RADAR: Robust AI-Text Detection via Adversarial Learning
Authors: Xiaomeng Hu
Pin-Yu Chen
Tsung-Yi Ho
Venue: NeurIPS 2023 poster (2023)
Keywords: Large Language Models
Text Detection
Adversarial Learning
Paraphrase
TL;DR: We propose an adversarial learning framework to train AI-text detectors robust to paraphrasing

Abstract: Recent advances in large language models (LLMs) and the intensifying popularity of ChatGPT-like applications have blurred the boundary of high-quality text generation between humans and machines. However, in addition to the anticipated revolutionary changes to our technology and society, the difficulty of distinguishing LLM-generated texts (AI-text) from human-generated texts poses new challenges of misuse and fairness, such as fake content generation, plagiarism, and false accusations of innocent writers. While existing works show that current AI-text detectors are not robust to LLM-based paraphrasing, this paper aims to bridge this gap by proposing a new framework called RADAR, which jointly trains a $\underline{r}$obust  $\underline{A}$I-text  $\underline{d}$etector via  $\underline{a}$dversarial lea$\underline{r}$ning. RADAR is based on adversarial training of a paraphraser and a detector. The paraphraser's goal is to generate realistic content to evade AI-text detection.
RADAR uses the feedback from the detector to update the paraphraser, and vice versa.
Evaluated with 8 different LLMs (Pythia, Dolly 2.0, Palmyra, Camel, GPT-J, Dolly 1.0, LLaMA, and Vicuna) across 4 datasets, experimental results show that RADAR significantly outperforms existing AI-text detection methods, especially when paraphrasing is in place. We also identify the strong transferability of RADAR from instruction-tuned LLMs to other LLMs, and evaluate the improved capability of RADAR via GPT-3.5-Turbo.

RADAR: Robust AI-Text Detection via Adversarial Learning
Xiaomeng Hu
Pin-Yu Yu Chen IBM Research New York, USA
The Chinese University of Hong Kong Sha Tin, Hong Kong xmhu23@cse. cuhk. edu hk
pin-yu. chen@i ww..niiimmcee bm. com
Tsung- Yi Ho
The Chinese University of Hong Kong Sha Tin, Hong Kong tyho@cse cuhk. edu. hk
Abstract
Recent advances in large language models (LLMs) and the intensifying popular- ity of ChatGPT-like applications have blurred the boundary of high-quality text generation between humans and machines. However, addition to the anticipated revolutionary changes to our technology and society, the difficulty of distinguishing LLM ..Me-geeerated texts (AI-text) from numan-generated texts poses new challenges of misuse and fairness, such as fake content generation, plagiarism, and false accusations inmocent writers. While existing works show that current AI-text detectors are not robust to LLM-based paraphrasing, this paper aims to bridge this gap by proposing a new framework called RADAR, which jointly trains a robust AI-text detector via adversarial learning. RADAR is based on adversarial training of a paraphraser and detector. The paraphraser's goal is to generate realistic content to evade Al-text detection. RADAR uses the feedback from the detector to update the paraphraser, and vice versa. Evaluated with different LLMs (Pythia, Dolly 2.0, Palmyra, Camel, GPT-J, Dolly 1.0, LLaMA, and Vicuna) across 4 datasets, experimental results show that RADAR significantly outperforms existing Al-text detection methods, especially when paraphrasing in place. We also identify the strong transferability of RADAR from instruction-tuned LLMs to other LLMs, and evaluate the improved capability of RADAR via GPT-3.5-Turbo.
Project Page and Demos: https: vizhub. ai IBM demo is developed by Hendrik Strobelt and Benjamin Hoover at IBM Research HuggingFace demo is developed by Xiaomeng Hu
Introduction
Large language models (L.MMs) are high-capacity neural networks that are pretrained web-scale datasets. They are foundation models achieving state-of-the-art performance in wide range of natural language processing tasks (e.g. document completion, question answering, machine translation, and content creation with text prompts) with advanced capabilities such in-context learning and reasoning (e.g. chain of thoughts). In particular, LLMs are the backbone of many ChatGPT-like conversational bots that enable text generation with high fluency and accuracy. However, while LLMss and their derived applications are expected to become ubiquitous in our future technology and society,
37th Conference on Neural Information Processing Systems (NcurIPS 2023).

---

Frozen
Trainable
Update with PPO Loss
Human text
Altestt
Paraphrased Al-ext
Buffer B
Reward
Target Language Model
Paraphraser with Logistic
D
0.98
0.02
0.15
Input Samples
Probability Human-Tex
3ppper Detector
Training Testing
Numan-text
0.98
0.01
Al-test
Input Samples
Trained Detector
Probability to be Human-Texx Thresholding
Detection Results
Figure 1: Overview of RADAR. An Al-text corpus is first generated from a target (frozen) language model from a human-text corpus. In RADAR, introduce a paraphraser (a tunable language model) and detector (a separate tunable language model). In the training stage, the detector aims to discern human-text v.s. Al-text, while the paraphraser aims to rewrite Al-text to evade detection. The model parameters of the paraphraser and the detector are updated in an adversarial learning manner as described in Section 3 the evaluation stage, the trained detector deployed to predict the likelihood of AI-generated content for any input instance.
new risks in failing to distinguish the so-called "AI text" generated by LLMs have emerged and gained considerable attention due to various reasons. The problem of reliable Al-text detection is motivated by realistic socio-technological challenges such as fake content generation, Al plagiarism (e.g. using LLMs for writing tests), and false accusations of innocent writers. According to a report released by ApenA their latest AI-text detector is admittedly not fully reliable. In the reported evaluation of some challenging cases for English texts, their classifier only correctly identifies 26% of Al-text (true positives) while incorrectly classifying 9% of numan-written text (false positives). Moreover, a recent study [21] found that state-of-the-art Al-text detectors demonstrated severely degraded performance when encountering texts written by non-native English speakers.
What can be even more challenging in Al-text detection is that existing Al-text detectors are prone to be manipulated. The authors in 27 17 showed that using LLMs paraphraser easily evade several Al-text detection methods, even in the scenario when the original AI-text had been watermarked. These findings sparked heated debate about whether and how design a reliable Al-text detector. While [27] theoretically quantifies the best detector's performance with respect to the total variation distance between Al-text and human-text distributions and argues that Al-text is difficult to detect, another work [3] proves that it is possible to obtain reliable Al-text detector unless the human-text distribution is exactly the same as the Al-text distribution, based on an information- -twoonettthrccclll analysis (i.c., the sample complexity of Chernoff information and Akellhooodrrati-- based detectors).
successfully
To improve Al-text detection, we propose RADAR, a framework for training robust Al-text detector using adversarial learning. An overview of RADAR is illustrated in Figure T Our proposal draws inspiration from adversarial machine learning techniques that train high-quality generator by introducing discriminator to form two-player game, such generative adversarial networks (GANs) 10] In RADAR, we introduce a paraphraser and a detector as two players with opposite objectives. The paraphraser's goal is generate realistic content that evade Al-text detection, while the detector's s goal is to enhance Al-text detectability, In our framework, both the paraphraser and the detector are parametrized by separate LLMs. During training, the paraphraser learns to rewrite the text from training corpus (generated by target LLM from human-text corpus) with the

---

Detecton AUnOc
904
0.86
0.900
0.856
3.557
0.755
0.651
627
0.422
0.61
0.426
0.472
0.434
mank
log ratt
entropy Detection Method
BADAS
Figure 2: Performance evaluation (AUROC) LLMs over 4 human-text datasets. w/o paraphraser means the evaluation with the original Al-text corpora (the yellow bin M in Figure TT. RADAR- Unseen puraphraser means the evaluation with the paraphrased Al-text (the green bin P in Figure D generated from independent paraphraser (OpenAl's GPT-3.5-Turie API) that is not used in RADAR. The black error bar represents the standard deviation of the detection AUROCs across LLMs. Please refer to Section 4.2 for more implementation details.
aim of decreasing the likelihood of AI-text prediction by the detector, whereas the detector aims to enhance the detection performance by learning to compare human-text v.s. Al-text from the training data and the paraphraser's output. These two players iteratively update their model parameters until their respective validation loss becomes stable. Specifically, the paraphraser treats the prediction reward and Proximal Policy Optimization (PPO) (8 for updates. The detector updates its parameters based on logistic loss function evaluated on the human-text and Al-text corpora (including the texts generated by the paraphraser). In the evaluation phase, the trained detector is deployed to predict the likelihood of Al-written content for any input instance. When compared with 6 existing detectors, our experimental results 8 different LLMs and datasets show that RADAR attains similar detection performance on the original Al- gegerratedd texts (a relatively easy task) and simultaneously improves the Al-text detectability when facing an "unseen" paraphraser (i.e. this paraphraser is not used in RADAR). The result is summarized in Figure When facing an unseen paraphraser (GPT-3.5-Turbo),
of the detector
area under the receiver operating characteristic (AUROC) score of RADAR is improved by 31 .64% compared to the best existing detector, suggesting significant improvement and reliable Al-text detection power enabled by RADAR.
We summarize our main contributions as follows:
To the best of our knowledge. RADAR is the first study that leverages the idea of adversarial learning between paraphraser and detector for training robust Al-text detector.
The experiments on 8 different LLMs (Pythia, Dolly 2.0, Palmyra, Camel, GPT-J, Dolly 1.0, LLaMA, and Vicuna) and datasets show that unlike the six existing supervised and unsupervised Al-text detection methods, RADAR is the only robust detector that attains consistently high detection performance. RADAR's s detector
weakened by paraphrasing, as shown in Figure
We also find the strong transferability of RADAR's detection capability. The detectors of RADAR obtained from instruction-tuned first-class LLMs (e.g., Vicuna-7B) are also effective on other LLMs, suggesting the possibility of training universal Al-text detector based on the state-of-the-art LLMs.
Related Work
AI-Text Detection. The research in Al-text detection can be divided into three approaches. (i) Statistical methods: some statistics such as entropy [19] n- n-gram frequency, and perplexity are used as threshold to discern Al-text. A typical example is GLTR g, which exploits entropy, probability, and probability rank for detection. A more recent work is DetectGPT (23], which assumes that the machine- machine-generated text always lies the negative curvature region the log probability of the L.M of interest. Based on this hypothesis, DetectGPT perturbs the input text with mask-filling -illlini language

