polish)
Generated (Polish)
Juan Machuea
Juan Machuca
Kariera klubowa
Kariera klubowa
Cala karierę pilkarska Juan Machuca spędzit w klubie Unión Española, w którym wystepowal latach 1969-1987. 7. Unión Española trzykrotnie zdobyl mistrzostwo Chile 1973, 1975 1977. Na arenie między- narodowej dotart do finalu Copa Libertadores 1975, którym Unión ulegl argentyfskiieuu Independiente Avellaneda.
Cala karierę pilkarska Juan Machuca spędzit w klubie Unión Española, w którym wystepowal latach 1969-1987. Byl to okres, w którym klub ten odnosit wiele sukcesów, m.in. zdobyt mistrzostwo Chile w 1973 1975 roku oraz Puchar Chile w 1975 roku.
18

---

Source, PHD
Text sample
Human, 5.59
The route, which mostly a two-lane undivided road, passes through mostly rural areas of Atlantic and Cape May counties as well as the communities of Tuckahoe, Corbin City, Estell Manor, and Mays Landing.
Human, 5.82
The Meridian Downtown Historic District is combination of two older districts, the Meridian Urban Center Historic District and the Union Station Historic District. Many architectural styles are present in the districts, most from the late 19th and early 20th centuries, including Queen Anne, Colonial Revival, Italianate, Art Deco, Late Victorian, and bungalow. The districts are: East End Historic District - roughly bounded by 18th St, 11th Ave, 14th St, 14th Ave, 5th St, and 17th Ave. Highlands Historic District roughly bounded by 15th St, 34th Ave, 19th St, and 36th Ave. Meridian Downtown Historic District runs from the former Gulf, Mobile and Ohio Railroad north to 6th St between 18th and 26th Ave, excluding Ragsdale Survey Block 71. Meridian Urban Center Historic District - roughly bounded by 2 and 25th Aves, 6th St, and the railroad. Union Station Historic District roughly bounded by 18th and 19th Aves, 5th St, and the railroad. Merrehope Historic District - roughly bounded by 33rd Ave, 30th Ave, 14th St, and 8th St. Mid-Town Historic District roughly bounded by 23rd Ave, 15th St, 28th Ave, and 22nd St. Poplar Springs Road Historic District-
bounded by 29th St, 23rd Ave, 22nd St, and 29th Ave. West End Historic District - roughly bounded by 7th St, 28th Ave, Shearer's Branch, and 5th St. Meridian has operated under the mayor-council or "strong mayor" form of government since 1985. A mayor is elected every four years by the population at-large. The five members of the city council are elected every four years from each of the city's five wards, considered single-membe districts. The mayor, the chief executive officer of the city, responsible for administering and leading the day-to-day operations of city government. The city council is the legislative arm of the government, setting policy and annually adopting the city's operating budget. City Hall, which has been listed the National Register of Historic Places, is located at 601 23rd Avenue. The current mayor is Percy Bland. Members of the city council include Dr. George M. Thomas, representative from Ward 1, Tyrone Johnson, representative from Ward 2, Fannie Johnson, representative from Ward 3, Kimberly Houston, representative from Ward 4, and Weston Lindemann, representative from Ward 5. The council clerk is Jo Ann Clark.
Table 7: The most extreme (outlier) examples of misclassified texts from humans
Source, PHD davinci, 31.06
Text sample
Mooreraft and Mcl McLaugglin's 's comment reflects the difficulty that the Rhodesian airmen had in distinguishing innocent refugees from guerilla fighters, as the camp was mix of both. Sibanda's i description of the camp further emphasizes the tragedy of the raid, as innocent children were among those killed.
davinci, 20.89
The average annual rainfall at Tikal is approximately 1,500 mm (59 inches). However, due to the unpredictable nature of the climate, Tikal suffered from long periods of drought. These droughts could occur at any time before the ripening of the crops, endangering the food supply of the inhabitants of the city.
