IPAD: Inverse Prompt for AI Detection - A Robust and Interpretable LLM-Generated Text Detector
Authors: Zheng CHEN
Yushi Feng
Jisheng Dang
Changyang He
Yue Deng
Hongxi Pu
Haoxuan Li
Bo Li
Venue: NeurIPS 2025 poster ()
Keywords: AI Detection
Prompt Inversion
Large Language Models
Explainability
AI Safety
Primary area: applications
TL;DR: This paper presents IPAD, a novel AI detection framework that identifies predicted prompts that could have generated the input text. IPAD outperforms the baselines by 9.73% on in-distribution data and 12.65% on OOD data.

Abstract: Large Language Models (LLMs) have attained human-level fluency in text generation, which complicates the distinguishing between human-written and LLM generated texts. This increases the risk of misuse and highlights the need for reliable detectors. Yet, existing detectors exhibit poor robustness on out-of-distribution (OOD) data and attacked data, which is critical for real-world scenarios. Also, they struggle to provide interpretable evidence to support their decisions, thus undermining reliability. In light of these challenges, we propose IPAD (Inverse Prompt for AI Detection), a novel framework consisting of a Prompt Inverter that identifies predicted prompts that could have generated the input text, and two Distinguishers that examine the probability that the input texts align with the predicted prompts. Empirical evaluations demonstrate that IPAD outperforms the strongest baselines by 9.05% (Average Recall) on in-distribution data, 12.93% (AUROC) on out-of-distribution (OOD) data, and 5.48% (AUROC) on attacked data. IPAD also performs robust on structured datasets. Furthermore, an interpretability assessment is conducted to illustrate that IPAD enhances the AI detection trustworthiness by allowing users to directly examine the decision-making evidence, which provides interpretable support for its state-of-the-art detection results.

IPAD: Inverse Prompt for AI Detection A Robust and Interpretable LLM-Generated Text Detector
Zheng Chen' "Yushi Feng2-Jisheng Jisheng Dang² Yue Deng' Changyang He*
Hongxi Pu Haoxuan Bo Li
Computer Science and Engineering, Hong Kong University of Science and Technology
School of Computing and Data Science, The University Hong Kong
"School of Information Science Engineering, Lanzhou University
*Max Planck Institute for Security and Privacy
*Computer Science, The University of Michigan
"Center for Data Science, Peking University
zchenin@connect ust.hk, fengys@connect.. hku. hk, dangjisheng@lzu.ee edu. en, ydengbi@conne woongbi@connect...m ust.uut changyang hwwmph-sm@pp..cc org, hongxi @umi ch. edu, hxli@stu, pku edu. cn, bli@cse.ust.oe
Abstract
Large Language Models (LLMs) have attained human-level fluency text gen- eration, which complicates the distinguishing between human-writte and LLM- generated texts. This increases the risk of misuse and highlights the need for reliable detectors. Yet, existing detectors exhibit poor robustness (OOD) data and attacked data, which is critical for real-world scenarios. Also, they struggle to provide interpretable evidence to support their decisions, thus under- mining the reliability. In light of these challenges, we propose IPAD (Inverse Prompt for AI Detection), novel framework consisting of Prompt Inverter that identifies predicted prompts that could have generated the input text, and two Distinguishers that examine the probability that the input texts align with the predicted prompts. Empirical evaluations demonstrate that IPAD outperforms the strongest baselines by 9.05% (Average Recall) in-distribution data, 12.93% (AU- ROC) on cul-of-distribution data, and 5,48% (AUROC) on attacked data. IPAD also performs robustly on structured datasets. Furthermore, interpretability assessment is conducted to illustrate that IPAD enhances the Al detection trustwor- thiness by allowing users to directly examine the ercision-makinng evidence, which provides interpretable support for its state-of oftte-of-the-art detection results.
nut-of-distribution
Introduction
Large Language Models (LLMs), characterized by their massive scale and extensive training data
[Chen et al.) 2024 Feng et al. 2025a Cheng et al.) 2025], have achieved significant advances
in natural language processing (NLP) Ouyang al. 2022 Veselovsky et al. 2023 Wu al.)
2025). However, with the advanced capabilities of LLMs, they are subject to frequent misused in
various domains, including academic fraud, the creation of deceptive material. and the generation
of fabricated information [Ji et al.) 2023 Pagnoni et al., 2022, Mirsky et al.) 2023 Chen et al.
2025), which underscores the critical need to distinguish between human-written text (HWT) and
L-g-eerrrteed text (LGT) [Pagnoni et al. 2022 Yu et al. 2025 Kirchenbauer et al. 2023
"Equal contribution. Corresponning authors.
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

Instraction
:Step1 Train the Prompt Inverter
Step4 Distinguisher Merge
whatis the geonpe that tre input?:
content generated by
Input
Legerratted Text (LGT)
Prompt Inverter
Original Prompt
promppe
Output
Human / LLMM
the prosage
Instruction
Step2 Train the Prompt-Text Consistency Verifier (PTCV)
texi2 Can
Predicted Prompt
Pracy (1 -W-Pac
through prompt
Imput
Human written Text Text(WWT (HWT) LLM generated (LGT)
Prompt Inverter
-eet 1: (Predlicted Prompt,
Distin- guisher
test 2: (LGT) (IWWT):
Dutput
(PTCV)
Yes No
Instrurtion
Step3 Train the Regeneration Comparator (RC)
Teut lis groweate LLM,
ceterntine
Predicted Prompt
Regenerated Text
Input
Human-written Text (HWT) LLM generated Text (IGT)
<>
Prompt Inverter
LLM Generate
Distin- guisher (RC)
leat E. Regenauttal
2eet (LGT) or fitreyy Ourput
Yes
Figure 1: The overall workflow of our proposed IPAD framework
However, due to their sophisticated functionality, LLMs pose significant challenges the robust- ness of current AI detection systems [Wu et al., 2025]. The existing detection systems, including commercial ones, frequently misclassify texts as HWT [Price and Sakellarios) 2023 Walters 2023
and generate inconsistent results when analyzing the same text using different detectors [Chaka
2023 Weber- Wulff et al.) 2023]. Studies show false positive rates reaching up to 50% and false
negative rates high as 100% in different tools [Weber- Wulff al. 2023
when dealing with
out-of-distribution (OOD) datasets.
Another critical issue with the existing AI detection systems is their lack of verifiable evidence (Ha laweh and Refae, 2024| Feng al., 2025b], as these tools typically provide only simple outputs like "likely written by Al" or percentage-based predictions Weber-Wullt et al. 2023]. The lack of
evidence prevents users from defending themselves against false accusations [Chaka 2023] and hin- ders organizations from making judgments based solely the detection results without convincing evidences [Weber- Wulff et al. 2023). This problem is particularly troublesome not only because the low accuracy of such systems mentioned before, but also due to the consequent inadequate response to LLM misuse, which can lead to significant societal harm [Stokel-Walker and Van Noorden] 2023]
Porsdam Mann al. 2023 Shevlane et al.) 2023 Wu al. 2025 These limitations highlight the pressing need for more reliable, explainable and robust detectors.
In this paper, propose IPAD (Inverse Prompt for AI Detection), novel and interpretable framework for detecting Al-generated text. As illustrated in Figure IPAD consists of two main components: a Prompt Inverter, which reconstructs the underlying prompts from input texts, and two Distinguishers the Prompt-Text Consistency Verifier (PTCV), which measures the aligmment between the predicted prompt and input text, and the Regeneration Comparator (RC), which compares the input with the corresponding regenerated text for consistency. By explicitly modeling the reasoning path from prompt inversion to final classification, IPAD introduces a paradigm shift in Al-generated content detection, significantly enhancing both detection robustness and user interpretability.
Empirical results show that IPAD outperforms state-of-the-al baselines by 9.05% in Average Recall on in-distribution datasets, 12.93% in AUROC out-of-distribution (OOD) datasets, and 5.48% in AUROC under adversarial attacks. IPAD also generalizes well to structured data. A user study further reveals that IPAD improves trust and usability in detection tasks by presenting concrete decision evidence, including predicted prompts and regenerated texts. Code available at hhtpss //githubs Bitooo///lllffe. c/ IPAD Inver Prooeeer-rroo---eeee for AI-Detection
Our contributions can be summarized as follows:
We introduce novel fine-tuned pperse-proomptbaseee detection framework that integrates prompt reconstruction and dual consistency evaluation.