---

model, such as T5 (25]. Then, Al-text detection is performed by comparing the log probability of the text and its infilled variants. (ii Classification methods: AI-text detection formulated as binary
classification task, and a classifier is trained for a target language model [37 29 26 13
For example,
OpenAl trains its Al-text classifier with a RoBERTa-based model [29]
The developers collected samples from the WebText datase 2 and labeled them as human- -uman--gneeratd.
Then, for each target GPT-2 model, they collected the generated samples and labeled them as machine-generated. Finally, they fine-tuned the pretrained RoB ERBERTa-baeed model [29] for Al-text classification, More recently, with the appearance of CharGPT, OpenAI tuned a GPT model called AI-Classifier' using data from several sources. The human-write written text comes from three sources: a new Wikipedia dataset, the WebText dataset collected in 2019, and a set of human demonstrations collected as part of training InstructGPT (24). To collect machine- machine-generated text, for the Wikipedia and WebTeet datasets, they truncated the articles sampled from the original corpus and used 34 models to generate article completion, pairing each generated text with the original article. For the demonstrations, they used a model to generate responses for each prompt and paired them with the corresponding human demonstrations, This detector was only accessible via web interface since its release in January 2023, and it has been taken down since July 2023, (iii) Watermark methods; post-hoc watermarking techniques, such rule-based methods 15 31 and deep-learning- -based methods 66, 32], can be applied to an LLM. At inference time, [6] proposed a soft watermarking scheme to embed a watermark in each word of the generated sentence by dividing the vocabulary into different lists and sampling the next token in a differentiated manner. However, many existing Al-text detectors are shown to be significantly weakened by paraphrasing in 277
Adversarial Learning for Natural Language Generation. The success of GAN [0] in the computer vision domain has motivated many studies in natural language generation. However, since text generation is a sequential sampling process that occurs in discrete vocabulary space, it is difficult
to directly train text generator using back- pookppropagttion in an end-to-end manner [36 7 5 35 There are two common approaches to tackle this problem. The first one is to replace the discrete sampling operation with continuous approximation techniques [35 5 such as Gumbel-Softmax 14 22
The second one is to view text generation as a decision decision-making process and cast the generator as a policy [36] 34 7 (33. A typical example is SeqGAN (36). During generation, SeqGAN considers the generated tokens as the state and the next token to be generated as the action, and adopts Monte Carlo search to collect reward signals from the discriminator. Instead of using classifier as the discriminator, the and combines both word-level and sentence-level rewards into training. TextGAIL imitation learning paradigm in which the rewards of the human-written text are regarded as constant value. Then, both the rewards from human-text and Al-text are used to optimize the generator with PPO. These works all used warm-up training for the generator with maximum likelihood estimation (MLE) on the probability of the generated text sequence. On the other hand, 77 trained a language GAN from scratch. Our proposed RADAR differs from these works in that we focus on training a robust AI-text detector with a tunable paraphraser. Another line of work. such as (20) 4 uses paraphrasing techniques to find adversarial examples for natural language processing tasks and for training a robust language model via adversarial training. Their focus is on the correctness of natural language understanding, which is beyond our scope of Al-text detection.
GAN 34] uses a unidirectional LSTM as the discriminator B3) proposed an
3 RADAR: Methodology and Algorithms
We start this section by giving an overview and mathematical notations of our proposed RADAR framework in Figure [ Then, in Sections 3.1 and 3.2, we provide the details on the design and training of the paraphraser and detector, respectively. Finally, we will summarise the entire training process into an algorithmic procedure in Section 3.3
High-Level Methodology. Our RADAR framework consists of three neural-network-baat language models (LMs):: the target LM To. the detector D& and the paraphraser Go. parameterized with 6, ó and or, respectively. We note that To is frozen (no updates on ()) in the entire process. We summarize RADAR into three key steps:
Step 1 (Data preparation): Before training, we build M, the corpus of Al-text, by applying document completion based on the prefix span of text in the human-text corpus H using Te.

---

Step 2 (Paraphraser update): We collect Al-text samples 2m from M and use Ge to do para- phrasing on Im to generate paraphrased Al-text z, to form corpus P. Then, we use the reward of Tp returned by the detector Dy to update the paraphraser Go using PPO.
Step 3 (Dectector update): We use the human-text samples 2h from H. the original Al-text samples T' from M, and the paraphrased Al-text samples xp from P in step 2 to update the detector Dg with a logistic loss function.
Step 4 (Performance Validation and Evaluation): During training, we use the test set of WebText the validation dataset to estimate RADAR's performance. For evaluation, we use To generate AI-text for the evaluation dataset and to calculate RADAR's ' detection AUROC.
Step 2 to Step 3 can be repeated until there is improvement in the AUROC evaluated on the validation dataset. The nature of rivalry in adversarial learning and the introduced competition helps the detector learn to be robust in detecting both original and paraphrased Al-text.
3.1 Training Paraphraser via Clipped PPO with Entropy Penalty
In RADAR, the goal of the paraphraser Go is paraphrase the imput machine- machine-generatee generated text 2'm We model the generation of paraphrased text as a decision-mant making process, taking I' as the state and the output text Tp as the action. In particular, we optimize Go using the reward feedback from the detector Da with PPO. The output of Do(x,)) is the predicted likelihood of xp being Human-text. The reward returned by xp and the log probability of the text xp are defined in Eq. [
R(xp Φ) = Do(xp) E [0, 1]; log Ps.. (xpp)m)
Σ log Pe.. (egp "))))
(I)
where sif means the i-th token in the sentence xp of length N and 2 -1:-1 represents the first 1 tokens in zp (xp means the default starting token).
We propose Clipped PPO with Entropy Penalty (cppo-ep) in RADAR to optimize Go. Let Let clip( a, b) denote a value-clipping operation with a lower limit a and an upper limit b, r(o, Tmms Fp) be the importance sampling ratio between new policy Go and an old policy Go., and Kp) ~ Ps., be a state-action pair sampled from Go.. The loss of cppo-ep op is defined as:
Lo(a)= = ((smap))
min (clp((((r am, up), 1 e, 1 + e),r(a, am, zp)) A(Ep, Φ) SS(0) (2)
4e
where E denotes expectation, a parameter used clipping to avoid the importance ratio from being too large, A(rrp Φ) is the advantage item of the paraphrased text Tp obtained by applying normalization to R(zp. Φ) across the entire PPO sample buffer B. S(or) = B(zmaap)=PG.r
Pa. (Tm) log Pa. (zpp/-m)) which is an entropy term introduced to encourage Go to explore more diverse generation policy. y is a coefficient to control the ratio between LA and Lg, in order to make balance between advantage (L and diversity (Lg) when paraphrasing.
3.2 Training Detector via Reweighted Logistic Loss
In typical GAN training process, the discriminator receives equal amount of positive and negative samples in each step, assuring an in-batch sample balance. However, RADAR, by construction, the number of Al-text samples is twice the number of human-text samples, because each Ty from the human-text corpus H is paired with a sample &m from the original Al-text corpus M as well as a paraphrased sample Tp generated by the paraphraser Go. To handle this in-batch imbalance problem, we use reweighted logistic loss function to optimize the detector Dø, described in Eq. 3
(Ø)
-EZANP log (3r + Bar... C.M log (1 D)((m))) +A Ex,,, CM log (1 Dar (Imm))
Leg human-text
2 loss on original Al text
23 loss on paraphrased Al-istt
(3)
Recall that (x) E [0, 1] is the predicted probability of an input instance x being Human-text. Lu
the loss to improve the correctness of predicting 24 ~ as human-written. LM = L + L
where L1, and 1.2, are used to avoid r.m and xp from being predicted as human-text, respectively. X a coefficient ranging from 0 1. We introduce to adjust the proportion of Al-text components in the overall loss function to alleviate the effeets of sample imbalance.
5

---

3.3 RADAR Algorithm
The entire training procedure of RADAR summarized in Algorithm [ For a given target LLM, RADAR returns a trained paraphraser and trained detector through the designed training steps. In the evaluation phase, the detector is used to predict the likelihood of Al-text for any input instance.
Algorithm RADAR: Robust Al-Text Detection via Adversarial Learning
1: Data initialization:
2: Collect human-written text to build human-text corpus H
3: Select a target language model To to perform document completion on H to build the correspond- ing Al-text corpus M
4: Build replay buffer B to store samples temporarily collected for training
5: Build a validation dataset from H and M
6: Model initialization:
7: Detector Dø < Opeetrain (a pretrained language model)
8: Paraphraser Go <- Ppetrain (a pretrained language model)
9: Model training:
for maximum step do
11: Sample Fa and its corresponding Tm from H and M respectively Use Go paraphrase Vm and generate Xp
13: Collect reward R(Ip, Φ) as in Eq.
Normalize R(zp. Φ) to compute the advantage function A(rp. Φ) used in Eq.
15:
Fill B with (In, I'm Tp. A( Φ))
o' to # initialize the old policy o' as the current policy
17:
for (Eh: I', Tp. Azx Φ)) E B do
Compute the log probability log Ps., (Ip (mm) and log Ps: (2:p (m)) using Eq. Update Go using Eq. 2
19:
20:
end for
21:
for (Ih, Tm. A(Zp, 6)) E B do
22:
Update Do using Eq.
23: end for
24: Clear
25: Evaluate AUROC of D& the validation dataset V
26: end for
27: Detector D& Obea (the detector model with the best AUROC on the validation dataset)
28: Paraphraser Go <- Obes (the paraphraser model which pairs with @bea)
29: Return Do and Go
4 Experiments
4.1 Experimen Setup
Datasets and Metrics. For training, we sampled 160K documents from WebText [9] to build the human-text corpus H. Then, we build the original Al-text corpus M from H using target language model Ta, which performs text completion using the first 30 tokens the prompt and limits the sentence length to be 200 tokens. For evaluation, we select four human-text datasets covering different domains. Following 22 we use Xsum, SQuAD, and Reddit WritingPrompts (WP) to test detector's ability to detect fake news, avoid academic fraud, and identify machine- generated machine-generated literature innovation, respectively. In addition, we also the non-native-ane authhreed TOEEL dataset (TOFEL) [21] to evaluate a detector's bias when encountering non-native-author for more details about the evaluation datasets. Following existing works, report the area under the receiver operating characteristic curve (AUROC) score by varying the detector's 's threshold as the performance measure (higher is better), which captures the relationship between the true positive rate and the false positive rate.
English text. Please see Appendix A
Comparisons. We compare RADAR with various detection methods. These methods include the OpenAl (RoBERTa) model which is fine-tuned on WebText [9] and GPT-2 ( generations, as well as the statistical approaches including log probability, rank, log rank, entropy, and DetectGPT S 19 23

---

Table 1: Summary of the studied large language models
Purumeter Count
Model Nume
Organization
Pretrain
Instruction Fine-tune Data
3B
Pythia-2 8B
FlewtheAA
The Pile
V2-33
Databricks
databriccs-dolll-11
5B
Palmyra- buse
Writer
Writer's custom dataset
Waterr
instruction respotise records Writer Linguist team
GPT-J-6B
EleutherAl
Pile
X
Dolly-VI-6B
Databricks
Standford Alpuca 52K instructio-- following demonstration
7B
Vicuna-78
LMsys
Meta
Various source
conversations collected from ShareGP
Specifically, we implemented DetectGPT using the trained Ta-large model as the mask-filling model and performed 10 perturbations for each sentence to be detected.
Large Language Models. For the target L.MM Ta. we select 4 pairs of L.MSs and summarize them in Table Each pair contains an open-source LLM and its fine-tuned version via instruction-tuni
Paraphrase Configurations. We consider two settings: without (w/o) paraphrasing and with paraphrasing. To prepare the machine- -eeeerrteee text for evaluation, for the w/o paraphrasing setting, we use the original Al-text corpus M generated by a target LLM based on an evaluation dataset. For the with paraphrasing setting, we define two types of paraphrasing: seen paraphraser and unseen paraphraser. The seen paraphraser refers to the paraphraser Gr returned by RADAR. The unseen paraphraser means new paraphraser that has not participated in training the detector of RADAR. We used the OpenAl API service of GPT-3.5-Ture used for paraphrasing is "Enhance word choices to make the sentence sound more like human", as inspired by (2
as the default unseen paraphraser. The prompt we
Implementation Details. We provide the detailed setups when implementing Algorithm I We build a PPO buffer B that can temporarily store 256 pairs of data for subsequent training. We use the pre-trained T5-large and RoBERTa-large models the initialization of Go and D2 respectively. During training, we set the batch size to 32 and train the models until the validation loss converges. We use Adam as the optimizer with the initial learning rate set to Ie-5 and use linear decay for both Go and Dø- We set = 0.5 for sample balancing in Eq. 3 and set 7 = 0.01 in Eq. 2 We follow the same construction principle of the training dataset to create the 4 evaluation datasets based on Xsum, SQuAD, WP, and TOFEL. Experiments were run on 2 GPUS (NVIDIA Tesla V100 32GB).
4.2 Performance Evaluation and Comparison with Existing Methods
We run three groups of experiments (wlo paraphraser, seen paraphraser, and unseen paraphraser) and report the overall results of RADAR and the compared methods on all 4 datasets in Table The reported AUROC scores are averaged over the considered LLMs. In the relatively easy case of without paraphrasing, most detectors attain good AUROC scores. RADAR attains comparable performance (0.856) to the best existing detector (log rank, 0.904). The slightly worse performance of RADAR can be explained by the tradeoff in enhancing Al-text detection against paraphrasing.
When facing paraphrasing, all existing methods except entropy show significant performance degra- dation. The drop in AUROC compared to the w/o paraphrasing case ranges from 10.4% to 81.7% While entropy is shown to be more robust to paraphrasing, its AUROC score can be quite low. On the contrary, RADAR demonstrates robust and superior detection power, attaining the best performance on every dataset. As shown in Figure 2 the average AUROC score of RADAR (0.857) improves the best existing method (entropy. 0.651) by 31.64% against the unseen paraphraser. On average, RADAR is more robust to the seen paraphraser than the unseen paraphraser, because the seen paraphraser is what is used to train the detector in RADAR. More importantly, the detection performance of RADAR is stable across different paraphrasing schema, suggesting that RADAR can successfully mitigate the performance drop in Al-text detection.
https:///iithn wtt.:/oot.ttteeeee httpa/////nnttttaaaa//ataattrrra
"Collected from CCNet (67%) C4 [15%), GitHub [4.5%]. Wikipedia [4.5%]. Books [4.5%], ArXiv [2.5%].
Stack Exchange [2%]
httpp:://sharegpt.com
7