Table 8: The most extreme (outlier) examples of misclassified texts from davinci-003
19

---

dimensions
random (mean: 25.1, median:24.8)
m.55
davinci (mean: 7.27, median:7.23)
const (mean: 2. median:2.55 2.9))
+
10
30 35
Figure 11: PHD of several types of texts: created by sampling 512 random tokens uniformly from the vocabulary; written by humans (Wikipedia); generated by text-davinci-003 with default temperature (Wikipedia domain); created by repeating the same randomly chosen token 512 times. We didn't 't perform any additional restarts for outliers correction here for the purpose of highlighting the edge cases. For this reason,
more outliers here than on Figure 3 The outlier texts are shown in
Table g
Table 9: Intrinsic dimensions of English texts of different genres estimated by different methods.
Intrinsic dimension estimator
Wikipedia articles
Fiction stories (Reddit)
Question answering (Stack Exchange)
CorrInt
10.05 + 0.57
8.30 = 1.64
9.92 + 0.71
Grassberger and Procaccia
1983
FisherS Albergante ct al.
2019
6.70 + 0.36
6.54 = 0.71
7.10 + 0.37
KNN
Carter al. 2010
4.306
6.54 0.71
7.10 0.37
IPCA
Cangelosi and Goriely
2007
23.18 3.60
7.10
MADA
Farahmand et
2007
23.2
420.7
MOM
Amsaleg et al. 2018
11.05
2.79
1.41
MLE
Levina Bickel
2004
11.83 0.77
11.55
12.13
PHD
proposed method)
4.49
9.21 1.29
9.59 + 1.29
TLE
Amsaleg et 2019
10.65 + 0.49
10.03 + 1.64
11.08 + 0.75
TwoNN
Facco et al.
2017
5.85 + 1.08
5.70 + 1.72
5.95 + 1.19
Table 10: Sizes of data splits (# of natural/generated text pairs) used our experiments on cross-model and cross-domain performance well as for comparison of our method with universal detectors.
Source
Train
Validation
Test
Human/GPT2
2001
275
281
Wikipedia
Human/OPT
1925
277
273
Hum3n/GPT3.5
1798
259
260
Reddit
Human/GPT3.5
1677
232
235
StackExchange
Human/GPT3.5
2100
300
300
G Data description
Table 10 shows the sizes of data splits that were used compare our method with universal detectors as well as for evaluating its cross-model and cross-domain performance.
Data for Wikipedia and Reddit was taken from [Krishna al. 2023 assembled the dataset ourselves following the same scheme as Krishna et al. (2023). For all text generation models (GPT2-XL, OPT, GPT-3.5), randomly selected 2700 pairs of natural/generated texts from the raw data.
for StackExchange,
First, divided the data into train/validation/test splits in proportion 7:1:1 human-written texts and no texts generated from the same prompt belong to the train and test split simultancously. Then filtered out all texts that were too short for stable estimation of the intrinsic dimensionality (shorter than 50 tokens) and an equal amount of texts from the opposite class.