---

We achieve superior detection performance on in in-distribution, OOD, adversarially attacked, and prompt-structured datasets.
We demonstrate through an interpretability assessment that IPAD improves human trust and interpretability in Al text detection.
2 Methodology
2.1 Preliminaries
Modules. Our method comprises Prompt Inverter fine and two Distinguishers, namely the Prompt-Text Consistency Verifier (PTCV) frrev and the Regeneration Comparator (RC) fRC. Given an input text T, the task is to determine whether it is human- written (HWT) generated by an LLM (LGT). We denote by Dpr the training set for fine, consisting of pairs (T, P) where T an I.M--generated text and P is its original prompt. The disjoint datasets: PLr contains I. L.L--generatdd samples and DHWT contains components are fine-tuned using Microsoft's Phi3-medium- 128k-instruct modiiA al. [2024]
distinguishers are trained using ones. All
Softmax- Based probability for Binary Classification in LLM. To estimate the fine-tume fine-tuned model's binary classification probability (i.e., the probability of predicting "yes" "no"), we follow the logit-based estimation approach (Yohhikwwa and Okazaki 2023]. Given the model input and the output logits z, the model's ' probability assigned y is computed through the softmax function
Confidence,es = P "yes"| x) = (2) Confidence,s Plý = "no" 2) = (z))
Since the fine-tuned model will only output"yes' "no", we further calculate the probability for this binary classification as:
Confidence,es
Probability yes =
Probability no = 1 Probability yes
Confidenceyss + Confidence
2.2 Workflow
Our framework follows a multi-stage fine-tuning pipeline with the following four steps, as illustrated in Figure I The details of the datasets for fine-tuning is illustrated in Appendix A
Step 1: Training Prompt Inverter. We first fine-tune a model fin on dataset Dpt, with the data structure shown in Figure [ For any input text T, finv predicts the most likely prompt P that could have generated it, i.e. P = -in (T). The resulting Prompt Inverter is then frozen and reused in the following downstream steps.
Step 2: Training the Prompt- Text Consistency Verifier (PTCV). Given the predicted prompt P in step 1, and the input text T [HWT, LGT), the verifier frrev is trained to predict whether the text 7 could plausibly be generated by an LLM using the prompt P. The fine-tuning datasets DLGT and DHWT share the same structure, with output labels "yes" for DLGT and "no" for DHWT, as shown in the Figure
After fine-tuning this module, we applied to the validation and computed the probability score Prrcv = fTrcv(T. P), where the confidence value was estimated using the softmax-based method described in Section 2.1
Step 3: Training the Regeneration Comparator (RC). With the same predicted prompt P in step we use an LLM to generate a regenerated text T" +- LLM(P). By default, the LLM we use gpt-3. 3.b.brbb... Then, the comparator fRC is trained to assess whether T and T" can be generated by LLM with a similar prompt. This step uses the same dataset as in Step 2, but applics a different structural formatting, as shown in Figure [
After fine-tuning this module, we also applied it to the validation set and computed the probability score Pec = [RC(T, P).
Step Distinguisher Merge. To determine the final classification, we combine the two probability scores, PPICV and PRC. obtained from Step 2 and Step 3 on the validation set. Specifically,
3

---

compute a weighted ensemble as p w Pricv + (1 - w) PRC, and assign the prediction = LGT if f т, Y HWT otherwise. The weight E [0, 1] and the threshold E [0, 1] are treated as hyperparameters and selected via grid search on the validation set. The selected values were = 0.45 and т 0.54.
Inference. We perform inference unseen input texts T by sequentially applying the trained modules. Given an input text T, we first use the prompt inverter fin to recover the most plausible prompt P. The prompt is then used regenerate candidate text T' via the an LLM. Next, compute two probability scores: prrcy, indicating whether I is consistent with P, and PRC. assessing the likelihood that T and 7" originate from the same prompt. These scores are fused into a final decision score ý using the gird-searched weight w, and the predicted label is determined by comparing á against the threshold The complete inference pipeline is summarized in Algorithm
Algorithm IPAD Detection Procedure
2.3 Computational Complexity and Deployment Considerations
Require: Input text T; trained modules fiv, fprcv, fRC: LLM fLLM; fusion weight
The inference procedure of the IPAD framework consists of three calls through a light-weight open- sourced LLM Phi-3 a decoder-only Transformer, whithin which, the self-attention complexity per layer is O(n² -d), where n is the sequence length and the hidden dimension (Vaswani al., 2017). The additional api call to 5pt-3.5-turt generating texts introduces fixed latency but local computation cost. Therefore, the overall com- putational cost is bounded by 0 L n²² d OpenAI where L = 32 is the number of layers in phi-3 [Abdin et al.] 2024), which is relatively small. All three phi calls can be deployed in an Nvidia V100 GPU as the minimum requirement. This demonstrates that IPAD is not computation- ally expensive and can be deployed with relatively modest hardware requirements.
E [0, 1]; threshold 5 E [0,1]
1: P f- fime (T) D. -Inverse-prompt prediction
2: T & (P) & Regenerate text using P
3: x PTCV fFrev(P,T)
frrev ( (=
4: PrrCv < a( (T
5: x RC + (
for re-
6: PRC & o(a (a(
7: ÿ <- PerCv + (1 w) PRC
8: if D- then
9:
Y LGT
10: else
11: Y + HWT
12: end if
13: + (P, prrcv, PRC, p)
14: return (Y, E)
2.4 Training
The supervised fine-tuning (Wei et al. 2022] process is performed on a Microsoft's open model, phi3- 1113-medium-1288 instritt and low-rank adaptation (LoRA) method [Hu et al. 2022 on the LLaMA-Facte -aattoyy framework [Zheng et al. 2024a). We train using six A800 GPUs for 20 hours for Prompt Inverter, 7 hours for PTCV, and 9 hours for RC.
3 Experiments
We investigate the following questions through our experiments:
Assess the robustness of IPAD, which includes using various LLMs as generators, comparing IPAD with other detectors, and evaluating on out-of-distribution (OOD), attacked datasets, and prompt-structured datasets.
Independently analyze the necessity and effectiveness of the Prompt Inverter, the PTCV, and the RC.
Explore the user-friendlliess of IPAD through interpretability assessment.

---

Table 1: Detection Accuracy (HumanRec, MachineRec, AvgRec, and AUROC %) of IPAD across Various LLMs on In In-Distriuttion Data
Original Generator
Re-Generator
HumanRec
MachineRec
AvgRec
AUROC
gpt-3.5-turbo
3pt-3.5-turbe
98.50
100
99.25
100
gpt-4
gpt-4
98.70
100
99.35
100
3pt-3.5-turbe
96.10
100
98.05
99.96
Qwen-turpe
Quen- twen-turbo
98.60
99.80
99.20
99.96
20-33.-ttubb
98.40
99.50
98.95
99.86
LLaMA-3-70B
LLaMA-3-703
98.70
100
99.35
T(X)
3pt-3.5-turee
98.60
100
99.30
100
3.1 Robustness of IPAD
3.1.1 Evaluation Baselines and Metries
The in-distribution experiments refer the testing results presented in (Koike al. 2024]. where the data aligns with the training data used for the IPAD, thereby serving as our baseline. This baseline assesses how the RoBERTa classifiers (base and large) PPrk et al., [021], the HC3 detector [Guo et al. 2023], and the OUTFOX detector [Koike et al. 2024) perform on standard data as well as under DIPPER (Alkanhel al. 2023] and OUTFOX attacks.
The OOD experiments refer to the DetectRL. baseline [Wu al. 2024), which is comprehensive
benchmark, which includes four datasets: (1) academic abstracts from the arXiv Archive (covering
the years 2002 to 2017), (2) news articles from the XSum dataset [Narayan et al. 2018 (3) creative
stories from Writing Prompts [Fan et 2018). and (4) social reviews from Yelp Reviews [Zhang
ct al. 2015]. It also employs three attack methods to simulate complex real-world detection scenarios.
which include (1) the prompt attacks, (2) paraphrase attacks, and (3) perturbation attacks [Wu et al.
2024 DetectRL evaluates three classifiers on the OOD dataset: DetectLLM (LRR) [Su et al.
2023 Fast-DetectGPT [Bao et al.) 2024), RoBERTa Classifier (Base). We included two more strong
classifiers in our evaluation DetectLLM (NPR) [Su et al.) [023] and Binoculars [Hans et al. 2024
All the testing sets have 1,000 samples in our experiments.
We further evaluate its performance on OOD datasets with structured prompts. The Writer dataset [Bai al. 2025). featuring average prompt length of 1,501 tokens, reflects IPAD's capability to handle long-form form prompts. The Code-Feedback (eeeeeeecaakkenng [Zheng et al.] [2024b] and Math datasets (Hendrycks al. 2021] contain highly structured prompts, in contrast to typical essay-like writing. We compare IPAD with baseline detectors from DetectRL to assess its relative performance under these challenging conditions.
The Area Under Receiver Operating Characteristic curve (AUROC) is widely used for assessing detection method (Mitchell et al. 2023a Since models predict binary labels, we follow the Wilcoxon-Manne Mann--Whnneyy statistic Calderr and Jaroszewicz (007), and the formula is shown in Appendix B The AvgRee is the average of HumanRec and MachineRec, which refers to the recall of the Human-written texts and the I.LM-generated texts et 2024].
3.1.2 Robustness across different LLMs
As shown in Table I IPAD achieves consistently strong performance across all combinations of original generators and re-generators, which shows its robustness to diverse LLM as generators. The best results are generally observed when the original generator and the re-generator are the same, while the gpt-3. S-turbo serves as an effective universal re- generator: it performs well even when the original generator differs. real-worke applications where the identity of the original generator is unknown, using gpt-3. 3.t-3.5-20 5.5-turo fixed re-generator provides a practical and reliable solution.
3.1.3 Comparison of IPAD with other detectors in and out of distribution
In Distribution. For the in-distribution data, as shown in Figure 2 the baseline detectors like RoBERTa, HC3, and OUTFOX perform well on standard data but degrade significantly under DIPPER and OUTFOX attacks. In contrast, IPAD maintains high accuracy across all scenarios, which surpasses the strongest bascline 9.05% in AvgRec.
5