---

Table 2: AUROC score averaged over 8 target LLMs. RADAR- -ADAR-Seen Paraphraser means the para-
phraser used in RADAR (G,). MADAR-Unseed Paraphraser is OpenAl's 1-PT-3.5Turrbo API. The notations (0.0) denote the best/second- method for each dataset.
Evaluation Dataset
Evaluation Schema
Method
Xsum
SQuAD
WP
TOFEL
Average
log P
0.882
0,868
0.967
0.832
0.887
rank
0.722
0.752
0.814
0.731
0.755
log rank
0,902
0.893
0.975
0.847
0,904
w/o Paraphraser
entropy
0.536
0.521
0,296
0.534
0,472
DetectGPT
0.874
0.790
0.883
0,919
0.867
OpenAl (RoBERTa)
0.953rp
0.914
0.924
0.810
0,900.p
RADAR
0
0.825
0.847
0.820
0.856
log
0,230
0.156
0.275
0.130
0.198
rank
0.334
0,282
0.357
0.163
0.284
log rank
0.245
0.175
0.281
0.134
0,209
RADAR-Sear Paraphraser
entropy
0.796
0,845
0.763
0.876
0.820
DetectGPP
0.191
0.105
0.117
0.177
0.159
OpenAl (RoBERTa)
0.821
0,842
0.892.0
0.670
0.806
RADAR
0,920
0,927
0,908
0.932
0.922
log p
0,266
0.343
0.641
0,438
0,422
rank
0.433
0.436
0.632
0.342
0,461
log rank
0.282
0.371
0.632
0.421
0,426
RADAR- -nneeen Paraphraser
entropy
0.779
0.710
0.499
0.618
0.651
DetectGPT
0,360
0.384
0.609
0.630
0.434
OpenAl (RoBERTa)
0.789
0.629
0.726.
0.364
0.627
RADAR
0,955
0,861
0,851 (
0.763
0.857
4.044
4235
5.509
L003
3850
8.335
0.877
3.44
1.00
5/5
6.63
6.024
3770
3.344
1.305
0.03
0.24
8665
3.009
0025
666
8.635
0.53
6.56
2.00
3.05
3.007
334
1000
0,00
bww
0.254
113
6421
8.67
0.21
822
3,004
330
3372
1357
0.212
0,507
E378
0503
3.72
3.09
0,00
643
6,903
0.714
873
0.03
1122
3.09
0351
333
6,700
0.98
8:14
2321
2.154
13.10
Dues
8:117
1.225
1:84
1.30X
0123456789
(a) w/o paraphraser
(b) GPT-3.5-Turbo paraphraser
Figure 3: RADAR'S detection transferability between pairs of LLMs Table [ In the matrix, each row is the source LLM (model A) for training the detector, and each column is the target LLM (model B) for evaluation. The reported value the matrix represents the detection transferability from A to B. A larger value indicates better transferability. The bar chart shows the row-wise sum of the matrix, indicating the holistic transferability of each source LLM.
4.3 AI-Text Detection Transferability of RADAR
We explore the Al-text detection transferability of RADAR between the 8 LLMS and report the ratio F(A,B)=
for each LLM pair (A,B), where AUROC(A,B) means using the RADAR's s detector trained model A to evaluate the Al-text generated by model B. A larger ratio means better transferability from A to Figure shows the matrix of pairwise detection transferability and the bar chart of the holistic detection transferability to all the 8 LLMs in the without and unseen paraphrasing settings. We highlight two key observations as follows.
(I) Instruction-tue tuned models have better detection transferability. Partitioning the LLMs into two groups, we can find that the detector targeting an instruction-tun transfers better than the detector targeting the corresponding L.M without instruction-tuning (bottom 4 rows). Take the pair (Vicuna-7B, I.L.MA-BB) as an example, we can see that without paraphrasing, F(Vicuna- 7 LL.M) can reach up 95.0%. On the other hand, F(LLMMA-78 -BBB Vicuna-7B) can only
LLM (top 4 rows) generally

---

account for (8.2%. Sorting the detectors according to the holistic detection transferalbility (which is presented in the bar chart), we can see the top-3 detectors are all trained with the instruction- tunedd LLMs. A similar conclusion can be made for the with paraphrasing setting. Moreover, there is no obvious trend between the target L.M size and the resulting detection performance. The effect of instruction tuning on transferability is more prominent than model size.
(II) RADAR achieves better detection transferability against paraphrasing- Another interest- ing finding is that RADAR's 's transferability is generally improved when paraphrasing is in place. Comparing the two bar charts in Fig. 3a and Fig. 3bb the average holistic detection transferability (over all LLMs) is increased by 11.6%.. 6%. Except for LLaMA-7B (3.8% drop) and GPT-J-6B (1.4% drop), all other LLMs' holistic transferability scores are improved from 2.4% (Palmyra-base) to 47.6% (Camel-5B).
Transfer detection AI-text generated by GPT-4. We also test RADAR detectors on the texts generated by GPT-4. The results show that out of RADAR models can outperform the OpenAl (RoBERTa), and three of them can achieve more than 0.8 detection AUROC. For example, RADAR trained on Camel-5B can achieve 0,915 detection AUROC on GPT-4 generations. The results show that the RADAR can achieve good transfer detection for GPT-4 The details are given in Appendix K
Ensemble detection. We also explored whether and how ensemble learning benefits detection by combining the outputs of detectors. The results show that the detection performance can be lifted by carefully tuning the ensemble ratio and the model to be combined. Please see Appendix G for the exact experiment results.
To sum up. we believe our findings suggest promising results for training a universal robust Al-text detector by leveraging state-of-the-ar LLMs, and RADAR can use a smaller-sized and weaker LLM to achieve good detection performance on texts generated from top-notching LLMs (such as GPT-4).
4.4 Variants of Paraphrasing
In addition paraphrasing the original LLM-ggenerted texts, also evaluate the detection perfor- mance when paraphrasing human texts (the output is labeled as Al-text). We also allow paraphrasing multiple times in our analysis. We conduct our experiments on the Xsum dataset using the detector trained with Camel-5B. The paraphraser for evaluation is GPT-3.5- As shown in Figure 4a we find that RADAR is the only detector robust to multi-round paraphrasing. On paraphrased Al-text, all existing methods suffer from a notable performance drop. On paraphrased human-text RADAR remains effective, along with two existing methods (OpenAI (RoBERTa) and entropy). In general. multi-round paraphrasing does not seem to increase the difficulty of Al-text detection. We also find RADAR robust to Dipper 18 another paraphrase model. Please see Appendix forr details.
Deseston AL RDC
Detection
Paraphrase Times
Paraphrase Times
(a) Paraphrased Al-text
(b) Paraphrased human-text
Figure 4: Detection AUROC of RADAR against multiple paraphrasing. The experiments are conducted on Xsum using the detector trained for Camel-5BB.
4.5 Evaluation on RADAR's Paraphraser
Although our focus is on training a robust Al-text detector via RADAR, as a by-product, we expect to obtain a better paraphraser through adversarial learning. To verify this hypothesis, we compare the quality of the initial paraphraser (a pretrained LLM) and the final paraphraser returned by RADAR

---

using GPT-3.5- Turbo''s response. We select 100 documents from WebText (9] and use 4 different paraphrasers from RADAR paraphrase the documents. Then, we ask GPT-3.5 Gurrb to rate sentences generated by these paraphrasers versus their initial version (T5-large). Figure Sa shows that RADAR also improves the quality of paraphrasing. Figure 5b shows that the RADAR s paraphraser can score higher if it is trained with larger target L.MM with instruction tuning. Following 12 we
also evaluate RADAR's ' paraphrasers on Quora Question Pairs (QQF)) and use iBLEU (ar = 0.8) (30 shows
as the metric (higher is better). Figure shows that the paraphrasing performance can be improved via RADAR as all the MADAR-paraphrasee can achieve a larger iBLEU score than T3-large.
111
Canvill
Vorate
Sily
Geral boyst Maruh
Parapeeaett Derget ModH
Parpleaeer's Thrger Model
(a) GPT-3.5 assessment
(b) GPT-3.5 score
(c) iBLEU on QQP
Figure 5: Evaluation of RADAR's paraphraser versus its initial version (T5-large).
4.6 Balancing the Detection Performance in the with and without Paraphrasing Settings
From Figure 2 we can observe that though RADAR can achieve robust detection under paraphrasing, it is (slightly) worse than some of the existing baselines when Al-text data are unperturbed (i.e., w/o paraphrasing). We run a trade-off analysis on the weight coefficient À in Equation (3) to study whether RADAR be further tuned to achieve competitive performance while still being robust to paraphrasing. We use Vicuna-7B as the target model to train 10 RADAR detectors by varying À from 0.1 to 1.0 with 0.1 increment, and then evaluate these detectors well as other detection baselines on the evaluation datasets. The results in [ that we can promote RADAR's performance paraphrased data. Take À = 0.6 as an example. When we change from 0.5 (the default value of A) 0.6, the AUROC of w/o paraphrasing increases from 0.906 0.937, while the AUROC of unseen- paraphrasing also increases from 0.892 to 0.920. The result suggests that the detection performance of RADAR in the with and without paraphrasing settings can be simultancously improved or better balanced with careful tuning of the hyperparameter À during training.
unperturbed data
unperturbed data while still preserving high detection AUROC on
5 Conclusion
In this paper, we presented robust Al-text detector training framework called RADAR, which adopts adversarial learning to jointly train detector and a paraphraser. RADAR addresses the shortcoming of existing detectors when facing LLM- LLM-paraphrased texts. Our extensive experiments on LLMs and 4 datasets validated the effectiveness of RADAR and demonstrated its strong transferability across LLMs. We believe our results shed new light on improving Al-text detection.
Limitations and Ethical Considerations
While RADAR is more robust to paraphrasing than existing baselines measured on datasets, sometimes it may show degraded detection performance against native LLM-generated texts (without paraphrasing) when compared to the best existing detection method. Moreover, like every existing Al-text detector, we acknowledge that our detector is not perfect and will likely give incorrect predictions in some cases. In terms of ethical considerations, we suggest users use our tool assist with identifying Al-written content at scale and with discretion. If the detection result is to be used as evidence, further validation steps are necessary as RADAR cannot always make correct predictions.
10