ensure that
20


Reviews:
[{"review_id": "mEiQ0S0SCt", "reviewer": "Reviewer_SSuo", "summary": "The paper proposes  using the intrinsic dimensionality of the manifold underlying the set of embeddings of a given text to detect AI-generated texts. Because the average intrinsic dimensionality of AI-generated texts is lower than that of  natural language. It is found that the intrinsic dimensionality of different languages varies a lot.", "questions": "- Intrinsic dimensionality is calculated in BERT/RoBERTa emebedding, I wonder if the *syntax of individual language* leads to the *difference of intrinsic dimensionality in different languages*. \n- Is there any analysis on the bad cases (incorrectly-classified cases)?  which might help better understand the method.\n", "limitations": "See the Weaknesses", "rating": 5, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "- The paper itself is novel\n- The finding that  the intrinsic dimensionality of different languages varies a lot is interesting.\n- The method is robust in cross-domain and cross-model scenarios.", "weaknesses": "- The paper does not discuss the reason for the difference of intrinsic dimensionality in different languages.\n- The reason why the method works isn't clearly understood.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your review.\n\nIn our work, we study Intrinsic Dimensionality estimation for text embeddings and show experimentally that this mathematical value can reflect some useful information about the given text, namely, helping to separate artificial and human written texts. We admit that a huge amount of important questions are left out of the scope of this paper. To the best of our knowledge, we are the first to show that ID estimation of text embeddings applies to this kind of downstream task, and just couldn’t cover all the questions related to this method in a single paper.\n\nOne of the most important questions is the one raised by Reviewer SSuo: why does this method work? Indeed, this has not been clearly understood yet. There is mathematical intuition behind the notion of intrinsic dimensionality; using it, we can conclude that GPT-generated texts have a smaller number of degrees of freedom, i.e. less creative in some sense. We believe that there are some subtle semantic, syntactic, stylistic, or statistical differences, which are reflected by ID value and could support this intuition. Unfortunately, so far, we could not discover these properties; but our work proves experimentally that some kind of differences exist. We hope that future research will shed some light on this question. \n\nAnswer to Q1. The difference between the ID of different languages could be caused by many reasons: the properties of the language, e.g. analytical vs. synthetic; the script (e.g. syllabic or letter); the quality of the language representations of the embedding model; the quality of the data (e.g. Wikipedia articles can have different quality for different languages), etc. Interesting to note that in Fig. 4 Asian languages have smaller ID than European; among European, related languages are often grouped (Russian and Ukrainian, Spanish and Italian). We can hypothesize that geographical and linguistic connections between languages lead to similar ID; this hypothesis should be a subject of accurate investigation, and we left it for future research.\n\nAnswer to Q2. As for bad case analysis, we noticed an interesting tendency among the examples with the lowest ID of human-written texts (those will be surely misclassified). It seems that most of these examples contain a lot of addresses, geographical names, or proper nouns. It may be connected with the usage of rare tokens or with more numbers in the text than usual, but more experiments are needed to claim it for sure. Some examples, however, are just very short texts. Examples are provided in Table 1 in the attached file.\nWe didn’t notice any significant anomaly in the top ten examples with the highest ID of Davinci-generated texts, except that all these texts were very short. We hypothesize that PH dimension estimation doesn’t work properly on short text. More thoughtful analysis of bad cases is a matter for future work.\n\nOn Fig. 1 in the attached file we provide extreme cases analysis. The most simple samples have the lowest ID, and the highest ID corresponds to the completely random ones. It corresponds to the general understanding of ID as the amount of degrees of freedom in the data."}, {"review_id": "qViy8DOC30", "reviewer": "Reviewer_oVCJ", "summary": "This paper proposes a new method for artificial text detection(ATD) with intrinsic dimension (ID) estimation. First, contextualized representation of tokens in the text is extracted by a RoBERTa model. Next, the author estimates the ID of this set of contextualized representations : (1) N tokens and their corresponding vectors are sampled from the set, forming a vertex set; (2) the persistent homology dimension (PHD) is estimated by measuring the lengths of the edges in a minimal spanning tree with the vertex set; (3) varying the value of N to obtain a set of N-PHD pairs, and measuring the ID based on the slope of their linear correlation. Finally, the ID is utilized as a feature in a logistic regression model for binary classification.