---

RoBeRth-large
HC3 detector
OUTFOX
RAU
gpt-3.5-turb
gpt-4
10.8
ALE
XA.0
15.1
20.8
Score (%)
80
79.2
18.2
74.3
Score:
70-
60
50
50
HumanRac
MachineRec gpt-3.5 tuttboobooooooooo DIPPER
AugRoc
Humanfac
Machinafac
AvgRec
apt-3.5-turbo + OUTFOX
100
99.1
100
90
Score (%)
12.
Score (%6
50
HumanRac
MachineRec
AugRec
HumanRac
MachinsRac
Avgñac
Figure 2: The In-distribution data performance of IPAD and the baseline detectors. Since Koike et al. (2024) only presents the AvgRec data for the baselines, also calculate AvgRee data for IPAD to compare.
Out of Distribution. Table 2 reports detection accuracy across four benchmark datasets, which shows that IPAD significantly outperforms prior baselines. Table further evaluates robustness under three attack types, where IPAD again demonstrates superior resilience. Compared to the strongest baseline, IPAD achieves 12.93% relative improvement on standard datasets in AUROC and 5.48 % improvement on attack datasets.
Table 2: Detection Accuracy (AUROC %) on four diverse OOD datasets
Method
Arxiv
XSum
Writing
Review
Average
DetectLLM (LRR)
48.17
48.41
58.70
58.21
53.37
DetectLLM (NPR)
53.85
34.59
54.96
50.09
48.37
Binoculars
84.03
77.39
94.38
90.00
86.45
Fast- Gett-etecctGPT
42.00
45.72
51.13
54.55
48.35
Rob-Bac Base
81.06
76.81
86.29
87.84
83.00
IPAD Merge
100
99.85
99.40
98.25
99.38
Table 3: Detection Accuracy (AUROC %)
three attacked OOD datasets
Method
Prompt Attack
Paraphrase Attack
Perturbation Attack
Average
DetectLLM (LRR)
54.97
49.23
53.62
52.61
DetectLLM (NPR)
77.15
56.94
6.78
46,96
Binoculars
93.45
88,34
76.89
86.23
TPT
43,89
41.15
44.38
43.14
Rob- Base
92.81
90.02
92.12
91.65
IPAD
97.30
96.00
98.10
97.13
Structured Prompts. The results are shown Table 4 while these datasets lack HWT references and are thus only evaluated using MachineRec, the strong scores suggest that IPAD maintains robustness even on structured diverse inputs, with an improvement of 9.87% against the strongest baseline in MachineRec.

---

Table 4: Detection Accuracy (MachineRec %) on three structured OOD datasets
Method
LongWriter
Code-Feedback
Math
Average
DeM (LRR)
32.1
29.0
30.2
30.43
DetectLLM (NPR)
41.2
45.9
56.0
47.7
Binoculars
82.1
84.6
89.4
85.4
Fast- GPT
12.0
11.1
15.1
12.7
Rob-Base
81.5
89.2
82.1
84.3
IPAD
97.5
92.7
95.6
95.27
FT Input
Prompt
Prompt Inverver PTCV
Prompt Inverter + RC
IPAD
upt35
9pt4
Owen turbo
LLaMA-3-708
AUROC (9)
1.00
100.0
AUROC (96)
1.00
100.0
AUROC (96)
99.4
93.6
100.0
AURDC (96)
100
99.6
94.6
100.0
50
10.3
11.3
impus prompt PICY RL.
Input prompt
riput promp: FICV
input prompe PILV
ASalt
wriling
yelp
97.3
96.7
94.5
95.6
96.7
$8.5
AUROC 1%)
AUROC 1%)
75
25
AUROCC
AUROC
50
26.0
12.6
rrpusprompp PICY RC
IAAD
Input prompt PTCV
I9AD
promp: PICV RC
1940
ingut promps PTCV RC
PAD
prompt
paraphrase
perturbation
AUROC (%)
91.1
91.3
97.3
100
96.9
96.0
AUROC 1%)
95.7
20.3
$8.1
100
96.6
$9.0
-5
AUROC
AUROC
75
25
14.2
15.2
21.6
proutrrmpe PICV
RC
IRAD
promppp PICY
186D
promp: FTCV
RC
1950
InpuE prompt FICV
FFD
Figure 3: Ablation study. Evaluating Fine-tune only on Input, Fine-tune only on Prompt, Prompt Inverter PTCV, Prompt Inverter RC, and IPAD on In-distribution datasets, standard OOD datasets, and attacked OOD datasets.
3.2 Necessity and Effectiveness of the Prompt Inverter, PTCV, and RC
3.2.1 Necessity
To prove that it is necessary to fine-tune on IPAD with IPAD with PTCV and RC. we conducted ablation study to use the same finetune method on only input texts and only predicted prompts. with the finetune data format shown in Appendix C We only experimented on Prompt Inverter + PTCV and Prompt Inverter + RC to compare with the three-moduled IPAD.
Based on the ablation study results as shown in Figure fine-tuning only on input texts or only on predicted prompts performs poorly across all datasets AUROC scores. While using Prompt Inverter + PTCV or Prompt Inverter + RC individually significantly improves performance, neither approach consistently excels across both HWT-style and LGT-style generations. In contrast, the full IPAD framework achieves consistently high performance across all settings, which demonstrates the necessity the Prompt Inverter, PTCV, and RC modules.
3.2.2 Effectiveness
Prompt Inverter. We use DPIC Yu al. 2024 and PE ZZhan et al. 2024a as baseline methods for prompt extraction. DPIC employs zero-shot approach using the prompt states in Appendix D while PE uses adversarial attacks to recover system prompts. In our evaluation, we tested 1000 LGT and 1000 HWT samples. We use only in-distribution data for testing since only these datasets include original prompts. The metrics are all tested comparing the similarity of the original prompts and the predicted prompts. The results shown Table illlustree that IPAD consistently outperforms
both DPIC and PE across all four metrics (BartScore Yuan et al. 2021 Sentence-Ber Cosine
7

---

Table Comparison of prompt inverters on the similarities of the original prompts and the predicted prompts on LGT and HWT.
LGT
HWT
Metrie
DPIC
PE
IPAD
DPIC
PE
IPAD
Bart-large-enn
-2.12
-2.23
-1.84
-2.47
-2.39
-2.22
Sentence-
0.46
0.58
0.69
0.42
0.53
0.57
BLEU
5.61E-05
3.21E-04
0.24
8.75E-06
2.56F-08
0.13
ROUGE-1
0.04
0.25
0.51
0.06
0.13
0.39
Table 6: Comparison of distinguishers on HumanRec, MachineRec, and AvgRec (%).
Distinguish Method
MachineRec HumanRec
AvgRec
Sentence-Bert (Thr. 0.67)
61.20
95.20
78.20
Bart-large-cnn (Thr. -2.52)
42.60
97.20
69.90
Prompt to ChatGPT
33.20
64.50
48.85
IPAD
98.50
100.00
99.25
Similarity [Reimers and Gurevych 2019), BLEU (Papineni al. 2002). and ROUGE-1
[Ln 2004
which highlight the effectiveness of the IPAD Prompt Inverter.
We conducted a comparison study using the frozen Prompt Inverter but different distinguishing methods. The first and second methods employed Sentence-Bert (Reimers and Gurevych| 2019) and Bart-large-can (Yuan al. [021] compute the similarity score between the input texts and the regenerated texts. We selected thresholds that maximized AvgRec, which were 0.67 for Sentence-Beo and -2.52 for Bart-large-enn. The classification rule is that the texts with scores greater than the threshold will be classified as LGT, while the texts with scores less than or equal the threshold will be classified as HWT. The third method to directly prompt ChatGPT in Appendix C which mimic the fine-tuning process of PTCV and RC. The final results shown in Table 6 demonsttatee that the other distinguishing methods performed worse than IPAD, highlighting the superior effectiveness of the IPAD Distinguishers.
PTCV and RC.
Compare with DPIC. DPIC first uses a zero-shot prompt inverter to generate prompts, then applics Siamese encoder and classifier mcasure similarity between the embeddings of the original and regenerated texts. However, the classifier's 's reliance on embedding similarity is ambiguous, as similar texts may stem from different prompts. IPAD addresses this by fine-tuning directly on raw texts and reformulating the task as logical reasoning problem as shown in the instructions of PTCV and RC. Our trained Prompt Inverter outperforms DPIC's generic zero-shot method shown in Table []
and IPAD also achieves better performance than DPIC overall, as results shown in Appendix
3.3 Interpretability Assessment of IPAD
To assess the explainability improvement of IPAD, we designed an interpretability assessment with ten participants evaluating one HWT and one LGT article. We used IPAD version 2 due to its superior OOD performance and attack resistance. Participants compared three online detection platforms (i.e., Scribbr, QuillBot, GPTZero) with IPAD's process (which displayed input texts, predicted prompts, regenerated texts, and final judgments). After evaluation, participants rated IPAD on four key explainability dimensions. Transparency received strong ratings (40%:5, 60%:4), with participants appreciating the visibility of intermediate processes. Trust scores were more varied (10%:3, 70%:4, 20%:5), but IPAD was generally considered more convincing than single-score detectors. Satisfaction was mixed (30%:3, 30%:4, 40%:5), with participants acknowledging better detection but raising concerns about energy efficiency since IPAD runs three LLMs. Debugging received unanimous 5s, as participants could easily analyze the predicted prompt and regenerated text to verify the decision-making process. If needed, users could refine the generated content by adjusting instructions, such as specifying word count, making IPAD more effective and user-friendly tool compared to black-box detectors.
8