---

Acknowledgement
The authors thank James Sanders and Jonathon Hartley for providing examples that can weaken the detection of RADAR models.
References
[1] Jack Brassil, Steven H. Low, Nicholas Maxemehuk, and Lawrence O'Gormnn. Electronic marking and identification techniques to discourage document copying, IEEE J. Sel. Areas Commun., (500):199515044 1995.
[2] Tom B. Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam. Girish Sastry, Amanda Askell, Sandhini Agarwal, Ariel Herbert-Vosss Gretchen Krueger, Tom Henighan, Rewon Child, Aditya Ramesh, Daniel M. Ziegler, Jeffrey Wu, Clemens Winter, Christopher Hesse, Mark Chen, Eric Sigler, Mateusz Litwin, Scott Gray, Benjamin Chess, Jack Clark, Christopher Berner, Sam McCandlish, Alec Radford, Ilya Sutskever, and Dario Amodei. Language models are few-shot learners. In NeurlPS, 2020.
[3] Souradip Chakraborty, Amrit Singh Bedi, Sicheng Zhu, Bang An, Dinesh Manocha, and Furong Huang. On the possibilities of ai-generated text detection. CoRR, abs/2304.04736, 2023.
[4] Minhao Cheng, Jinfeng Yi, Pin- Yu Chen, Huan Zhang, and Cho-Jui Hsieh. Seq2sick: Evaluating the robustmess of sequence- sequence-to-sequemee toseeunncee models with adversarial examples. In Proceedings of the AAAI conference artificial intelligence, volume 34, pages 3601-3608, 2020.
[5] Pedro Colon-Heraandez, Henry Lieberman, Yida Xin, Claire Yin, Cynthia Breazeal, and Peter Chin. Adversarial transformer language models for contextual commonsense inference. CORR, abs/2302.05406, 2023.
[6] Long Dai, Jiarong Mao, Xuefeng Fan, and Xiaoyi Zhou. Deephider: invisibility watermarking scheme for language model. CoRR, fbss/2008.06666 2022.
molti- and
[7] Cyprien de Masson d' Autume, Shakir Mohamed, Mihaela Rosca, and Jack W. Rae. Training language gans from scratch. In NeurlPS, pages 4302-4313, 2019.
[8] Sebastian Gehrmann, Hendrik Strobelt, and Alexander M. Rush. GLTR: statistical detection and visualization of generated text. In ACL, pages 111-116. 2019.
[9] Aaron Gokaslan, Vanya Cohen, Ellic Pavlick, and Stefanic Tellex. Openwebtext corpus. 2019.
http://Skylion007. git.ub.gggtt..bb... httphaub.ooo/ppeeeeeeeeetttorrr
[10] Ian Goodfellow, Jean Pouget-Abadie, Mchdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial networks. Commumications of the ACM, 63(1 1):139-144: 2020.
[11] Tom Hosking and Mirella Lapata. Factorising meaning and form for intent peentt-peeerving para- phrasing. In ACL/JCNLPP, pages 445-14488 2021.
[12] Tom Hosking. Hao Tang, and Mirella Lapata. Hierarchical sketch induction for paraphrase generation. In ACL, pages 2489-2501, 2022.
[13] Daphne Ippolito, Daniel Duckworth, Chris Callison-Buree and Douglas Eck. Automatic detection of generated text is easiest when humans are fooled. ACL, pages 1808-1822, 2020.
[14] Eric Jang, Shixiang Gu, and Ben Poole. Categorical reparameterization with gumbel-softmax. In ICLR, 2017.
[15] Mohan S. Kankanhalli and K. F. Hau. Watermarking of electronic text documents. Electron. Commer. Res., 2(1-2):169-1)) 189 2002.
[16] John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. A watermark for large language models. CoRR, 0ans2301..12222 2023.
[17] Kalpesh Krishna, Yixiao Song, Marzena Karpinska, John Wieting, and Mohit Iyyer. Para- phrasing evades detectors of ai-generated text, but retrieval an effective defense. CoRR, abs/2303. 13408, 2023.

---

[18] Kalpesh Krishna, Yixiao Song, Marzena Karpinska, John Wieting, and Mohit lyyer. Para- phrasing evades detectors of ui-generated text, but retrieval an effective defense. CoRR. abs/2303. 13408, 2023.
[19] Thomas Lavergne, Tanguy Urvoy, and François Yvon. Detecting fake content with relative en- tropy scoring. In Proceedings of the ECA/ 08 Workshop on Uncovering Plagiarism, Authorship and Social Software Misuse, Patras, Greece, July 22, 2008, volume 377 of CEUR Workshop Proceedings, 2008.
[20] Qi Lei, Lingfei Wu, Pin- Yu Chen, Alex Dimakis, Inderjit S Dhillon, and Michael Witbrock. Discrete adversarial attacks and submodular optimization with applications to text classification. Proceedings of Machine Learning and Systems, 1: 1414-665, 2019.
[21] Weixin Liang, Mert Yülksekööüül, Yining Mao. Eric Wu, and James Zou. GPT detectors are biased against non-native english writers. CoRR, abs/2304.028 2023.
[22] Chris J. Maddison, Andriy Mnih, and Yee Whye Teh. The concrete distribution: A continuous relaxation of discrete random variables. In ICLR, 2017.
[23] Eric Mitchell, Yoonho Lee, Alexander Khazatsky, Christopher D. Manning, and Chelsea Finn. Detectgpt: sero-shot machine-generated text detection using probability curvature. CoRR, abs/2301. 1305, 2023.
[24] Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll L. Wainwright, Pamela Mishkin, Chong Zhang. Sandhini Agarwal, Katarina Slama, Alex Ray, John Schulman, Jacob Hilton, Fraser Kelton, Luke Miller, Maddie Simens, Amanda Askell, Peter Welinder, Paul F. Christiano, Jan Leike, and Ryan Lowe. Training language models to follow instructions with human feedback. In NeurlPS, 2022.
[25] Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, and Peter J. Liu. Exploring the limits of transfer learning with unified text-to-text transformer. JMLR, 2020.
[26] Juan Rodriguez, Todd Hay, David Gros, Zain Shamsi, and Ravi Srinivasan. Cross-domain detection of gpt-2-generated technical text. In NAACL, pages 1213-1233, 2022.
[27] Vinu Sankar Sadasivan, Aounon Kumar, Sriram Balasubramanian, Wenxiao Wang, and Soheil Feizi. Can ai-generated text be reliably detected? CoRR, abs/2303. 1 1156, 2023.
[28] John Schulman, Filip Wolski, Prafulla Dhariwal, Alec Radford, and Oleg Klimov. Proximal policy optimization algorithms. CoRR, 0tx/1707.06344 2017.
[29] Irene Solaiman, Miles Brundage, Jack Clark, Amanda Askell, Ariel Herbert- Jeff Wu, Alec Radford, Gretchen Krueger, Jong Wook Kim, Sarah Kreps, al. Release strategies and the social impacts of language models. arXiv preprini arXiv: 092003, 2019.
[30] Hong Sun and Ming Zhou. Joint learning of a dual SMT system for paraphrase generation. In ACL, pages 38 42, 2012.
[31] Umut Topkara, Merean Topkara, and Mikhail Atallah. The hiding virtues of ambiguity: quantifiably resilient watermarking of natural language text through synonym substitutions, In MM&Sec, pages 174,174,22 2006.
[32] Honai Ucoka, Yugo Murawaki, and Sadao Kurohashi. Frustratingly easy edit-based linguistic steganography with a masked language model. In NAACL, pages 5486-5492, 2021.
[33] Qingyang Wu, Lei Li, and Zhou Yu. Textgail: Generative adversarial imitation learning for text generation. In AAAI, pages 14067-14075, 2021.
[34] Jingjing Xu, Xuancheng Ren, Junyang Lin, and Xu Sun. entropy based generative adversarial network for diversified text generation. In EMNLP, pages 9940-3949, 2018
GAN: A cross-
[35] Zichao Yang. Zhiting Hu, Chris Dyer, Eric P. Xing, and Taylor Birg-KKrkpattick. Unsupervised text style transfer using language models as discriminators. In NeurIPS, pages 2018.
[36] Lantao Yu, Weinan Zhang, Jun Wang. and Yong Yu. Seqgan: Sequence generative adversarial nets with policy gradient. In AAAI, pages 2852-2858, 2017.
[37] Rowan Zellers, Ari Holtzman, Hannah Rashkin, Yonatan Bisk, Ali Farhadi, Franziska Roesner, and Yejin Choi. Defending against neural fake news. In NeurIPS, pages 9051-9062, 2019.
12

---

Appendix
A Human-text Corpora
We summarize the human-text corpora used in RADAR's training, validation, and evaluation phases in Table A1 It shows the usage of these corpora, the source where they come from, and the number of samples select from them for evaluation.
Table A1: Summary of the used human-text corpora
Phase
Source Dataset
Dataset Key
Sample Counts
Trainng
WebText-train
text
160000
Validation
WebText-test
text
4007
Xsum-train
document
500
SQuAD-train
context
312
Evaluation
document
500
TOFEL-test
text
90
B Details of Existing Detectors
Every detector assigns score to the given text and determines whether the text is generated by AI based on the score. We introduce the scores used existing detectors in the following.
Unsupervised Methods. In this paper. we leverage log-p. rank, log-rank, and entropy as the baselines. They are all unsupervised methods. They depend on statistical metrics of the given text to determine if is an AI-text. Specifically, they input the given text to the target language model To, and sniff statisties from To's output. We use Mag.p, Mrank, rank and Mentopy to represent the score for them respectively. These scores are calculated as below:
Mugn(w)
1 N
Σ log Pro (1 1
(A1)
Mrnn(2)
index(sort(log P7 (+1x (22--1)),
(A2)
N
Mug-rank (x) =
log(index(sor((() PTo (-1x
(A3)
N
Mentopy (x)
Pr (jaa (1 log PTo (il
(A4)
N
where N the length of the input sentence x. C the size of the vocabulary, 2; means the i-th token in and x: 1:111 represents the first - 1 tokens in æ, sort(a) () is a sorting operation which inputs a list and returns a new list descending order, index(a.b) is indexing operation which inputs list with an element and outputs the position of b in a.
DetectGPTTs is also unsupervised detection method we compare with in this paper. It introduces another language model (denoted Ga), which is used to do perturbations on the given text. DetectGPT uses the perturbation discrepancy as the score assigned the text (denoted MDetenGPT). which is shown below:
MeessstPP (x:) log Pr, (x)
(A5)
where ū = Σ log Pr, (T), 02 = - Ei= (log Pro (i:) u), Fz Ps. Pg. and & is the number of perturbations applied each text.
13

---

Supervised Methods. RADAR, as well as OpenAl (RoBERTa), are both supervised detection methods. Let D denote the OpenAl (RoBERTa) or RADAR's detector. The score MD that they assigned the input text is defined below:
Mp(a) (oftmax(fo(=)))0)
(A6)
where (z) means D's [CLS] token's logits over the whole label set. Softmax (f [0] means the prediction probability of Al-text, and Softmax(fD=))] means the prediction probability of human-text. Since there are only two labels (Al-text vs human-text) in the label set, the detection is equivalent logistic regression task with scalar output.
C RADAR Loss Visualization
We visualize RADAR's training process by presenting the training loss and validation performance below. We take the Camel-5B language model an example.
(a) Detector Loss
(h) Paraphraser Loss
(c) Validation Detection AUROC
Figure A1: Visulization of the training process of RADAR targeting Camel-5B.
From Figure Ala and Figure ATb we can see that the loss for both the Detector and the Paraphraser converge. From Figure Alc we can conclude that RADAR's detection capacity on the validation dataset is promoted to a stable state as the training loss of the detector and the paraphraser converge.
D Paraphrase Settings
When using a RADAR-seen paraphraser, the input is: Paraphrase: [s], Where [s] is the slot for the input Al-text. The paraphraser adopts top-k sampling and nucleus sampling strategy to decode a new word. Top-k sampling only focuses on the & highest-probability tokens. Nucleus sampling sorts the sampling distribution in descending order and selects top-n tokens from the sorted distribution until their cumulative probability exceeds p. and then samples the next token from the top-n candidates. In our experiment, we set to 50 and p to 0.95.
When using GPT-3.5-Turbo's 's API service as another paraphrasing tool (RADAR-Unsed) paraphraser) to paraphrase the Al-texts, the instruction we input Enhance the word choices in the sentence to sound more like that of human. When paraphrasing the human-texts, the instruction is Worsen the word choices the sentence sound less like that of a human.
Multi-round paraphrasing can be easily achieved by using the paraphrased text as input text and using the paraphraser re- paraphrase it.
E
Complete Experimental Results
We show all the evaluation results Table A2 (without paraphraser), Table (with RADAR-Unsent paraphraser) and Table A4 (with RADAR- paraphraser).
F
Case Study for RADAR
Sample Selection. For each evaluation dataset (Xsum, SQuAD, WP, and TOFEL), we randomly select sample from the human-text corpora and use 8 instruction-tuned LLMs (Vicuna-7B.
14