\n\nThe author has conducted extensive experiments on widely-used benchmarking datasets. The results demonstrate that the proposed method exhibits greater robustness when compared to existing ATD methods, particularly in terms of its resilience towards adopted AI models, paraphrase attacks, and non-native speakers. Furthermore, in comparison to a conventional RoBERTa-based classifier, this method showcases significantly improved out-of-domain performance in both domain and AI model transfer scenarios. Additionally, the author has curated a new dataset for multilingual ATD, although specific details regarding this dataset are not provided.\n", "questions": "\n## Typos\n\n1. Line 45: some downstream task(s)\n2. Line 177: where equivalence mean(s)\n\n## Suggestions\n\n1. It would be helpful to include some text examples with high and low ID.\n\n## Questions\n\n1. Why RoBERTa-large has higher variance than RoBERTa-base(Figure 5)\n2. What does the * mean in Table 2?\n3. Why do you shuffle the order of datasets in Table 3? It is weird that PHD has higher performance on OOD than ID.\n4. Why https://arxiv.org/abs/2104.08894 report much higher dimension for images?\n5. Line 177: “equivalence mean that…” where is the equivalence?\n6. Caption in Figure 6 is confusing: the title of the right-hand-side graph says it is the success rate of classification (higher the better) but the caption says it is the decrease of performance (lower the better). \n7. What is the ID of the text generated by randomly sampling tokens from the vocabulary?\n\n", "limitations": "The limitations are fairly elaborated.", "rating": 7, "confidence": 3, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "1. The application of persistent homology and intrinsic dimension estimation for ATD is both intriguing and well-founded in theory. While the methodology is similar to that of [1], which is already cited in the paper, this method relies on fewer features and conducts more comprehensive experiments to assess the robustness of competing methods. Hence, the proposed method and its findings exhibit a significant level of novelty.\n\n2. The proposed method has achieved promising performance, particularly in terms of robustness. This is mainly because it does not need to finetune parameters of a large Transformer model, nor does it assume reliance on an AI model that is likely to generate the text.\n\n3. Extensive experiments and analysis are done to demonstrate the effectiveness of the method.\n\n[1]  Kushnareva, Laida, et al. \"Artificial Text Detection via Examining the Topology of Attention Maps.\" EMNLP. 2021.\n", "weaknesses": "1. Some claims are not well supported. The author claims that they estimate the intrinsic dimensions (ID) of text data. In fact, what they really estimate is the ID of the contextualized representations. By contrast, [1] directly estimates the ID of natural images. \n\n2. Although extensive experiments have been conducted, one important analysis is missing: investigating the impact of the decoding algorithms. One important assumption of this work is that the metric space of human-written text has more isolated sub-graphs, which can be incurred by rapid shift of topic, usage of rare words, and so on. AI models can also achieve these characteristics by adjusting the hyperparameters of decoding algorithms, such as reducing the softmax temperature or increasing the values of P and K in nucleus and top-K sampling, respectively. As seen in Table 2, PHD has better performance for detecting GPT-3.5 than GPT-2, mostly because GPT-2 tends to generate text that has more grammar mistakes and less akin to human language. Consequently, the reliability of the method in the face of different sampling techniques becomes questionable.\n\n3. The paper is not very easy to follow: some important details and definitions are missing. To name a few:\n   * Some background information about topological features, especially connected components, are necessary to understand the estimation of persistent homology dimension.\n\n   * Lack of definition of $C$ in Line 177, as well as $\\tilde{C}$ in Line 183.\n   * In Section 3, the author solely explains the estimation process for $E^{i=0}$ without explicitly indicating that they set $i=0$ until Section 4. It would be clearer if this information was explicitly stated earlier.\n\n   * The author lists the new dataset as one of the main contributions of their work. However, no specific details are presented. It would be helpful to know the dataset's statistics, the curation process employed, as well as any annotation, cleaning, or pre-processing steps that were carried out.