---

Related Work
4.1 AI detectors Methods and challenges
Recent studies have explored diverse strategies for detecting Al-generated text. Watermarking embeds identifiable patterns during training Gu al. [022]] Shevlane al. [023) inference Lucas and Havens 22033, but requires model access and is vulnerable to erasure attacks Hou et al. 2024]. Statistics- based methods treat output distributions
detection signals. P et al.
(2023b) and Fast-DetectGGP Bao et al. (2024) locate LGT in regions of negative curvature of log- probability; Lastde Xu et al. 2025 and Glimpse Bao al. [2225 exploit ooken-probability dynamies and partial-distribttin prediction. Other statistical approaches rely on n-gram divergence or revision similarity Hamed and Wu [223) Kalinichenko et al. [2003]. Zhu et al. [2023], Mao al. [2024] Yang
et al. [2024a]. though robustness remains limited Wu et al. [2025] Regeneration- based methods
compare model rewrites with originals: RAIDAR Mao et al. [2024] and MAGRET [uuag al.
[2024a] and TOCSIN Veselovsky ct al. 2023) measure continuation or deletion-based differences. Neural approaches fine-tune
[2025] observe stronger edits on human text; DNA- DNA-GPT[Yang
large encoders (e.g., RoBERTa Liu et al. (2019), BERT Devlin et al. [219)] XLNet Yang et al.
20199) with adversarial or contrastive objectives Pagnoni et al. [2022] Yang et al. [2024b]. while
juman-in-the-lopp methods provides complementary semantic judgment and explainability Chaka
2023 Dugan et al. [2023]. Uchendu et al. [2023].
4.2 Prompt Inverter techniques and applications
Prompt extraction techniques aim to eeggine- the prompts that generate specific outputs from LLMs. Approaches include black-box methods like output2prompt Zhang et al. (2024b). which extracts prompts based on model outputs without access to internal data, and logit-based methods like logit2prompt Mitka [202]), which rely on next-token probabilities but are constrained by access to logits. Adversarial methods can bypass some defenses but are model-specific and fragile Zhang ct al. [2024c). Despite the success of some zero-shot LLM-inversion based methods Li and Klabjan 2024 Yu et al. [2024), they are mostly naive usage of prompting LLMs, which makes them poor in prompt extraction accuracy and robustness.
5 Conclusion
This paper introduces IPAD (Inverse Prompt for AI Detection), framework consisting of Prompt Inverter that identifies predicted prompts that could have generated the input text, and two Distinguishers that examines how well the input texts align with the predicted prompts. One is the Prompt-Texl Consistency Verifier (PTCV) which evaluates direct alignment between predicted prompts and input text, and the other Regeneration Comparator (RC) that examines content similarity by comparing input texts with the corresponding regenerated texts. Empirical evaluations demonstrate that IPAD outperforms the strongest basclines by 9.05% (Average Recall) on in-distribution data, 12.93% (AUROC) on out-of of--tsiiiiiiitiionn (OOD) data, and 5.48% (AUROC) on attacked data. IPAD also performs robustly on structured datasets. While the local alignment in RC approach provides explicit interpretability. it is more sensitive to adversarial attacks. In contrast, the global distribution in PTCV matching approach implicitly learns generative LLM's distributional properties, which offers more robustness while maintaining explainability. The combination of the two modules suggests that combining self-consistency checks of generative models with multi-step reasoning for evidential explainability holds promise for future AI detection systems in real-world scenarios. An interpretability assessment reveals that IPAD enhances trust and transparency by allowing users to examine decision- decision-making making evidence. Overall, IPAD establishes new paradigm for more robust, reliable, and interpretable Al detection systems to combat the misuse LLMs.
While IPAD demonstrates SOTA performance, two limitations warrant discussion: (1) The Prompt Inverter may not fully reconstruct prompts containing explicit in-context learning examples, as prioritizes semantic alignment over precise syntactic replication. (2) While IPAD achieves strong performance across diverse datasets, relies on LLMs, making more computationally expensive compared to lightweight detectors such as RoBERTa or HC3. However, compared other detectors compared with L.MMs, such as DPIC, IPAD is more lightweight since it calls the open-sources light-weight Phi-3 model.

---

Acknowledgments
This work was supported in part by NSFC grants (62432008 and 623B2002), in part by RGC RIF grant 2200 in part by RGC TRS grant 143-513/23N-2, in part by RGC CRF grants (C7004-22G. C1029-22G and C6015-23G), in part by NSFC/RGC grant CRS HKUST601/24 and in part by RGC GRF grants (16207922, 16207423 and 16203824).
References
Zheng Chen, Di Zou, Haoran Xie, Huajie Lou, and Zhiyuan Pang. Facilitating university admission using a chatbot based on large language models with retrieval-uggmented generation. Educational Technology & Society, 27(4):pp. 454-470, 2024. ISSN 11763647, 14364522.
Yushi Feng, Tsai Hor Chan, Guosheng Yin, and Lequan Yu. Democratizing large language model- based graph data augmentation via latent knowledge graphs. Neural Networks, 191:107777,
2025a.
Fengxiang Cheng, Haoxuan Li, Fenrong Liu, Robert Van Rooij. Kun Zhang, and Zhouchen Lin. Empowering lims with logical reasoning: A comprehensive survey. In Proceedings of the Thirty- Fourth International Joint Conference on Artificial Intelligence, 2025.
Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, et al. Training language models to follow instructions with human feedback. Advances in Neural Information Processing Systems, 35: 27730-27744, 2022.
Veniamin Veselovsky, Manoel Horta Ribeiro, and Robert West. Artificial artificial artificial intelli- gence: Crowd workers widely use large language models for text production tasks. arXiv preprint arXiv:2306.07899 2023.
Junchao Wu, Shu Yang, Runzhe Zhan, Yulin Yuan, Lidia Sam Chao, and Derek Fai Wong. A survey Imm-generated text detection: Necessity, methods, and future directions. Computational Linguistics, pages 1-65, 01 2025. ISSN 0891-2017.
Ziwei Ji, Nayeon Lee, Rita Frieske, Tiezheng Yu, Dan Su, Yan Xu, Etsuko Ishii, Ye Jin Bang, Andrea Madotto, and Pascale Fung. Survey of hallucination in natural language generation. ACM Computing Surveys, 55(12):1-38, 2023.
Artidoro Pagnoni, Martin Graciarena, and Yulia Tsvetkov. Threat scenarios and best practices to detect neural fake news. In Proceedings of the 29th International Conference on Computational Linguistics,, pages 1233-1249, 2022.
Yisroel Mirsky, Ambra Demontis, Jaidip Kotak, Ram Shankar, Deng Gelei, Liu Yang, Xiangyu Zhang, Maura Pintor, Wenke Lee, Yuval Elovici, et al. The threat of offensive ai to organizations. Computers & Security, 124: 103006, 2023.
Zheng Chen, Zhaoxin Feng, Jianfei Ma, Jiexi Xu, and Bo Li. Can LLMs recognize their own analogical hallucinations? evaluating uncertainty estimation for analogical reasoning. In Yuji Zhang, Canyu Chen, Sha Li, Mor Geva, Chi Han, Xiaozhi Wang, Shangbin Feng, Silin Gao, Isabelle Augenstein, Mohit Bansal, Manling Li, and Heng Ji, editors. Proceedings of the 3rd Workshop on Towards Knowledgeable Foundation Models (KnowFM), pages 84-93, Vienna, Austria, August 2025, Association for Computational Linguistics. ISBN 979-8-89176-288.
Peipeng Yu, Jiahan Chen, Xuan Feng, and Zhihua Xia. Cheat: A large-scale dataset for detecting chrttpt- abstracts. IEEE Transactions on Big Data, 2025.
John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. A watermark for large language models. In International Conference on Machine Learning, pages 17061-17084, PMLR, 2023.
Gregory D. Price and Mare Sakellarios. The effectiveness of free software for detecting ai-generated writing, International Journal of Teaching, Learning and Education, 2(6), 2023.
10