---

Table A2: Performance evaluation (AUROC) with no paraphraser.
Targel Language Model
Method
Dataset
Pythin-2.8
Dolly-V2-3B
Palmyra-hise hase
Camel-3B
GPT-T-6B
Dolly-VE-6B
LL
Vicuna 7B
Xsum
0.829
0.993
0.902
0.998
0.809
0.937
0612
0.927
log P
SQUAD
0,005
0.992
0.967
D3007
0.999
0.779
0.916
0.70
0,932
0.996
TOFEL
0,705
0.965
0.770
0.999
0.718
0.886
0.644
0.971
Xsum
0.758
0.795
0.734
0.715
0.746
0.756
0.610
0.659
SQLAD
0.789
0.831
0.796
0.752
0.787
0.790
0.627
0:645
WP
0.859
0.818
0.841
0.761
TOFEL
0.739
0.792
0.768
0.765
0.726
0.751
0.857
0.617
Xsum
0.875
0
0.928
0.998
0.849
0.944
0.667
0.962
rank
SQUAD>
0.991
D3542
0332
0:217
0397
0.957
03977
TOFEL
0,740
0.960
0.807
0.995
0.749
0.889
0.675
0.959
Xsum
0.613
0.514
0.529
0.358
0.400
0.522
0.704
0.445
SQUAD
0.644
0.506
0.515
0.35%
0.527
0,851
0:422
entropy
0.308
0.183
0.421
0.173
TOFEL
0.617
0.305
0.628
0,455
0.616
0.535
0.607
0.311
Xsam
0.871
0.989
0.909
0.900
0.306
0.837
0.709
0,900
DeteaGPT
SQRAD
0.766
0.965
0./02
0.697
0.561
0:755
0306
0.967
0813
0339
0.726
03059
TOFEL
0363
0.909
03927
0.989
0.875
0.890
0.824
0.976
Xsam
0.91
0.962
0.93
0,9%9
0.979
0,980
0.900
0.8AD
OpenAl (RoBERT))
SQUAD
0.888
0.880
0.925
03348
0.339
0:871
0.856
TOFEL
0.887
0.747
0.915
0.748
0.872
0.851
0.710
0.748
Xsum
0.955
0.873
0.979
0,982
0.923
0,912
0.916
0.916
RADAR
SQWAD
WF
0821
0.762
0.849
0.965
0.968
0.763
0.743
0.829
0.725
0.009
0.902
TOFEL
0.756
0.742
03238
0.763
0.852
0.781
0.779
0.908
Table A3: Performance evaluation (AUROC) with RADAR-Unsen Paraphraser.
Target Language Model
Method
Dataset
Pylhi-ZNH
Dolly-V2.18
Palmyrs-bose
Camel.3
GPT-1-68
Dollg-V1-68
VieHnn-7E
Xsum
0.173
0,285
0212
0.530
0.141
0.237
0.144
0,408
log P
SQUAD
WF
02477
0.413
0.328
0.500
0.241
0.305
0255
0.767
0.425
TOFEL
0.4%6
0:00
0.201
03653
Xsam
0.429
0.429
0.478
0.300
0.382
0
04414
0.368
rank
SQUAD
WF
D44
0.463
D:480
0.486
0.400
0.693
04411
0440
0.502
0,393
TOPEL
0.377
0.397
0.335
0,366
0.300
0.326
Xsum
02001
0.201
0.248
0.500
0.164
0.264
0.150
0.376
log rank
SQuAD
WF
0289
0.126
D611
0.372
0.595
0.771
0.569
0.722
0,310
0.315
0.425
0.731
TOFEL
0.403
0.305
0.675
0.286
0,445
0.376
Xsam
03316
0,713
0.801
0.525
0.811
0.788
0.898
0.747
SQUAD
0300
0.630
0.7256
0.53
0.778
0.725
0.808
0.651
entropy
WF
D3545
0,306
TOPEL
0.397
0.737
0.30
0.729
0.57
0:436
Xsam
02260
0.389
0.291
0.211
0217
0.254
0.213
0.374
DetecGGPT
SQUAD
WF
02288
0.447
04139
0:343
0.844
0.393
0252
0.393
0,288
0.204
0.350
0.311
TOPEL
0.3%
0.662
0373
UNEY
0.572
0.18
0.522
0.746
Xsum
0.855
0.809
0.899
0.677
0.221
0.761
0.774
0.068
OpenAl (RoBERT))
SQUAD
WF
07277
0.397
0.006
0.757
0.465
0.665
0.38
0.748
0.612
0.663
0.352
TOFEL.
0.665
0311
0.308
0.309
0.348
0.312
Xsam
01866
0.937
0.96
0.96
0.94
0,985
0.910
0.947
RADAR
SQUAD
WF
03822
0373
0.821
03733
0.988
0.763
0.726
0.34
0.608
0.887
0.907
TOFEL
0.784
0,775
0.772
0998
0.634
0.809
0.554
0.827
Dolly-V Dolly-Vi-6B- 1-6B, Camel-5B, D221y-V2-3B, LLaMA-7B, GPT-J-6B, Palmyra-base, Pythia-2.8B) to generate completions for each text, then use GPT-3.5-Turbh API service to perform paraphrase to all completions. Thus, we get 64 Al-texts in total (32 completions, 32 paraphrases).
Case Selection. Each Al-text has a source model, for the detection of one given text, we use the RADAR-detector trained for its source model. Then, collect the one with the largest confidence to be machine- senerrtee (most likely to be correctly detected) and the one with the smallest confidence to be maacine--enerraed (mostly likely to evade detection) for the following case study.
Analysis. We show two detection cases in Table A5 One with a higher probability (0.9999) is an casy-to-detect case, and another with lower probability (0.0031) is a difficult-to-detee -o-teect case. Specifically, the latter can only be detected when our detection threshold drops below 0.0031. From the table, we can see that the misclassification has good explanation, because the Al-text is nearly identical to the original Human-text, except for the inclusion of several additional words. In fact, the Al-text can be seen as the Human-text with suffix composed of several words appended to it.
15

---

Table A4: Performance evaluation (AUROC) with RADAR- Paraphraser. Red text means the evaluating method is not capable to perform detection for some samples in the evaluating dataset and the reported value the detection AUROC after removing these samples..
Target Language Model
Method
Datasel
Pythia 2.88 2.8B
Dolly-X2-3B
Palmyra- base
Camel SB
GPT-J-6B
Dolly-Vi-6B
LLaMA-7B
Vicuna- 7B
Xsum
0.209
0,191
0.287
0.528
0.217
0,174
0.142
0.22X
log P
SQaAD
0.779
0,057
0.347
0.248
0.235
0.158
0.271
0.065
0,081
0.179
0.130
TORFI.
02251
1,025
0.204
0.155
0.172
0.022
0/887
0,199
Xsam
04499
0.261
0440
0.587
0.340
0.251
0.324
0.267
0.301
0.203
0.32
0:241
0:267
0.303
TOEFL
0.326
0.042
0:215
0.140
0.239
0.062
0.177
0.106
Xsam
0.306
0.197
0:330
0.539
0.241
0.189
0.154
0.214
log rank
SQUAD
00064
0.167
0.366
02250
0.244
0.154
0.252
0.075
0.182
0101
0.187
0. 1.134
0.187
TOEFL
02667
01025
0.227
0.135
0.151
U.B5
0ASSS
00085
Xsmm
0778
0.798
00772
03647
03814
0.851
0.71
0:848
SQUAD
0.769
Entropy
0330
0.822
TOEPL
0313
0.952
03025
0.795
0.879
0.035
0.891
0.922
Xsam
0.270
0.214
0.280
0.284
0.224
0.129
0.078
0.143
DetecGGPT
SQUAD
0.192
03061
TOEFL
0.327
0.107
0.322
0.257
0.187
0.081
0.040
0.111
Xsam
0344
0,319
D3329
0.716
0.786
0.31
0.83
0.842
OpenAI (RoBERTa)
SQUAD
WP
0.905
0,903
0371
0.8
0301
0.335
0.99
03881
03838
TORFL.
0711
0.621
0.022
0.10
0.716
01811
00649
Xsam
0379
0,920
0993
0.955
0.890
0,945
0.922
0.924
0917
TOEFL
0.99
0.804
03926
0.809
0.952
0.947
0.994
0.964
Table A5: Case study of RADAR's detection performance.
Source Modd
Oviginal Humsn
Parpllesse
Text
Probuldiit Al-tet
Aliaze was cant and sacearad abbranurale lut fixd laanaca complocll uncasalalee Helo let ue legin cppan seing experiznes and without you guilunee and feoding w- sold base been stedl ieposiile. Lei me gist you how seprised fed
Guetting woedd like to expreio my atount g stitale the
franlfll
vallin <ee Las soutisied Mas" fottues and the infertxi- on gathoodd bating my jouney las resialioed my Ge- Desptt Mas engloeatinn was -ill able to wheee be kandicap in it estural sato periing breatlaking pleceggn gropts and Sliiing videos -lextig leg
experioned
seigiliving plant Ii
scleatios thisoppinniig
sieclarion oneer Theie cslo lirge numbeer crganiors gring throug ose orge arother of change stile they fill segeetivv has mod
Canadi-B
WP
GPT-3
0,9599
planer
have bell-
rcientti discserioe
wo he uniemmal tax colled nut impart thoryy wi- huchoon he deartbeed rwo pure quwlaccann only Spacied which demret
This engeniee bos frewer changed my peroppiio of tumariy and inqind my pos upace ingienannnnn hoping and
impaar zavinaarse
undereseding
KGy Ricant Soar, anl accmunt dhinig sporks cat will
Ray Reluat Soom scaut desttng a sperts in thipph
smach th-mad Winderr Carnh Hicko -fferdt trai injonts when the vae he one adieggi in yo- os tu by MrrScanic Auai As Ma Sezet denire sagee
Boondd Witssirn Gareh thike 34, -tied best injorio when the von he soc stlop is as ti by Mi Sout's And Mig Seot deasn ch- Lhadee Cath allegdd defendier from Gren Lane ta sheppenoe, Surmyy aad croeed the cimagea my of be ollupts ris, le wil jasos, He Mr Sootls can doscit- bed "wilchingg and rayy lave boon agapplaiig" strling
by
Lian alleped detendast, tree Grmm Lanz in shepperton Sammy aad croeed the curno of
Caral-th
Xum
the dhagh ewful Stuceios Auseddayy rais, be sol james, He waid Scott's was doseri- And as xelling and twey have equoplasiig" Read Mr
No purplisoor
Slacstoon near Astolerry
6:0011
driven Soot's waliile retered
then he real crosed the conlageway may ogain belose coll.
side
die the snd but crooed the canlageery sgais befoce will:- (eeg hoad on with Food Trank was
ding
G Effectiveness of Ensembling Detectors from RADAR
We study the ensembling detection performance by combining two RADAR-detectors' prediction probability and report the detection AUROC calculated using the combined prediction probability.
The combined prediction probability E(A, B, x) = (1 (x) - 3D (Ix) is a weighted sum of the prediction probability of the base model A and the augmented model B. The detection performances are shown in Table A6 We explore various ensembling ratios and ensembling models. Ensembling with the base model itself and setting the ensembling ratio to both mean no ensembling. Setting the ensembling ratio to is another extreme case, which refers to the transfer detection scheme mentioned in Section 4.3 From the results, we can see that the ensembling detection's 's effectiveness can be influenced by both the ensemble model and the ensemble ratio.
16