\n\n\n\n[1] Pope, Phil, et al. \"The Intrinsic Dimension of Images and Its Impact on Learning.\" ICLR. 2020.\n", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your review!\n\nFirst, we address the “Weaknesses” section. \n\n1. We use the notion “ID of text” for simplicity; in contrast to image processing, text embeddings are the main numerical representation of texts widely used in NLP nowadays, so we believe there is very little chance of confusion caused by this inaccurate terminology. Text data, regardless of the type of embeddings, has common properties, e.g., it is discrete, and there is a relatively small number of points available for each text. Our methods of ID estimation are able to deal with such types of data.\n\nExperiments of this work are restricted to text embeddings obtained by Transformer MLMs. But our focus is not on the properties of these embeddings; we show that embedding sets obtained by the same model have different estimated IDs for different types of data, and we study the properties of data via their embeddings’ ID. To be precise, we estimate the ID of a set of embeddings obtained by RoBERTa-family models, for both natural and generated texts, and show that they differ. \n\nWe thank you for pointing out this confusion and will clarify it in the text if accepted.\n\n2. Unfortunately, space and time constraints precluded us from performing a thorough analysis of the impact of the decoding algorithm parameters and including the results of this analysis in the paper. We will include them into the appendices after concluding additional experiments. We can note here that ID estimation of texts obtained from GPT-3.5 exponentially depends on temperature: texts obtained with temperature values up to 1.2 usually have lower ID than human-written texts, but if temperature is at least 1.7 then generated texts have ID notably larger than human-written ones. As for GPT-2, we found that top-K sampling (with K=40) on average leads to ~15% lower values of ID.\n\n3. We thank you for noting unclear details in the paper. We will fix them and add the necessary explanations in the final version if accepted.\n\n4. Thank you for this suggestion! We will definitely add this information to the paper if accepted.\n\nQuestions\n\nSuggestion 1. \n\nPlease find some examples in Table 1 in the attached file. It seems that most examples with lower ID contain a lot of addresses, geographical names, or proper nouns. It may be connected with the usage of rare tokens or with more numbers in the text than usual, but more experiments are needed to be certain.\n\nSome examples, however, are just very short texts, for which our method of PHD calculation is less reliable. This means that there is high variability of the ID values for the *single* sample, calculated with different random seeds. On our estimation, this kind of data occupy the  lowest and highest 0.5% of the distribution.\n\nQ1. We hypothesize that it may be caused by larger embedding size in RoBERTa-large (1024 compared to 768 for RoBERTa-base). It is known from literature that increasing the latent space dimension may often negatively affect the stability of individual ID estimates for fractal-based methods [1] (and PH-dim is one of such). See: Camastra and Staiano, Intrinsic Dimension Estimation: Advances and Open Problems, Information Sciences, vol. 328, pp. 26-41, 2016.\n\nQ2. * means that this number is not directly comparable with other numbers in the table because the detector uses weights of exactly the same model that was used for generation, so it does not belong to the class of universal detectors. This issue for the pair DetectGPT-GPT2 is mentioned in the subsection “Comparison with universal detectors” (l. 262-263 and 268-269). We will add this explanation to the table caption if accepted.\n\nQ3. This is a typo in table heading; thank you for pointing it out. The correct order of labels is given in the left half of the table: Wikipedia, Reddit, StackExchange. Meanwhile, numbers are given in the correct order.\n\nQ4. Thank you for the useful reference! \nThe setup of this paper differs from ours. We estimate the dimensionality of each text separately; they estimate the dimensionality of the entire dataset considering every image as a separate point. Naturally, such estimation yields larger numbers with larger variation. \nTable 1 and 2 and Figure 1 in that paper show that ID estimation depends both on the dataset and estimator properties, and varies from 7 to 45, while our estimation mainly lies in the 7-12 range. As mentioned above, our estimation also depends on the properties of the embedding model. \n\nQ5. It is related to the equation from the same line: $E^0_\\alpha(X) \\sim C n^{\\frac{d-\\alpha}{d}}$, here $\\sim$ is read as “equivalence”. We will state it more clearly in the final version if accepted.