---

William H. Walters. The effectiveness of software designed to detect ai ai-generated writing: A comparison of 16 ai text detectors. Open Information Science, 7(1):20220158, 2023.
Chaka Chaka. Detecting AI content in responses generated by ChatGPT, YouChat, and Chatsonic: The case of five Al content detection tools. Journal of Applied Learning and Teaching, 6(2):
94-104, 2023.
Debora Weber-Wulff, Wulff, Alla Anohina-Naumeca Sonja Bjelobaba, Tomáš Foltýnek, Jean Guerrero-De Dib, Olumide Popoola, Petr Sigut, and Lorna Waddington. Testing of detection tools for Al Al-generated text. International Journal for Educational Integrity, 19(1):26, 2023.
Mohanad Halaweh and Ghaleb El Refae. Examining the accuracy of ai detection software tools in education. 2024 Fifth International Conference on Intelligent Data Science Technologies and Applications (IDSTA), pages 186-190, 2024.
Yushi Feng, Junye Du, Yingying Hong, Qifan Wang, and Lequan Yu. PASS: probabilistic agentic supernet sampling for interpretable and adaptive chest x-ray reasoning. abs/2508. 10501, 2025b.
Chris Stokel- Waleer and Richard Van Noorden. What chatgpt and generative ai mean for science. Nature, 61 4117777))214-216 2023.
Sebastian Porsdam Mann, Brian D Earp, Sven Nyholm, John Danaher, Nikolaj Møller, Hilary Nowman-Smart Joshua Hatherley, Julian Koplin, Monika Plozza, Daniel Rodger, al. Generative ai entails credit-blame asymmetry. Nature Machine Intelligence, 5(5):472-475, 2023.
Toby Shevlane, Sebastian Farquhar, Ben Garfinkll, Mary Phuong, Jess Whittlestone, Jade Leung, Daniel Kokotajlo, Nahema Marchal, Markus Anderljung, Noam Kolt, Lewis Ho, Divya Siddarth, Shahar Avin, Will Hawkins, Been Kim, Iason Gabriel, Vijay Bolina, Jack Clark, Yoshua Bengio, Paul F. Christiano, and Allan Dafoe. Model evaluation for extreme risks. abs/2305.15324. 2023.
Marah Abdin, Sam Ade Jacobs, Ammar Ahmad Awan, Jyoti Aneja, Ahmed Awadallah, Hany Awadalla, Nguyen Bach, Amit Bahree, Arash Bakhtiari, Harkirat S. Behl, Alon Benhaim, Misha Bilenko, Johan Bjorck, Sébastien Bubeck, Martin Cai, Caio César Teodoro Mendes, Weizhu Chen, Vishrav Chaudhary, Parul Chopra, Allie Del Giorno, Gustavo de Rosa, Matthew Dixon, Ronen Eldan, Dan Iter, Amit Garg, Abhishek Goswami, Suriya Gunasekar, Emman Haider, Junheng Hao, Russell J. Hewett, Jamie Huynh, Mojan Javaheripi, Xin Jin, Piero Kauffmann, Nikos Karampatziakis, Dongwoo Kim, Mahoud Khademi, Lev Kurilenko, James R. Lee, Yin Tat Lee, Yuanzhi Li, Chen Liang, Weishung Liu, Eric Lin, Zeqi Lin, Piyush Madan, Arindam Mitra, Hardik Modi, Anh Nguyen, Brandon Norick, Barun Patra, Daniel Perez-Becker, Thomas Portet, Reid Pryzant, Heyang Qin, Marko Radmilac, Corby Rosset, Sambudha Roy, Olatunji Ruwase, Olli Saarikivi, Amin Saied, Adil Salim, Michael Santacroce, Shital Shah, Ning Shang. Hiteshi Sharma, Xia Song, Masahiro Tanaka, Xin Wang, Rachel Ward, Guanhua Wang. Philipp Witte, Michael Wyatt, Can Xu, Jiahang Xu, Sonali Yadav, Fan Yang. Ziyi Yang. Donghan Yu, Chengruidong Zhang, Cyril Zhang, Jianwen Zhang, Li Lyna Zhang, Yi Zhang, Yue Zhang, Yunan Zhang, and Xiren Zhou Phi-3 technical report: A highly capable language model locally on your phone. abs/2404.14219, 2024.
Hiyori Yoshikawa and Naoaki Okazaki. Selective-LAMA: Selective prediction for confidence-aue evaluation of language models. In Findings of the Association for Computational Linguistics: EACL 2023, pages 2017-2028 Dubrovnik, Croatia, May 2023. Association for Computational Linguistics.
Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Lukasz Kaiser, and Illia Polosukhin. Attention is all you need. Advances in Neural Information Processing Systems, 30, 2017.
Jason Wei, Maarten Bosma, Vincent Zhao, Kelvin Guu, Adams Wei Yu, Brian Lester, Nan Du, Andrew M. Dai, and Quoe Le. Finetuned language models are zero-shot learners. In International Conference on Learning Representations, 2022.
Edward J. Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang. and Weizhu Chen. LoRA: Low-rank adaptation of large language models. The Tenth Interna- tional Conference on Learning Representations. OpenReview.net, 2022.
11

---

Yaowei Zheng, Richong Zhang, Junhao Zhang, Yanhan Ye, and Zheyan Luo. LlamaFactory: Unified efficient fine-tuning of 100+ language models. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics ( (Volume 3: System Demonstrations), pages 400-410, Bangkok, Thailand, August 2024a. Association for Computational Linguistics.
Ryuto Koike, Masahiro Kaneko, and Naoaki Okazaki. OUTFOX: Ilm- essay detection through in-context learning with adversarially generated examples. In Thiriy-Eighth AAAI Confer- ence on Artificial Intelligence, AAAI 2024, Thirty-Sixth Conference on Innovative Applications of Artificial Intelligence, IAAI 2024, Fourteenth Symposium on Educational Advances in Artificial Intelligence, EAAI 2014, February 20-27, 2024, Vancouver, Canada, pages 21258-21266 AAAI Press. 2024.
Sungjoon Park, Jihyung Moon, Sungdong Kim, Won-Ik Cho, Jiyoon Han, Jangwon Park, Chisung Song. Junseong Kim, Youngsook Song. Tae Hwan Oh, Joohong Lee, Juhyun Oh, Sungwon Lyu, Younghoon Jeong, Inkwon Lee, Sangwoo Seo, Dongjun Lee, Hyunwoo Kim. Myeonghwa Lee, Scongbo Jang, Seungwon Do. Sunkyoung Kim, Kyungtae Lim, Jongwon Lee, Kyumin Park, Jamin Shin, Seonghyun Kim, Eunjeong Lucy Park, Alice Oh, Jung- Woo Ha, and Kyunghyun Cho. KLUE: Korean language understanding evaluation. In Proceedings of the Neural Information Processing Systems Track on Datasets and Benchmarks 2021, December 2021.
Biyang Guo, Xin Zhang. Ziyuan Wang, Minqi Jiang, Jinran Nie, Yuxuan Ding, Jianwei Yue, and Yupeng Wu. How close is chatgpt to human experts? comparison corpus, evaluation, and detection. abs/2301.0759) 2023.
Reem Alkanhel, El-Sayed M El-kenawy, Abdelaziz A Abdelhamid, Abdelhameed Ibrahim, Mostafa Abotaleb, and Doaa Sami Khafaga. Dipper throated optimization for detecting black-hole attacks in manets. Computers, Materials & Continua, 74(1), 2023.
Junchao Wu, Runzhe Zhan, Derek F. Wong, Shu Yang, Xinyi Yang. Yulin Yuan, and Lidia S. Chao. DetectRL: Benchmarking LLM--genertted text detection in real-world scenarios. Advances in Neural Information Processing Systems, Datasets and Benchmarks Track, Vancouver, BC, Canada, December 2024.
Shashi Narayan, Shay B. Cohen, and Mirella Lapata. Don't give me the details, just the summary! topic-aware convolutional neural networks for extreme summarization. In Proceedings of the 2018 Conference on Empirical Methods in Natural Language Processing, pages 1797-1807, Brussels, Belgium,
2018. Association for Computational Linguistics.
Angela Fan, Mike Lewis, and Yann Dauphin. Hierarchical neural story generation. In Proceedings of the 56th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 889-898, Melbourne, Australia, July 2018. Association for Computational Linguistics.
Xiang Zhang, Junbo Jake Zhao, and Yann LeCun. Character-level convolutional networks for text classification. In Advances in Neural Information Processing Systems 28: Annual Conference on Neural Information Processing Systems 2015, December 7-12, 2015, Montreal, Quebec, Canada, pages 649-657. 2015.
Jinyan Su, Terry Yue Zhuo, Di Wang, and Preslav Nakov. DetectLLM: Leveraging log rank in- formation for zero-shot detection of machine machine-generated text. In Findings of the Association for Computational Linguistics: EMNLP 2023, pages 12395-12412, Singapore, December 2023. Association for Computational Linguistics.
Guangsheng Bao, Yanbin Zhao, Zhiyang Teng, Linyi Yang, and Yue Zhang. Fast-DetectGPT: Efficient zero-shot detection of serchine-generated text via conditional probability curvature. In The Twelfih International Conference Learning Representations, Vienna, Austria, May 2024.
Abhimanyu Hans, Avi Schwarzschild, Valeriia Cherepanova, Hamid Kazemi, Aniruddha Saha, Micah Goldblum, Jonas Geiping, and Tom Goldstein. Spotting LLMs with binoculars: Zero-shot detection of macchnne-generatee text. In Forty-first International Conference on Machine Learning, Vienna, Austria, July 2024.
Yushi Bai, Jiajie Zhang, Xin Lx, Linzhi Zheng, Siqi Zhu, Lei Hou, Yuxiao Dong, Jie Tang, and Juanzi Li. Longwriter: Unleashing 10,000+ word generation from long context L.MMs. The Thirteenth International Conference Learning Representations, 2025.
12