---

Table A6: Ensembling Detection results averaged on datasets. Ensembling detection means combining base model A's output prediction and augmented model B's output prediction to detect A's generation. The ensemble ratio 3 varies from 1. Red text represents a better detection AUROC than that of no-ensembling
Augmented Model
Base Model
Ensemble Ratio
Vicuna-7B
Dolly-VI-6B Camel-5B
Dolly-V2-3B
0,906
Vicuna-7B
0.5
0,906
0.861
0.866
0.814
0,906
0.822
0.749
0.684
0.859
Dolly-V1-6B
0.5
0,884
0,859
0,846
0.829
0,877
0.859
0.722
0.764
0.920
Camel-5B
0.5
0.929
0,926
0.92
0.897
0.882
0.883
0.92
0.764
0.769
Dolly-V22 V2-3B
0.5
0,803
0.763
0.753
0.769
0.794
0.727
0.642
0.769
kgpard unbryy Disiiin Opand
Detection AUROC
0.7
Detection AUROC
0.
0.1
0.4
013
Length Relative Position
Length Relative Pos
(a) w/o paraphraser
(b) RADAR-Unseen paraphraser
Figure A2: Detection AUROC of RADAR toward AI Al-generated texts with different lengths. The reported value is the AUROC of 8 LLMs averaged over 4 human-ter datasets. The value the X-axis means the texts' relative length rank position the whole evaluation dataset. For example, 20% means the shortest 20% sentences.
H Text Detection Towards Different Lengths
We study RADAR's effects on Al-generated texts with different lengths. We grouped the evaluation dataset into subsets according to the length of the Al-text. The results are shown in Figure A2 We summarize observations below:
For the group [log probability, rank, log rank, DetectGPT)), without paraphrasing, these methods not really sensitive the length of the text. When facing paraphrasing, however, their performance increases with a longer text length.
For the group (entropy, OpenAl (RoBERTa), RADAR), without paraphrasing, these meth- ods have better detection performance for longer texts. On the contrary, their performance degrades when facing longer paraphrased Al-text (even though RADAR seems much better for short-text detection, it still outperforms other methods by large margin, see Figure A2b).
17

---

I Detection on Dipper Paraphrasing
We also explore the use of RADAR to detect other advanced paraphrasers. We use Dipper proposed in [88 (L60-060 version) to paraphrase the evaluation dataset following the same setup of RADAR- Unseen paraphrasing and RADAR-Seat paraphrasing. The results are shown in Figure A3 We can from the results that the green bars much higher than the red bars except for DetectGPT, which means in general, Dipper is less destructive than GPT-3.5- 3-rbbo to these detectors. RADAR's detection AUROC Dipper reaches 0.9. One thing be noted is that though the OpenAl (RoBERTa) can perform well under Dipper paraphrasing, it still cannot be regarded as robust because it can be bypassed by other paraphrasers (RADAR-Sae -een and RADAR-
wio Pamphrorer BIl RACAR Unowen Parpp Dtsper Parphraetr
Detecton AU1OC
0.867
0,900
0.9
0.572
0.426
572
0.472
3.651
0.434
0.627
Detection
Figure A3: Augmented version of Figure performance under Dipper paraphrasing.
The added green bar represents RADAR's detection
J Sensitivity Analysis of RADAR on the Hyperparameter À
Please refer to our discussion in Section 4.6
A-0.8
1-0
A-0.5
A=0.1
6PP-3.5-Tumi S-Turh Paraphras Detection AUTOC
0.9
A-0./
>-0.2
0./
log
OpenAl (RobOCRTa)
DetectGPT
0.95
W/O Paraphrase Detection AUROC
Figure A4: Sensitivity analysis for À in Eq. (3). The RADAR models are trained with Vicuna-7B with different À values ranging from 0.1 to 1.0. We then compare these RADAR detectors with other baselines on Vicuna-7B* s evaluation datasets. The norizontal/vertion axis shows the AUROC of umperturhee/ppaapprraeed Al-text.
18

---

K Detection on GPT-4 Generated Texts
Figure A5 shows RADAR's transfer detection for GPT-4. We RADAR detectors trained on weaker LLMs (Vicuna-7B, Camel-SB, etc.) to detect the generation of GPT-4. We prompted GPT-4 with the instruction: You are a helpful assistant to complete given text:, to generate texts based on the same evaluation datasets (Xsum, SQuAD, WP and TOFEL) used when evaluating other LLMs. The detection performance have been discussed in Section
Opnell (R:8CT7N)
0.2
0.404
0..44
0.3
0.28
83
60 1ama,70
dehuy1_8
CRTE
PADAR Scarce Mode
Figure A5: RADAR detection performance on GPT-4. The detector is trained with a source model, and the evaluation is measured with the texts generated from GPT-4.
L Use GPT-3.5 to Assess RADAR-paraphrasent
After RADAR training, we not only get a detector but also a paraphraser. We use GPT-3.5-Turbo to assign score these paraphrasers' generation assess the language generation capability of these paraphrasers and compare with their initial version (T5-large) to see how adversarial training benefits them. We compare these paraphrasers on a WebText subset with 100 samples. For each sentence in this subset, we first use GPT-2-XL to generate one sentence, and then use the paraphrasers (T5-large and 4 paraphrasers trained 4 instruction-tuned models' generation) paraphrase this sentence respectively. Then we input these 5 paraphrased sentences combining an instruction to GPT-3.5-Turie Our instruction You are given an array of five sentences. Please rate these sentences and reply with an array of scores assigned to these sentences. Each score is on scale from 1 to 10, the higher the score. the sentence written more like human. Your reply example: [2,2.2,2.2]. Then we sniff the score for each sentence from the returned answer and make the comparison. The results have been discussed in Section 4.5
19