\n\nQ6. We opted to preserve the style of figures from the paper where those experiments were originally introduced. The plots themselves are correct (lower is better on the left-hand size, while higher is better on the right-hand side); we will clarify it in the caption of the figure. \n\nQ7. In Figure 1 of the attached file, we show boxplots of IDs of texts made up of repetitions of the same tokens (const), generated by davinci, written by humans, and generated by sampling random tokens from the RoBERTa vocabulary. It supports our hypothesis that embeddings of more homogenous texts tend to have lower ID, while embeddings of more heterogeneous texts tend to have higher ID. \n"}, {"review_id": "AIhuVzUNzO", "reviewer": "Reviewer_NYsD", "summary": "The paper describes work on detecting AI-generated text using intrinsic dimensionality (ID) estimation methods through Persistent Homology Dimension (PHD) (and MLE).  The authors motivate this approach by highlighting that written texts between machine and humans observe differences in topological representation. The authors explored this method using an extensive set of experiments covering various SOTA models for detection, such as DetectGPT, GPTZero, etc., across multiple languages in a crosslingual setup and across multiple source domains of data such as Reddit, StackExchange, and Wikipedia. Results show that using ID as a feature generally performs consistently and somewhat robustly across other methods, especially in general detection. \n\nOverall, I believe the paper is a good addition to NeurIPS, especially as it gives a unique perspective on detecting machine-generated texts that’s theoretically motivated.\n", "questions": "Aside from the supporting questions highlighted in the Weaknesses section, here are some points that further require clarification:\n\n1. Is it scientifically correct to refer to the intrinsic dimensionality methods as non-linguistic approach for detecting AI-generated texts? To me, the method seems to merit its own category compared to approaches using stylistic properties of texts.\n2. What decoding hyperparameter values were used? Are these uniform across all model generation setups?\n3. Is it possible that the training setup of RoBERTa contributed to it being more robust across various domains? RoBERTa’s performance was highlighted but the authors did not provide any of their own inferences.\n", "limitations": "The added limitations section seems acceptable but I would recommend to further clarify the breadth of dataset used to merit claiming robustness and applicability to domain shift. It might be worth comparing to previous literature on how much data they used before they can refer to one model as robust. ", "rating": 7, "confidence": 4, "soundness": 4, "presentation": 3, "contribution": 4, "strengths": "There are a number of things that I liked about the paper that contributed to my overall recommendation. First, the paper gives a unique point-of-view to the standard AI-generated text detection task which deviates from the usual approach of looking at surface-based style and linguistic characteristics. The paper shows strong motivation and support as to why intrinsic methods such as PHD shows substantial differences between human-written and machine-generated texts. Second, I find merit in the breadth and depth of the experiments conducted which extends to crosslingual and crossdomain settings. It is also good that the authors explored a number of generative models and targeted some of the concerns with detecting machine-generated text such as errors with texts from non-native speakers. Lastly, the paper is readable enough for a larger variety of readers to appreciate its contributions. With these points, I recommend the paper for acceptance.\n", "weaknesses": "There are no major issues in the paper that I’m particularly concerned about. There are some points, however, that I would recommend to be given more emphasis and clarification to improve the quality of the discussion as well as to increase confidence with the results.\n\n1. I would have appreciated it better if the authors provided their clear inferences as to why the PHD-based detector, even with a paraphraser, is substantially better than the other classifiers. If the result indeed shows that the method is effective, what does it imply? Does it suggest that using a non-linguistic representation such as the intrinsic dimension of data compared to other linguistic factors considered by DetectGPT, RankGen, etc. is more practical?  Quantitatively, how much offset in performance do paraphrasers like DIPPER affect the proposed classifier as well as the other detectors? It would also be interesting and a good addition in the discussion if the authors can show that even using paraphrasers, the proposed detector is still significantly effective through a statistical test.