---

Tianyu Zheng, Ge Zhang, Tianhao Shen, Xueling Liu, Bill Yuchen Lin, Jie Fu, Wenhu Chen, and Xiang Yue. Opencodeinterpreter: Integrating code generation with execution and refinement. In Lun-Wei Ku, Andre Martins, and Vivek Srikumar, editors, Findings of the Association for Computationall Linguistics, ACI. 2024, Bangkok, Thailand and virtual meeting, August 11-16, 2024, pages 12834-12859 Association for Computational Linguistics, 2024b.
Dan Hendrycks. Collin Burns, Saurav Kadavath, Akul Arora, Steven Basart, Eric Tang, Dawn Song, and Jacob Steinhardt. Measuring mathematical problem solving with the MATH dataset. In Thirty-fisth Conference on Neural Information Processing Systems Datasets and Benchmarks Track (Round 2), 2021.
Eric Mitchell, Yoonho Lee. Alexander Khazatsky, Christopher D Manning, and Chelsea Finn. Detectgpt: Zero-shot gaahine-generated text detection using probability curvature. In International Conference on Machine Learming, pages 24950-24961 PMLR, 2023a.
Toon Calders and Szymon Jaroszewicz. Efficient auc optimization for classification. In European conference on principles of data mining and knowledge discovery, pages 42-53. Springer, 2007.
Yafu Li, Qintong Li, Leyang Cui, Wei Bi, Zhilin Wang, Longyue Wang, Linyi Yang, Shuming Shi, and Yue Zhang. MAGE: Machine -eeeeratdd text detection in the wild. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Pupers), pages 36-53, Bangkok, Thailand, August 2024. Association for Computational Linguistics.
Xiao Yu, Yuang Qi, Kejiang Chen, Guoqiang Chen, Xi Yang, Pengyuan Zhu, Xiuwei Shang, Weiming Zhang, and Nenghai Yu. Dpic: Decoupling prompt and intrinsic characteristies for Ilm generated text detection. In The Thirty-eighti Annual Conference on Neural Information Processing Systems, 2024.
Yiming Zhang, Nicholas Carlini, and Daphne Ippolito. Effective prompt extraction from language models. In First Conference on Language Modeling (COLM 2024), 2024a.
Weizhe Yuan, Graham Neubig, and Pengfei Liu. Bartscore: Evaluating generated text as text generation. Advances in Neural Information Processing Systems, 34:27263-27277, 2021.
Nils Reimers and Iryna Gurevych. Sentence-BERTT. Sentence embeddings using Siamese BERT- networks. In Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing, pages 3982-3992, Hong Kong, China, November 2019, Association for Computational Linguistics.
Kishore Papineni, Salim Roukos, Todd Ward, and Wei-Jing Zhu. Bleu: a method for automatic evaluation of machine translation. In Proceedings of the 40th annual meeting of the Association for Computational Linguistics, pages 311-318 2002.
Chin-Yeu Lin. Rouge: A package for automatic evaluation of summarics. In Text summarization branches out, pages 74-81, 2004.
Chenxi Gu, Chengsong Huang, Xiaoqing Zheng, Kei Chang, and Cho-Jui Hsieh. Watermarking pre-trained language models with backdooring, arXiv preprint arXiv:2210.07543, 2022.
Evan Lucas and Timothy Havens. Gpts don't keep secrets: Searching for backdoor watermark triggers in autoregressive language models. Proceedings of the 3rd Workshop on Trustworthy Natural Language Processing, pages 242-248, 2023.
Abe Bohan Hou, Jingyu Zhang, Tianxing He, Yichen Wang, Yung-Sune Chuang, Hongwei Wang, Lingfeng Shen, Benjamin Van Durme, Daniel Khashabi, and Yulia Tsvetkov. SemStamp: A semantic watermark with paraphrastic robustness for text generation. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume I: Long Papers). pages 4067-4082, Mexico City, Mexico. June 2024. Association for Computational Linguistics.
Eric Mitchell, Yoonho Lee, Alexander Khazatsky, Christopher D Manning, and Chelsea Finn. Detectgpt: Zero-shot -eeeereege text detection using probability curvature, In International Conference Machine Learning, pages 24950-24962. PMLR, 2023b.
13

---

Yihuai Xu, Yongwei Wang, Yifei Bi. Huangsen Cao. Zhouhan Lin, Yu Zhao, and Fei Wu. Training- free LLM-gennrated text detection by mining token probability sequences. In The Thirteenth International Conference on Learning Representations, 2025. URL. URI.htts:: httpp::/ forum??d=vo4AlHooxkk
net.
Guangsheng Bao, Yanbin Zhao, Juncai He, and Yue Zhang. Glimpse: Enabling white-box methods to use proprietary models for zero-shot LLM-generated text detection. In The Thirteenth International Conference on Leurning Representations, 2025. URL https: htt.attppe//opeeeeeeeee..eeeeee http://iwwwweeef/o/mmmmmm
an3fugFA22
Ahmed Abdeen Hamed and Xindong Wu. Improving detection of chatgpt-generated fake sci- ence using real publication text: Introducing xfakebibs a supervised-leamiine network algorithm. abs/2308. 11767, 2023.
Leonid A. Kalinichenko, Vladimir V. Korenkov, Vladislav P. Shirikov, Alexey N. Sissakian, and Oleg V. Sunturenko. Digital libraries: Advanced methods and technologies, digital collections: Report on RCDL'2002 the 4th all-Russian scientific conference, dubna, 15-17 october 2002.
D-Lib Magazine, 9(1), January 2003.
Biru Zhu, Lifan Yuan, Ganqu Cui, Yangyi Chen, Chong Fu, Bingxiang He, Yangdong Deng, Zhiyuan Liu, Maosong Sun, and Ming Gu. Beat Ilms their own game: Zero-shot Ilm-generated text detection via querying chatgpt. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, pages 7470-7483, 2023.
Chengzhi Mao, Carl Vondrick, Hao Wang, and Junfeng Yang. Raidar: generative Al detection via rewriting. In The Twelfth International Conference on Learning Representations, 2024.
Xianjun Yang, Wei Cheng, Yue Wu, Linda Ruth Petzold, William Yang Wang, and Haifeng Chen. DNA-GPT: divergent n-gram analysis for training-free detection of gpt-generated text. In The Twelfth International Conference on Learning Representations, ICLR 2024, Vienna, Austria, May 7-11, 2024. OpenReview.net, 2024a.
Yifei Huang, Jiuxin Cao, Hanyu Luo, Xin Guan, and Bo Liu. MAGRET: Machine-generated text detection with rewritten texts. In Proceedings of the 31st International Conference on Computational Linguistics, pages 8336-8346, Abu Dhabi, UAE, January 2025. Association for Computational Linguistics.
Yinhan Liu, Myle Ott, Naman Goyal, Jingfei Du, Mandar Joshi, Danqi Chen, Omer Levy, Mike Lewis, Luke Zettlemoyer, and Veselin Stoyanov. RoBERTa: A robustly optimized BERT pretraining approach. arXiv preprint arXiv: 19..9..1........ 2019.
Jacob Devlin, Ming- Wei Chang, Kenton Lee, and Kristina Toutanova. BERT: Pre-training of deep bidirectional transformers for language understanding. In Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguisties: Human Language Technologies, Volume (Long and Short Papers), pages 4171-4186, Minneapolis, Minnesota, June 2019. Association for Computational Linguisties.
Zhilin Yang, Zihang Dai, Yiming Yang, Jaime G. Carbonell, Ruslan Salakhutdinov, and Quoe V. Le. Xlnet: Generalized autoregressive pretraining for language understanding. In Advances in Neural Information Processing Systems 32: Annual Conference Neural Information Processing Systems 2019, NeurIPS 2019, December 8-14, 2019, Vancouver, BC, Canada, pages 5754-5764, 2019.
Lingyi Yang. Feng Jiang, Haizhou Li, et al. chatgpt involved in texts? measure the polish ratio to detect 2024b.
text. APSIPA Transactions on Signal and Information Processing. 13(2).
Liam Dugan, Daphne Ippolito. Arun Kirubarajan, Sherry Shi, and Chris Callison- Callison-Burch. Real or fake text?: Investigating human ability to detect boundaries between human- written and machine- generated text. In Thirty-Seventh AAAI Conference on Artificial Intelligence, AAAI 2023, Thirty- Fifth Conference
human-written
Innovative Applications of Artificial Intelligence, IAAI 2023, Thirleenth Symposium on Educational Advances Artificial Intelligence, EAAI 2023, Washington, DC, USA, February 7- 74,,, 2023, pages 12763-12771. AAAI Press, 2023.
14