Reviews:
[{"review_id": "0rE92LyvXl", "reviewer": "Reviewer_8fAM", "summary": "This paper proposes RADAR, a detection method for AI-generated text that is based on adversarial learning. Inspired by the conceptual idea of generative adversarial networks, RADAR consists of a paraphraser and a detector module. The former aims to generate textual content that evades an AI content detection system, while the latter aims to detect AI-generated text. Both modules are based on LLMs and trained end-to-end. Once trained, only the detector is then used for evaluation. \nThe authors conduct experiments with 8 LLMs (incl. Pythia-2.8B, GPT-J-6B, LLaMA-7B) across 4 datasets (Xsum, SQuAD, Reddit WritingPrompts, TOEFL-dataset). RADAR is compared against a range of detection baselines in multiple settings (with and without paraphrasing of test set texts). Experimental results demonstrate that RADAR attains a slightly lower performance on tasks without paraphrasing as compared to baselines, but outperforms all existing works when the texts are paraphrased. The authors provide more extensive results on evaluating RADAR detection performance across all possible pairings of the 8 LLMs when one of the models is used for paraphrasing during training and the other one during testing. Interestingly, the paper also shows that RADAR is robust against paraphrasing a sequence multiple times (in contrast to the baselines).", "questions": "* Can you elaborate on the dataset sizes and splits that you used to evaluate RADAR? This is a technical detail, but it would be helpful to get an estimate of test set sizes to better interpret the results in Table 2.\n* Did you run any additional experiments analyzing the model tradeoff between performance on paraphrased vs non-paraphrased data? \n", "limitations": "The authors neither discuss the limitations of their work nor do they mention ethical considerations arising from these results. I strongly encourage the authors to address these two missing points.", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "* The paper is very well-written, and the technical aspects are well-explained. The analysis of RADAR is thorough, and the experimental results are mostly promising.\n* The proposed algorithm is novel and the idea of adversarial learning in the context of AI-generated text is interesting.\n* Overall, I think that this method and work represent a solid contribution to the field.\n", "weaknesses": "* In terms of model performance, RADAR shows to be outperformed by existing baselines on original (i.e., unperturbed) data to a notable extent. While this is not necessarily problematic, it might be good to show some additional analyses further investigating how this tradeoff can be mitigated. For example, how does adjusting the weight coefficients in Equation 3 impact the detection results? Is there a way to better optimize these parameters, to ensure that model accuracy on unperturbed data remains competitive with baselines?\n* Missing discussion and limitations: The paper does not list any possible limitations, nor does it have a discussion section to contextualize the findings better into the existing literature. Since detecting AI-generated text has a direct application in more practical settings, it would have been helpful to address how well RADAR can be employed by users and practitioners, and which challenges remain. Moreover, the authors do not discuss potential ethical considerations arising from their work.\n\n", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for the time and expertise you have invested in these reviews. We are delighted to receive the positive feedback that our work provides a solid contribution to the field, especially that the paper is well-written, the technical aspects are well-explained, the analysis is thorough, the experiments are mostly promising, and the proposed algorithm is novel.\n\nBelow we provide point-by-point responses to your comments and questions.\n\n* **Comment 1**: Did you run any additional experiments analyzing the model tradeoff between performance on paraphrased vs non-paraphrased data?  \n\n  **Response**: This is a great question. Following your advice, to study the model trade-off, we conduct a sensitivity analysis on the coefficient $\\lambda$ in Eq.3 (we select 10 different $\\lambda$ values in the range of 0 to 1, and the original reported $\\lambda$ value is 0.5). The result is shown in **Fig. R1** in the attached PDF, the horizontal/vertical axis in **Fig. R1** shows the AUROC of unperturbed/paraphrased AI-text of each detector (including RADAR and baselines). We also list the exact values (AUROC) below. \n\n  | $\\lambda$ | 0.1 | 0.2 |0.3 | 0.4 |0.5 | 0.6 |0.7 | 0.8 |0.9 | 1.0 |\n  | :-----| :----: | :----: |:----: | :----: |:----: | :----: |:----: | :----: |:----: | :----: |\n  | **w/o Paraphrase Detection AUROC**| 0.935 | 0.911 | 0.926 | 0.917 | 0.906 | 0.937 | 0.923 | 0.908 | 0.908 | 0.923 |\n  | **RADAR-Unseen (GPT-3.5-Turbo) Paraphrase Detection AUROC** | 0.910 | 0.882 | 0.900 | 0.909 | 0.892 | 0.920 | 0.883 | 0.890 | 0.892 | 0.908 |\n\n  Due to the constraint in rebuttal time and training cost, we only reported the model tradeoff of RADAR detector trained with Vicuna-7B.  We evaluated these RADAR detectors along with other baselines on the generated data of Vicuna-7B. We can see the stability of RADAR as the RADAR detectors are clustered in a region where both the two AUROC values are high. By tuning $\\lambda$, we can promote RADAR’s performance on unperturbed data while still preserving high detection auroc on paraphrased data (for example, $\\lambda$=0.6). Though there is a small gap in the w/o paraphrase detection performance of RADAR and the best baseline, RADAR shows significantly improved detection performance against paraphrased AI-text. The reviewer’s intuition is also correct that by carefully tuning $\\lambda$, the tradeoff can be further mitigated. We will include this model tradeoff analysis of RADAR in the revised version.\n---\n* **Comment 2**: Can you elaborate on the dataset sizes and splits (of test set sizes) that you used to evaluate RADAR?   \n\n  **Response**: We briefly introduced the evaluation dataset in Section 4.1 and provided detailed information (including data sizes and splits) in Appendix (Section A). In short, we selected 500 samples from Xsum-train, 312 samples from SQuAD-train, 500 samples from WritingPrompts-train, and 90 samples from TOFEL-test as human-text. Then we employed 8 LLMs to generate the same number of AI-text counterparts as described in Line 138. Our evaluation dataset consists of both the AI-text and the human-text.\n---\n* **Comment 3**: The authors neither discuss the limitations of their work nor do they mention ethical considerations arising from these results.   \n\n   **Response**: Thank you for the comment. As other reviewers have pointed out, we addressed the limitation of RADAR in the observed slight reduction of detection performance when compared to the best detector in the without paraphrasing case, in order to obtain a significant gain in detecting AI-text with paraphrasing (line 225-228). Moreover, like every existing AI-text detector, our detector is not perfect and will likely give incorrect predictions in some cases. In the revised version, we will make a new paragraph of \"Limitation\" at the end of the Conclusion section to make these discussions more explicit. For potential ethical considerations, we will add that our method involves the use of existing large language models and may inherit the shortcomings therein. Also, users can use our tool to assist with identifying AI-written content at scale, but further validation steps are needed if the result is used as evidence.\n\n\n\n  \n\n\n"}, {"review_id": "hb5rN8xTRP", "reviewer": "Reviewer_M6sT", "summary": "This paper proposes an adversarial learning framework, called RADAR,\nfor improving the robustness of AI-text detector.  Given a target\nlarge language model (LLM) that generates AI-text, the framework\ntrains a detector model and a paraphraser model both are also based on\nan LLM simultaneously.  The performance of RADAR on AI-text detection\nis evaluated through eight LLMs and four datasets.  The results show\nthat RADAR can achieve the best classification accuracy measured by\nAUROC, when paraphraser is introduced to illude classification.  The\nauthors further clarified the relatively high versatility of detectors\ntrained through RADAR, especially when using LLMs fine-tuned through\ninstruction tuning.\n", "questions": "- The numbers in Figures 2, 3, 4, and 5 are too small to read on US\n  letter papers.\n\n- Bars in Figure 2 should also have error bars, because the bars\n  except for RADAR are the average of the AUROC for the four test\n  sets.  The results for RADAR are also averaging eight LLMs (or 64\n  combinations of training/testing LLMs) and four task results.\n  The authors have some space to also show the worst and best models.\n\n- The rows should be grouped by \"Evaluation Schema\" and the first two\n  columns should be swapped.  This makes direct comparisons of\n  different methods easier, also avoiding the colors for the schema,\n  which are difficult to distinguish by people with achromatic vision.\n\n- Coloring scheme for the two heat-maps in Figure 3 should be shared,\n  in order to avoid misunderstanding based on the colors only.  Text\n  color for dark cell should also be reconsidered.\n\n- The paper has some language problems, such as present tense in\n  Section 4, \"pair\" -> \"paired\" in l.101, and \"did not participate\" ->\n  \"has not participated\" in l.211.\n", "limitations": "Although the authors indicated Section 4.2, the limitations of this\nwork is rather discussed in Section 4.3 through a discussion on\ntransferability.  The high values for transferability suggest the\nproposed method and resulting AI-text detectors are versatile.\nHowever, it does not necessarily stop a kind of arms race between LLM\nand detector, as evidenced in Figure 3: detectors trained on weaker\nLLMs perform much worse for test data generated by stronger LLM.\n\nThere is no discussion on the potential societal impact, but according\nto the above note on the arms race, the results of AI-text detector at\nsome point would mislead users, potentially causing severe issues.\n", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "- The paper presents a straightforward but effective way of training a\n  robust AI-text detector, which is backed up by the empirical\n  experiments.\n\n- The authors also demonstrate that the detector trained by the\n  proposed method can perform well also for AI-texts generated by\n  another LLM, measuring the \"transferability\" across eight publicly\n  available LLM, revealing an advantage of instruction tuning for LLM.\n", "weaknesses": "- One critical point is in line 11 of Algorithm 1: $x_{h}$ and $x_{m}$\n  are sampled from $\\mathcal{H}$ and $\\mathcal{M}$ respectively, which\n  means that there are arbitrary pairs of $(x_{h}, x_{m})$ drawn from\n  $\\mathcal{H}\\times\\mathcal{M}$.  I suspect this could be wrong and\n  $x_{h}$ and $x_{m}$ must be corresponding, since $x_{p}$ is\n  generated from $x_{m}$ in l.12 and the tuple of $x_{h}$, $x_{m}$,\n  and $x_{p}$ is saved together in the batch in l.15, enabling an\n  indirect contrastive learning.\n\n- ll.165-166: What is the purpose of the normalization function $A$\n  and how is it actually implemented?  $R(x_{p},\\phi)$ is already\n  between 0 and 1 according to Equation 1.\n\n- It is nice to evaluate paraphrasers in Section 4.5, but what is the\n  justification to choose this method?  Paraphrase generation methods\n  are in general evaluated on paraphrase generation tasks, such as\n  Quora.  Human evaluation is a possible alternative.  On the other\n  hand, the process of using GPT-3.5 Turbo for rating is not clearly\n  explained, and anyways it will not draw reliable results and\n  consequent conclusions.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for the time and expertise you have invested in these reviews. We are grateful to receive your appraisal that our work provides a straightforward but effective way of training a robust AI-text detector. This is indeed our original aspiration.   \n\nWe reply to individual points below:  \n* **Comment 1**: I suspect this could be wrong and $x_h$ and $x_m$ must be corresponding.  \n\n  **Response**: The reviewer’s understanding is correct: $x_h$, $x_m$ and $x_p$ are corresponding. We will update our presentation in the revised version of our paper to avoid misunderstanding.\n---\n* **Comment 2**: What is the purpose of the normalization function $A$ and how is it actually implemented?   \n\n  **Response**: Reward normalization is a typical technique adopted by reinforcement learning implementations [R1, R2], which will help to stabilize the training process. During training, we use Normalization to shift the distribution of the rewards. Mathematically, it can be expressed as below:\n\n  Given a buffer $\\mathcal{B}$ with many samples ($n$ of them) and each holds a reward obtained from the detector: $R_1, R_2, \\ldots, R_n$:\n  1. Calculate the mean ($\\mu$):\n     $$\\mu = \\frac{\\sum_{i=1}^{n} R_i}{n}$$\n  2. Calculate the standard deviation ($\\sigma$):\n     $$\\sigma = \\sqrt{\\frac{\\sum_{i=1}^{n} (R_i - \\mu)^2}{n}}$$\n  3. Get Advantages:\n     $$A_i = \\frac{R_i - \\mu}{\\sigma}$$  \n  Where $A_i$ represents the advantages used to calculate the policy gradient.\n---\n* **Comment 3**: Paraphrase generation methods are in general evaluated on paraphrase generation tasks, such as Quora.  \n\n  **Response**: This is a great suggestion to further validate the paraphrasers obtained from RADAR.  Following [R3, R4], we evaluated RADAR-paraphrasers on Quora Question Pairs [R5] and use iBLEU (α=0.8) [R6] as the metric (higher is better). The result is shown in **Fig. R2** in the attached pdf. We can conclude that based on the iBLEU metric, the paraphrasers can be improved via RADAR as all the RADAR-paraphrasers can achieve a larger iBLEU score than T5-large (which is the initialization of the paraphraser). We will add this result in the revised version to support our argument.\n---\n* **Comment 4**: On the other hand, the process of using GPT-3.5 Turbo for rating is not clearly explained, and anyways it will not draw reliable results and consequent conclusions.  \n\n  **Response**: We understand the reviewer’s concern. We hope that our additional evaluation on Quora (see our response for Comment 3) provides another evidence for our claim.  Our evaluation is motivated by the study from the Vicuna Team that used GPT-4 to compare Vicuna with other open-source LLMs back in March 2023 [R7] (we did not have access to GPT-4 at that point). We use GPT-3.5-Turbo to rate all the five paraphrasers’ generations together at the same time. We introduced in Appendix (Section I) the details about the evaluation instruction.\n---\n* **Comment 5**: Comment on presentation ( font size, text color, coloring scheme, and table organization)  \n\n  **Response**: We will incorporate these suggestions into our updated version.\n---\n* **Comment 6**: Bars in Figure 2 should also have error bars because the bars except for RADAR are the average of the AUROC for the four test sets. The results for RADAR are also averaging eight LLMs (or 64 combinations of training/testing LLMs) and four task results. The authors have some space to also show the worst and best models.  \n\n  **Response**: It appears that there is a misunderstanding. In fact, in Fig. 2 the reported values for all the detection methods are all averaged across 8 target LLMs. In total, our evaluation includes the AI-texts generated from 8 (LLMs) * 4 (datasets) combinations). More specifically, we follow the evaluation setup in [R8] to evaluate a target LLM. Under this setting, all the methods except for Roberta-based Detector (supervised trained) use the target LLM itself for detection. For example, RADAR uses the corresponding detector trained with the target LLM, and baselines such as DetectGPT directly use the target LLM to access decoding information.  \n\n  We agree that Fig.2 should have error bars to reveal the difference between target LLMs. We draw error bars for all the detection methods using the detection standard deviation over 8 target LLMs and show the updated version in **Fig. R3** in the attached PDF. We also listed RADARs’ detection AUROC for different LLMs below:  \n\n    |Target LLM|Pythia-2.8B|Dolly-V2-3B|Palmyra-Base|Camel-5B|GPT-J-6B|Dolly-V1-6B|LLaMA-7B|Vicuna-7B|\n    |:-----|:---:|:---:|:---:|:---:|:---:|:---:|:---:|:---:|\n    |**w/o Paraphrase Detection AUROC**|0.854|**0.769(Worst)**|0.916|**0.920(Best)**|0.820|0.859|0.808|0.906|\n    |**RADAR-Unseen Paraphrase  Detection AUROC**|0.866|0.876|0.861|**0.973(Best)**|0.757|0.923|**0.712(Worst)**|0.892|\n---\n* **Comment 7**: However, it does not necessarily stop a kind of arms race between LLM and detector, as evidenced in Figure 3: detectors trained on weaker LLMs perform much worse for test data generated by stronger LLM.  \n\n  **Response**: The reviewer’s observation is correct. We totally agree that AI-text detection can be an arms race, and therefore adversarial learning is a natural approach to tackle this challenge. We would like to reemphasize that our RADAR is a general framework that applies to any LLM. Whenever a new and more powerful LLM emerges, we can use RADAR to obtain a better detector.\n\n---\n* **Comment 8**: The results of AI-text detector at some point would mislead users, potentially causing severe issues.  \n\n  **Response**: Although our detector is not perfect (and so are existing detectors), it shows better robustness than existing methods against paraphrasing, and we believe RADAR can be a useful tool to assist users to identify AI-written content at scale and help mitigate issues related to AI-written content.\n\n## References\n  Please see **Rebuttal References** in the global response.\n"}, {"review_id": "c36YVF15FB", "reviewer": "Reviewer_uRZ4", "summary": "The paper introduces a new framework called RADAR, which aims to address the gap in existing AI-text detection methods. RADAR utilizes adversarial learning to jointly train a robust AI-text detector. The framework consists of a paraphraser and a detector, both trained through adversarial training. The paraphraser's objective is to generate realistic content that can evade AI-text detection. RADAR continuously updates the paraphraser and the detector based on the feedback received from each other. The framework is evaluated using eight different language models (Pythia, Dolly 2.0, Palmyra, Camel, GPT-J, Dolly 1.0, LLaMA, and Vicuna) across four datasets. The experimental results demonstrate that RADAR outperforms existing AI-text detection methods, particularly when paraphrasing techniques are employed.", "questions": "1. The experimental settings are a little confusing. What are the training data? Why is the test data constructed in such a naive way as \"for the w/o paraphrasing setting, we use the original AI-text corpus M generated by a target LLM\". Why not construct some domain and task-specific AI texts?\n\n2. Why not do experiments on SOTA LLMs like GPT-4 and ChatGPT?", "limitations": "The authors have addressed the limitations.", "rating": 5, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The detection of ChatGPT generated texts is an interesting and important research problem.\n\n2. The proposed method is reasonable.\n\n3. Experimental results seem promising.", "weaknesses": "1. It is not clear whether the proposed method can achieve good result if the LLM for text generation (usually black-box) is much power than the paraphraser used in the proposed method (open-sourced).\n\n2. The proposed method is not tested on the texts generated by powerful LLMs like GPT-4.\n\n3. The experimental settings are a little confusing.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for the time and expertise you have invested in these reviews. We are delighted to receive the positive feedback that our research problem is both interesting and important, the proposed method is reasonable, and the experimental results are promising.  \n\nBelow we provide point-by-point responses to your comments and questions.\n* **Comment 1**: It is not clear whether the proposed method can achieve good result if the LLM for text generation (usually black-box) is much power than the paraphraser used in the proposed method (open-sourced).  \n\n  **Response**: Thanks for the reviewer's suggestion. We believe that we have discussed this setting in our paper.  \n  Below we show a detailed discussion in different scenarios to address the reviewer’s concern.  \n  1. When LLM is much more powerful than the paraphraser used in the RADAR training: Though we use a small-size paraphraser (T5-large, 770M parameters) to train a RADAR detector, our detector showed effectiveness against many powerful LLMs (from 3B to 7B) in Fig. 3. Though the LLMs in Fig.3 are open-sourced, they can be regarded as black-box as the LLM to be detected in the transfer setting (i.e. the off-diagonal entries in the matrix) is oblivious in the training process of the detector.  \n  2. When LLM is much more powerful than the paraphraser used in the RADAR evaluation. We need to emphasize that we not only introduced RADAR-Unseen paraphraser (GPT-3.5-Turbo, 175B parameters) but also introduced RADAR-Seen paraphraser (T5-large, 770M parameters). RADAR showed great detection performance in both cases. (See Table 2 for more details).  \n\n  In addition, we also test RADAR on the SOTA LLM: GPT-4 (black box) following your suggestion. As training a RADAR detector for GPT-4 is very expensive, we perform transfer detection on GPT-4 using RADAR detector trained for smaller LLMs, e.g. Vicuna-7B, Camel-5B, etc. We reported the results and the analysis in the response to the reviewer’s 2nd comment.  \n---\n* **Comment 2**: The proposed method is not tested on the texts generated by powerful LLMs like GPT-4. & Why not do experiments on SOTA LLMs like GPT-4 and ChatGPT?  \n\n  **Response**: Thank you for the suggestion. In fact, we indeed tried to incorporate ChatGPT/GPT-4 into RADAR’s target list before the submission. But there are many reasons that we don’t either train a detector targeting them or just evaluate our method’s performance on their generation.  \n\n  Firstly, at that time, we have limits (Tokens-Per-Minute (TPM) and Requests-Per-Minute (RPM)) for ChatGPT’s API usage. The generation process will be dramatically slow due to the TPM and RPM limits. Moreover, we didn't get access to GPT-4 (On July 7th we have access to GPT-4’s API).  \n  \n  Secondly, even up to now, the user still can’t get useful decoding information of GPT-4/ChatGPT from the return content of the API call as mentioned in [R9]. The other baselines except for Roberta-based Detector can’t work if there isn’t some decoding information (for example, log probability).  \n  \n  Following the reviewer's suggestion, we performed transfer detection on GPT-4 which has been mentioned in the response to the 1st comment. The evaluation procedure is as same as Fig. 3. The detection results are shown in **Fig. R4** in the attached pdf. The results show that  5 RADAR models can outperform the Roberta-based detector, and three of them can achieve 0.8+ detection AUROC. The results show that RADAR can achieve good detection for GPT-4.  \n\n---\n* **Comment 3**: What are the training data?  \n\n  **Response**: As briefly mentioned in Line 188, we have Human-text sampled from WebText [R10] and original AI-text generated by the corresponding LLM. During training, the AI-text will be perturbed. The Human-text, AI-text, and the perturbed AI-text will all be used to train the detector. We introduced the training data in Section 4.1 and in Appendix (Section A). \n---\n* **Comment 4**: Why not construct some domain and task-specific AI texts?  \n\n  **Response**: Thank you for the comment. In fact, the AI-texts in our evaluation dataset are already domain and task-specific. We choose  Xsum (news ), SQuAD (Academic Essays), Reddit WritingPrompts (Creative Writing Stories), and Tofel Essay (Non-native speaker's essay) as the human-texts in the evaluation dataset. We let the target LLM do text completion for these domain-specific or task-specific human-texts to get AI-texts, so the AI-texts can be regarded as domain and task-specific, too.\n\n## References\nPlease see **Rebuttal References** in the global response.\n"}, {"review_id": "Dk9jCNH49l", "reviewer": "Reviewer_acyW", "summary": "The paper proposes a framework called RADAR for training a robust AI-text detector using adversarial learning. The framework consists of a paraphraser and a detector, both based on large language models (LLMs). The paraphraser aims to generate realistic contents to evade AI-text detection, while the detector aims to enhance AI-text detectability. The two players iteratively update their model parameters until their respective validation loss becomes stable. Experimental results show that RADAR outperforms existing AI-text detection methods, especially when paraphrasing is involved. The paper also highlights the transferability of RADAR's detection capability to other LLMs.", "questions": "+ Have you ever tried the paraphraser trained by [1]?  I want to see whether your proposed RADAR could be spoofed by this paraphraser.\n\n\n\n[1]Paraphrasing evades detectors of AI-generated text, but retrieval is an effective defense", "limitations": "The limitations are adequately discussed.", "rating": 6, "confidence": 4, "soundness": 4, "presentation": 3, "contribution": 3, "strengths": "+ The paper brings back the success of adversarial learning. The idea of employing an adversarial AI text paraphraser is simple but reasonable.\n+ The experiments conducted on 8 different LLMs and 4 datasets demonstrate the effectiveness of RADAR in achieving consistently high detection performance. \n+ The proposed method is not only effective with the seen paraphraser but also generalizable across different unseen paraphrser.", "weaknesses": "+ The generation quality after post-processed by the AI paraphraser is my major concern. Since the paraphrase model is inferior (T5 in your case) to the generation model, I suspect that the machine-generated text degrades in quality after paraphrasing. Meanwhile, we do not know whether the paraphrased text keeps its semantics unchanged. Therefore, I suggest the authors add an experiment comparing the text before and after being paraphrased. \n+ The parameter scale of studied language models in the experiment is at most 7b.  I am curious to see the performance on larger models like GPT3.5 or GPT4. I understand that the cost of open AI API is one of the barriers to conducting such experiments. If this is the case, you may perform experiments on a sampled subset from the datasets to save the budget.\n+ In line 268 you claim that all existing methods suffer from a notable performance drop on paraphrased AI text. However, from Figure 4(a) and Figure 2, we could observe that the entropy method actually becomes better.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for the time and expertise you have invested in these reviews. We are delighted to receive the positive feedback that our method is simple but effective.   \n\n---\n* **Comment 1**: The generation quality after post-processed by the AI paraphraser is my major concern. Since the paraphrase model is inferior (T5 in your case) to the generation model, I suspect that the machine-generated text degrades in quality after paraphrasing. Meanwhile, we do not know whether the paraphrased text keeps its semantics unchanged.  \n\n  **Response**: Thank you for pointing out this issue. In our evaluation, we not only use T5 as the paraphraser (RADAR-Seen) but also use GPT-3.5-Turbo as the paraphraser (RADAR-Unseen). The experimental results showed that no matter whether the paraphraser is inferior (T5) to the generation model or superior (GPT-3.5-Turbo) to the generation model, RADAR can achieve good performance.   \n\tIn terms of the paraphrased texts’ quality, following the suggestion from reviewer M6sT, we showed the RADAR-Seen paraphraser’s iBLEU score is much higher than the original T5-large on the standard benchmark: Quora Question Pairs. The iBLEU score is shown in **Fig. R2** in the attached PDF. We also note that in RADAR training, we take the human-text, the original AI-text (by a target LLM), and the paraphrased AI-text (by a paraphraser) into consideration. Therefore, the detector not only sees the paraphrased texts.  \n\n---\n* **Comment 2**: I am curious to see the performance on larger models like GPT3.5 or GPT4. I understand that the cost of open AI API is one of the barriers to conducting such experiments. If this is the case, you may perform experiments on a sampled subset from the datasets to save the budget.  \n\n  **Response**: Thanks for your understanding that training a detector for those OpenAI close-sourced LLMs is expensive for us. Due to the limit (Quota & Tokens-Per-Minute & Requests-Per-Minute) of accessing OpenAI API service, training a detector for GPT-3.5/GPT-4 is both time-consuming and money-consuming, and honestly beyond our capability (for example, we estimated that the complete RADAR training process for GPT-4 will cost at least $1000). The training data generation process will also be dramatically slow due to the TPM and RPM limit. However, evaluation is feasible. We use RADAR detectors that are trained for other language models to perform transfer detection on GPT-4’s generation. The detection results are shown in **Fig. R4** in the attached pdf. The results show that 5 RADAR models can outperform the Roberta-based detector, and three of them can achieve 0.8+ detection AUROC. The results show that RADAR can achieve good detection for GPT-4.  \n\n---\n* **Comment 3**:  However, from Figure 4(a) and Figure 2, we could observe that the entropy method actually becomes better.  \n\n  **Response**: This observation is correct. We also observed this phenomenon and in Sec. 4.2 we have mentioned that although entropy is robust to paraphrasing, its detection AUROC is quite low no matter whether the AI-texts are paraphrased or not.  \n\n  Back to line 268, where we write \"On paraphrased 268 AI-text, all existing methods suffer from a notable performance drop.\" Actually, according to the context, this sentence is correct. Because this sentence is to depict the recursive paraphrase attack to AI-text and from the corresponding figure (Fig. 4. a), we can see that after the 2nd paraphrase, the detection auroc of entropy begins to degrade indeed. We will make this discussion clearer to avoid confusion.  \n\n  In summary, even if the entropy method becomes better after 1 round paraphrase, it is still not a good detector because of the low AUROC and it is not robust to recursive attacks. \n \n\n---\n* **Comment 4**: Have you ever tried the paraphraser trained by [1]? I want to see whether your proposed RADAR could be spoofed by this paraphraser.  \n\n  **Response**: We thank the reviewer for pointing us to a new paraphraser. Following your suggestion, we use Dipper L60-O60 version to perform a paraphrase attack to the evaluation dataset following the same setup of RADAR-Unseen attack and RADAR-Seen attack. We listed RADAR and other baselines’ performance below.   \n  |Detection Method|log p|rank|log rank|entropy|DetectGPT|Roberta-based Detector|RADAR|\n  |:-----|:----:|:----:|:----:|:----:|:----:|:----:|:----:|\n  |**w/o Paraphraser Detection AUROC**|0.887|0.755|0.904|0.472|0.867|0.900|0.856|\n  |**GPT-3.5-Turbo(RADAR-Unseen) Paraphraser Detection AUROC**|0.422|0.461|0.426|0.651|0.434|0.627|0.857|\n  |**Dipper Paraphraser Detection AUROC**|0.571|0.553|0.572|0.705|0.402|0.966|0.901|\n  |**RADAR-Seen Paraphraser Detection AUROC**|0.198|0.284|0.209|0.820|0.159|0.806|0.922|\n\n  We can see from the table that the values in the third line are much higher than the second line except for DetectGPT, which means Dipper is less destructive than GPT-3.5-Turbo to the detection system listed in the table.  RADAR’s performance under this attack reaches 0.9. One thing to be noted is that though Roberta-based detector can perform well under Dipper Paraphrasing, it still can not be regarded as robust because it can be bypassed by other paraphrasers.\n\n"}]