\n\n2. There are a few vague statements in particularly focused on parts of the discussion of results. In the cross-domain and cross-model performance, statements such as “the PHD classifier is not influenced by domain transfer” and “PHD classifier to be more robust to entirely new AI models” need further clarification and even rephrasing. Achieving relatively favorable performance on three datasets hardly makes any model robust and immune to domain shift unless proven in-depthly with more data and/or backed by statistical tests. \n\n3. It seems odd that ChatGPT was never mentioned anywhere in the statement of models used for experiments and then appears on one of the results section. Was this portion rushed? Justification is needed for this as readers would expect all experiments on evaluating generations to come from what was previously declared and should be uniform for all experiments. Also, there’s no “GPT3.5-davinci-003” in OpenAI’s model endpoints (https://platform.openai.com/docs/models/model-endpoint-compatibility). This may have been a typo so kindly clarify.\n\n4. Same recommendation also applies where the authors should provided more discussion instead of describing the values on the table as seen in the experiment on non-native written text vs. AI. It was observed that existing models such as GPTZero and OpenAI tend to have higher rates of misclassifying non-native text as AI-generated but not so much for PHD and especially using MLE-based classifiers. Thus, what are the author’s insights as to why MLE performs better than PHD for this type of experiment? The authors previously mentioned that MLE performs well on “small samples, noisy settings, and small variance” so how does this ties up with the result? What gives MLE the edge over PHD in this scenario?\n\n5. There are mentions of using specific splits of existing datasets in the paper. These should all be added as a separate table in the Appendix. It’s quite challenging as the reader to approximate how large the data used specifically for the study. This information is also used when analyzing the model performances.\n", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Weaknesses.\n\n1. We suppose that modem language models can mimic human-written texts very well in terms of common linguistic properties such as grammar, semantic, style etc., but there are subtle differences that can be captured via numerical analysis of the topology of text embeddings or the curvature of the probability function, somewhat similar to the approach of DetectGPT. We consider it as an important and interesting direction for future work. \n\n2. Naturally, we cannot state that our method will work in any domain shift situation. Our point was to demonstrate that ID of the text embeddings is a reliable characteristic of text that helps to discover the above-mentioned subtle differences in text data and disentangle them from text style and semantics.\n\n3. Thank you for your remark! By “GPT3.5-davinci-003” we meant the model “text-davinci-003” from /v1/completions. By “ChatGPT” we meant the model  “gpt-3.5-turbo” from /v1/chat/completions. We often refer to both models as “GPT-3.5” or “GPT-3.5 family” in the introduction and other parts of the paper because both are listed as such in the list of  “GPT-3.5 models” at https://platform.openai.com/docs/models/gpt-3-5 . If accepted, we will review our naming and make it more clear and precise in the text (i.e., replace “GPT3.5-davinci-003” by “text-davinci-003”; specify more clearly that we refer to both davinci and ChatGPT as “GPT-3.5” in the introduction etc.).\n\n4. Table 4 shows that PHD and MLE have roughly the same ROC-AUC for ChatGPT texts in English. The higher accuracy on 1% FPR means that MLE provides a shorter left “tail” on real data, i.e. there are fewer real texts with very low MLE. We suppose that this is exactly because it works better with small samples. As we have mentioned in the answer to Reviewer 1, many of the PHD extreme cases are too short. \n \n5. Thank you for pointing this out. We planned to upload exact splits into the Github repository with the code for this paper, but we can also add tables with sizes of used splits to the appendices. \n\nQuestions\n\nQ1. Our approach can be called “non-linguistic” in the sense that we are not working with text or language *directly*; instead, we analyse its mathematical representation (which, of course, inherits various features of text).\n\nQ2. Yes, they are uniform for every model across all generation setups. For our dataset, we used ChatGPT with default parameters (temperature 0.7). We used texts generated by GPT-2, GPT-3.5, and OPTb that were published by Krishna et al. (authors of \"Paraphrasing evades detection...\"), and detailed information on the choice of hyperparameters can be found there. We followed the procedure from the paper, and in experiments with the intrinsic dimension reported results on data without watermarking (strength_0.0).