---

Adaku Uchendu, Jooyoung Lee, Hua Shen, Thai Le, Dongwon Lee, et al. Does human collaboration enhance the accuracy of identifying llm-generated deepfake texts? Proceedings of the AAAI Conference on Human Computation and Crowdsourcing, volume 11, pages 163-174, 2023.
Collin Zhang, John Xavier Morris, and Vitaly Shmatikov. Extracting prompts by inverting LLM outputs. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages 14753-14777, Miami, Florida, USA, November 2024b. Association for Compu- tational Linguistics.
Krystof Mitka. Stealing part of production language model. B.S. thesis, University of Twente, 2024.
Yiming Zhang, Nicholas Carlini, and Daphne Ippolito. Effective prompt extraction from language models. In First Conference on Language Modeling, 2024c.
Hanqing Li and Diego Klabjan. Reverse prompt engineering. arXiv preprint arXiv:2411.06729, 2024.
John Xavier Morris, Wenting Zhao, Justin T Chiu, Vitaly Shmatikov, and Alexander M Rush. Language model inversion. In The Twelfth International Conference on Learning Representations, 2024.
Yiming Zhang, Nicholas Carlini, and Daphne Ippolito. Effective prompt extraction from language models. In First Conference on Language Modeling, 2024d.
A Fine-tune Dataset
Prompt Inverter Dataset. We use the following four datasets, with the first three datasets enhance the model's generalization to recover the prompts, while the last dataset improves performance on essay-related tasks.
Instructions-22 2M Morris et al. [0024), a collection of 2 million user prompts and system prompts, from which we used 30,000 prompts.
ShareGPT Zhang et al. 2024d an open platform where users share ChatGPT prompts and responses, from which we used 500 samples.
Unnatural Instructions Zhang et al. (2024d), dataset of creative instructions generated by OpenAl's models, from which we used 500 samples.
OUTFOX dataset Koike et al. 2024), which contains 15,400 essay problem statements, student-written essays, and LLM --geeeratteed essays.
The first three datasets aims to enhance the general querying capability of the Prompt Inverter, and are all released under the MIT license. All the samples we used are the same to the samples randomly selected in [Zhang et al. [2024b]. The last dataset aims enhance the familiarity of the Prompt Inverter with the data of the essay to detect the LLM-ggenrraed essays, and are created and examined by Koike et al. ] We specifically used the I.LM-generate essays and problem statements for this supervised fine-tuning (SFT). There are 45,400 training pairs total.
Given that essay data diverse, utilize only the OUTFOX dataset Koike et al. (2024). To adapt this dataset for training our Distinguisher, we enhance it to align with the model' requirements. The original dataset consists of 14,400 training triplets of essay problem statements, stutent-written essays, and -e..eaeeed essays. To further process the data, we apply the Prompt Inverter to both student- written and LLM- LLM- generrtted essays, generating corresponding Predicted Prompts. These Predicted Prompts are then used to regenerate texts via ChatGPT, ie. gpt-3.5-turbo. Following this procedure, construct total of 20,800 training samples, with an equal distribution of positive and negative examples (14,400 each).
The final dataset is structured follows:
15

---

Table 7: Instruction, input/output structure, and inference outputs of each fine-tuned module. T the input text, P the predicted prompt, and 7" the regenerated text.
Field
Prompt Inverter
PTCV
RC
Instruction
"What the prompt P that generates the Input Text T?"
"Can LLM generate the input text T through the prompt P?"
"T' generated by LLM, determine whether T is also generated by LLM with similar prompt." (I",)) "yea"/"no"
Input
T P
(P,T) "yes"/"no" /"no"
Output
Output in Inference
P
Petcy
PRC
B AUROC formula
Since model predicts binary labels, we follow the Wilcoxon-Mane Mannhhieee statistic Calders and Jaroszewicz [007)] to calculate the Area Under Receiver Operating Characteristtic curve (AUROC):
AUC(f) EIeEDo ELED 1[f(to) f(t1)] IDd| I
where (tg) < f(4) denotes an indicator function which returns if f(4) < f(h) and otherwise. D is the set of negative examples, and 'D is the set of positive examples.
C Ablation study data structures
Input-only fine-tuning data instructions.
"Is this text generated by LLM?"
Prompt Only fine-tuning data instructions. could have generated the input texts. Is this prompt predicted by an input texts written by LLM?"
"Prompt Inverter predicts prompt that
"Text is generated by an LLM. Determine whether Text is also generated by an LLM using a similar prompt. Meanwhile, determine whether Text could have been generated from Prompt using an LLM. Answer with YES or NO.
Ablation Prompt.
D DPIC (decouple prompt and intrinsic characteristics) Prompt Extraction Zero-shot Prompts Yu et al. [0244]
"I want you to play the role of the questioner. I will type an answer in English, and you will ask me question based on the answer same language. Don't write any explanations or other text, just give me the question. <TEXT>.".
E
Comparison with DPIC
Since DPIC has not released its code, data, or models, we are unable to independently evaluate the performance of its classifier. Consequently, we rely on the reported results DPIC paper and construct a comparable dataset following their described settings to enable fair comparison with IPAD. However, due to these limitations, we are unable to apply DPIC to additional datasets for broader evaluation.
16

---

To assess the generalization of IPAD, we reconstruct the following datasets, each containing 200 randomly sampled examples: XSum, WritingPrompts, and Pub For each dataset, we generate texts using three large language models: ChatGPT (gpt-3. --t-3bbot GPT-4 (gpt-4), and Claude (claude-3-oput) wtw.--puuu200022200 20240229). Furthermore, the XSum datasets generated by these three models are augmented using two attack methods DIPPER and Back- Translation Transssitatiioo-reutinnn in total of 15 evaluation datasets.
Table 8: AUROC comparison across tasks (XSum, Writing, PubMed) for ChatGPT, GPT-4, and
Claude 3 using various prompt extraction methods.
Method
ChaiGPT
GPT4
Claude 3
XSom
Wriling
PubMed
XSam
Writing
PunMed
XSum
Writing
PabMed
Avg.
DPIC (ChatGPT)
0.9996
0,9950
DPIC (Vicura-7B)
0.9976
0.9708
0.8990
0.9558
0.9986
0.9644
0.9394
0.9674
0.9992
0.9943
0.9690
0.9875
IPAD (Version
0,9850
0,9800
0.9250
0.9633
1.00000
0,9700
0.9700
0.9800
1.0000
0,9800
0.9750
0.9650
IPAD (Version 2)
1,0000
0,9850
0.9800
0.9883
1.0000
0.9800
0.9500
0.9767
1.0000
0.9950
1,0000
1.0000
Table 9: AUROC comparison under generation perturbation settings (DIPPER, Back-translation for
each model.
Method
ChatGPT DIPPER
GPT-4
Claude
Oni.
Back-trans.
Ori.
DIPPER
Back-tran
Ori.
DIPPER
Back-trans.
DPIC (CharGiPT)
1.0000
1.0000
0.9972
0.9996
0.9991
0.9931
1,0000
0.9996
0.9878
DPIC (Vicuna-7B)
0.9976
0,9980
0,9889
0.9986
0,9969
0.9903
0.9992
0.9996
0,9979
IPAD (Version
0,9850
0.8900
0.9850
1,0000
0.8950
0.9900
1,0000
0.9250
0,9950
IPAD (Version 2)
1.0000
0,9750
0.9950
0.9800
0.9750
0.9950
1,0000
1.0000
1.0000
Based on the experimental results, IPAD performs well and exhibits notable resistance to adversarial
attacks.
IPAD open-sourced all the fine-tuned models, including the Prompt Inverter, and the two versions of distinguishers. Therefore, all the experiment results can be validated and reproduced.
F IPAD and DPIC prompt inverter examples
17