Author rebuttal:
## Rebuttal References

[R1] PyTorch actor-critic example. (we are not allowed to post any link, so please google it to find the link)

[R2] PyTorch REINFORCE example. (we are not allowed to post any link, so please google it to find the link)

[R3] Tom Hosking and Mirella Lapata. Factorising Meaning and Form for Intent-Preserving Paraphrasing. In ACL/IJCNLP (Volume 1: Long Papers), pages 1405--1418, 2021.  

[R4] Tom Hosking, Hao Tang and Mirella Lapata. Hierarchical Sketch Induction for Paraphrase Generation.  In ACL (Volume 1: Long Papers), pages 2489--2501, 2022.  

[R5] Kaggle competitions on Quora Question Pairs. (we are not allowed to post any link, so please google it to find the link)   

[R6] Hong Sun and Ming Zhou. Joint learning of a dual SMT system for paraphrase generation.  In ACL (Volume 2: Short Papers), pages 38--42, 2012.  

[R7] The Vicuna Team. Vicuna: An Open-Source Chatbot Impressing GPT-4 with 90%* ChatGPT Quality. In LMSYS Org's blog, 2023. (we are not allowed to post any link, so please google it to find the link)  

[R8] Eric Mitchell, Yoonho Lee, Alexander Khazatsky, Christopher D. Manning, and Chelsea Finn. Detectgpt: Zero-shot machine-generated text detection using probability curvature. CoRR, abs/2301.11305, 2023.  

[R9] OpenAI. GPT-4 API general availability and deprecation of older models in the Completions API.  In OpenAI's blog, 2023. (we are not allowed to post any link, so please google it to find the link) 

[R10] The project page of Open WebText Corpus. (we are not allowed to post any link, so please google it to find the link) 

## Rebuttal Figures

Please download the attached PDF file.

Meta-review: The paper centers around AI-Text Detection, a prominent topic within the realm of LLM. Reviewers find the proposed algorithm to be novel, and the idea of applying adversarial learning in the context of AI-generated text is interesting. The experiments conducted on various LLMs and datasets demonstrate that the proposed approach consistently achieves high detection performance. However, reviewers have raised concerns regarding the limitations statement, generation quality after post-processing by the AI paraphraser, the experimental setting, and the analysis of how the parameters impact the detection results. The author's responses have partially addressed the concerns raised by the reviewers, leading some to subsequently adjust their scores. Consequently, I am inclined to recommend acceptance.
Decision: Accept (poster)