\n\nQ3. Indeed, RoBERTa (which is exactly “Robustly optimized BERT”) is developed to be robust. The important factor which is shown to improve the performance on downstream tasks is increasing the training dataset by an order of magnitude and, importantly, adding more variability to the data. While BERT was trained on Books and Wiki only, RoBERTa was fed also with a large web crawled corpus. So, both Reddit and StackOverflow are the types of data seen during pretraining. We believe that this is, indeed, the root cause of the robustness of ID estimation for RoBERTa embeddings. We suppose that ID estimation is more stable for data familiar to the embedding model. We plan to test this hypothesis in our further study. "}, {"review_id": "oMH2nVHySB", "reviewer": "Reviewer_98X7", "summary": "This paper proposes a method to detect AI-generated texts based on intrinsic dimensions of sequences generated by humans and LLMs. The authors use a method called persistence homology dimension (PHD) to estimate intrinsic dimensions of both human- and LLM-generated texts. Using a variety of datasets across multiple languages, the authors first notice that intrinsic dimensions between human- and machine-generated texts tend to differ, with the intrinsic dimension of human texts being higher than that of machine-generated ones (the intrinsic dimensions again differ between languages, yet they are always differentiable from human texts).  \nUsing the estimated dimensions, the authors then train a simple single-feature logistic regression classifier to differentiate between human- and machine-generated texts. Experimental results reveal that their method substantially surpasses existing baselines (e.g., DetectGPT, GPTZero), and interestingly the method remains robust against paraphrase attacks conducted using DIPPER. \nFinally, the authors show that their method is more robust against samples authored by non-native speakers than existing baselines. ", "questions": "None", "limitations": "The authors clearly outline the limitations of their work in a dedicated section. However, a few additional words on the broader impact (e.g., the applicability of the method in practice) would be helpful.", "rating": 7, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "* The authors propose a novel method to detect AI-generated content, outperforming existing works.\n* The method is effective yet easy to understand, and I believe researchers working on similar topics would be quite interested in the presented results.\n* The additional experiments showing that the model is robust against paraphrase attacks further strengthen the method’s relevance.\n", "weaknesses": "* The analysis could be more extensive. For example, given that the classifier is based on a single feature, it would be interesting to see how performance varies as a function of dataset size, and how vulnerable its generalization capabilities are to ‘noisy’ datasets (i.e., those where dimensions for individual samples have high variance).  While this has partially been explored (Figure 2), showing classification results in the Experiments section would have been informative.\n* It would be nice if Table 1 could be extended for additional approaches to ID estimation (line 188 mentions that 12 approaches have been explored). Showing results across those approaches (e.g., in a boxplot) would give the reader a better notion of how well the differences in dimensions between human- and AI-generated texts generalize across methods.\n", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your review!\n\nWe have considered adding more analysis of ID estimations for the texts to appendices. In fact, we have explored some types of \"linguistic noise\", i.e., deviations from standard language. In particular, we use data from Reddit that contains quite informal texts (with a notable amount of colloquialisms) as one of our primary datasets; the standard deviation of ID estimates for them is ~28% higher than for Wikipedia texts, but the mean is still the same. We also analyze the performance of our method on texts produced by non-native speakers, and it also shows a higher variance of ID estimates. We leave more detailed investigations of the impact of other kinds of noise in data for future work.\n\nDue to space limitations, we could not include the data for other ID estimation approaches in the primary text, so we limited Table 1 to two methods only. Thank you for this comment; we will add an extended version of Table 1 (with other ID estimators) into the appendix."}]

Author rebuttal:
We are thankful to all the reviewers for their inspiring reviews! In the attached file, we provide examples and figures illustrating  extreme cases of ID values. We discuss these results in the direct answers to the reviewers (SSuo and oVCJ).

Meta-review: All reviewers unequivocally agreed that this submission to be accepted. One room for improvement the AC is noticing is that most references do not go past 2019. I'm pretty sure the term "intrinsic dimension" in the deep learning era was coined by "Measuring the Intrinsic Dimension of Objective Landscapes" , ICLR 2018.
Decision: Accept (poster)