---

Table 10: IPAD and DPIC prompt inverter examples
Input
IPAD
DPIC
The IPC opened proceedings against the National Paralympic Committee of Russia after report claimed the country had operated widespread doping programme. A decision any ban will come in the week com- The mencing August. The International Olympic Committee (IOC) has opted against a blanket ban." "I can assure you that our board will take the right decision in the interest of sport and the interest the Paralympic movement moving forward," " said Craven. On Sunday. the IOC said it would leave up to the governing bodies of individual sports decide if Russian competitors are clean and should be allowed to take putt.But Craven, himself memher of the IOC, was critical of that decision and said the IPC would not necessarily follow suit." "I am disappointed in their decision, but their right to take such decision. This is there has been a situation in the past where you have had institutional doping such scale." "We believe the Russian NPC is either unwilling or unable to uphold the IPC anti-doping code, which in line with the World Anti-Doping Agency code, that is what they have respond to. "Canadian law professor Richard McLaren's 's report, published last week, claimed Russia operated state-sponsored doping programme from 2011 to 2015.The IPC said it acted after Mcl laren provided the names of the athletes associated with the 35 "disappearing positive ples" from the Moscow laboratory highlighted in the report.Nineter samples potentially doctored as part of the sample-swapping regime during the 2014 Sochi Paralympic Winter Games have been sent for further analysis. Russia will have up 21 days to appeal against any IPC decision, with the Rio Paralympics due to begin on 7 September.
Explain the actions taken by the Inter- national Paralympic Committee against the Russian Paralympic Committee and the reasons behind these actions.
What were the key findings of Richard McLaren's regarding Russia's doping programme?
report
personal view," he added." "We have to acknowledge don't think
The world came crashing down in minutes. Many of us were asleep when it happened, and did n' t find out about it until later. When awoke, we saw the carnage spread through the land, and we wept. There were n' many of us left, but what few there were managed find each other over the Internet. We gathered together in what remained of major the United States. took
Write an essay about time when you and your friends were the only survivors of catastrophic event that wiped out most of the world's population. De- scribe how you and your friends coped with the aftermath and the chal- lenges you faced in re- building society.
What was the event that caused the world to come crashing down?
city on the East Coast of what time, but we eventually began to rebuild. The brightest among those who survived thought to ask Why, while most of surviving. Years passed, and no link was found between us. Eventually, those who had the question resigned themselves the fact that they would never know. They went to their new homes, and tried to integrate themselves best they could into the new society. It was n' until years after the event happened that the connection was discovered, quite by accident. One the former questioners had taken a job as mover, and was helping fellow survivor move into a newly cleaned house. Sticking of one of the boxes was the missing link. Oh, you used shop at Bad Dragon too? Moments later, the realization struck him.
content with just
18

---

Input
IPAD
DPIC
In an alternate timeline, second sentient race evolved in parallel with humans, These beings, known as the Avralians, possessed extraordinary abilities and resided in the hidden corners of the Earth. For centuries, unaware of each other's existence, humans and Avralians progressed in- dependently. However, fate intervened one fateful day when an Avralian girl named Elara stumbled upon group of human explorers deep in the forest. With wide-eyed wonder, she approached them cautiously. The humans, initially startled, soon recognized Elara's unique nature. They befriended her, and through her, the races began unravel the secrets of their intertwined existence. As time passed, harmony emerged between the races, and mutual respect solidified their bond. The Avralians shared their ancient knowledge and wisdom, while humans brought innovation and technology. Together, they worked towards world where unity triumphed over differences. However, not all were convinced of this newfound alliance. A faction within the human popu- lation, fueled by fear and mistrust, sought to exploit Avralian abilities for personal gain. Conflict brewed, threatening the fragile equilibrium. Elara, fueled by her pure heart and belief in unity, emerged as a beacon hope. With small band of supporters, she embarked bridge the gap and foster understanding. Battles were fought, sac- rifices made, ultimately. Elara's message prevailed. Humans and Avralians learned to cherish their diversity and forge future marked by collaboration and empathy. The world transformed into a tapestry coexistence, where magnificent cities stood testaments to unity and cultural exchange. Humans and Avralians moved freely through bustling markets, sharing knowledge, stories, and laughter. Together, they faced global challenges, from climate crises to epidemics, with unwavering determination.
Write essay describ- ing an alternate time- line in which second sentient race evolved in parallel with humans, exploring the potential interactions and flicts between the two species.
How did Elara manage to convince both races to embrace unity despite the conflict?
journey
Both times had the banana pepper appetizer, which is great and goes really well with the FRESH and delicious bread and cheese they give you at the start of your meal. nnFor entrees, me and my girlfriend have had mixed experience. I've had the fish sandwich (very good) and the eggplant parm sandwich (okay). My girlfriend got the salad with bread basil on it, but the basil was over powering and bread was soggy with the dressing. nn The service is also mixed bag. The first time our her way to take care
This was a great place to stop for quick lunch. The lines were not too long for the sandwiches they had and they had wide selection of bagels if you wanted bagel sandwich. With great front patio for enjoying your food, it was a relax- place to stop. Write a review for
What made the banana pepper appetizer stand out to you compared to other starters?
and even MADE me cocktail sauce for my fish sandwich. The second time, the server was lackluster, didn't t know anything about the menu and wasn't able to take proper care of nnl would return to Papa J's, but my terrible experience last time isn't enough to say it would be my first pick of places to eat around
server went
Carnegie/Robinoo..
19

---

Input
IPAD
DPIC
This article explores the longstanding debate between Ein- stein's theory of general relativity and Maxwell's theory of electro- magnetism regarding the nature of gravitation. The central question addressed is whether gravitation is best understood as a curvature space, a field in flat space, perhaps combination of hoth concepts. Drawing upon a comprehensive analysis of the theoretical framework and empirical evidence, the article presents nuanced examination of the arguments put forth by Einstein and Maxwell. The article begins by discussing Einstein's general theory of relativity, which proposes that gravitation arises from the curvature of spacetime caused by mass and energy. outlines the mathematical formalism used describe this curvature and highlights the key predictions and experimental confirma- tions of the theory. Conversely, the article delves into Maxwell's elce- tromagnetic theory, which suggests that gravitation may he explained fundamental force mediated by field propagating through flat space, similar to electromagnetic Further the article explores the distinctive features and limitations of each theory. scrutinizes the conceptual foundations, mathematical rigor, and empirical support for both approaches, highlighting their respective strengths weaknesses. Moreover, the article examines attempts to reconcile the two theories into a unified framework, gravity. By critically evaluating the arguments and evidence from both camps, this article aims to offer comprehensive assessment of the ques- tion regarding the nature of gravitation. Based the analysis presented, it becomes evident that both Einstein's 's theory of general relativity and Maxwell's theory of electromagnetism provide valuable insights into the phenomenon gravitation.
Abstract:
Write paper abstract to explain the debate between Einstein's the- ory general relativ- ity and Maxwell's the- ory of electromagnnttim regarding the nature of gravitation, and argue for which theory is more likely to be correct based the evidence presented in the essay statement.
What are the main chal- lenges in reconciling Einstein's theory of general relativity with Maxwell's theory of electromagnetism in explaining gravitation?
as the development of theories quantum
20

---

NeurIPS Paper Checklist
1. Claims
Question:
Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification:
We explained the contributions listed in the abstract and introduction in Section
2-4.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
is fine to include aspirational goals as motivation as long as is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations the work performed by the authors?
Answer: [Yes]
Justification:
We present the limitation in the section Conclusion.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g.. independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't 't acknowledged judgment and recognize that individual actions in favor of transparency play impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
the paper. The authors should use their best
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [NA]
21

---

Justification:
There is no theorem or lemma in this paper.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification: The codes are presented in the anonymous github, and the results can be reproduced by following the readme.
Guidelines:
The answer NA means that the paper does include experiments.
If the paper includes experiments, No answer this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make it clear how reproduce that algorithm. (b) If the contribution is primarily
model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome deseribe the particular way they provide for reproducibility, In the case of closed-source models, it may be that access to the model is limited in some way (e.g., registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
22

---

Answer:
[Yes]
Justification: The codes are presented in the anonymous github, and the results can be reproduced by following the readme. The dataset for this paper are publicly available.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips. cc/
for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to to reproduce the results. See the NeurlPS code and data submission guidelines (https
ssicnyolicy) for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification:
The experimental details are presented.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, or as supplemental material.
7. Experiment statistical significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [No]
Justification: We set the temperature parameter of the large language models to 0, so the results are deterministic.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by emror bars, confi- dence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.
The factors of variability that the error bars capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
23

---

It should be clear whether the error bar is the standard deviation or the standard error of the mean.
is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out range (e.g. negative етror rates).
If error bars reported in tables plots. The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: We use A800-80GE gpu and one Nvidia v100 to conduct experiments.
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't 't make into the paper).
9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurlPS Code of Ethics httpppp//pearurrrpc.c.ppooooaaap
Answer: [Yes]
Justification:
This paper has no ethics problem.
Guidelines:
The answer NA means that the authors have reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make to preserve anonymity (e.g., if there is special consid- eration due to laws or regulations their jurisdiction..
10. Broader impacts
Question: Does the paper discuss both potential positive socictal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification:
We discuss the potential socictal impacts mainly in section 3.2.
Guidelines:
The answer NA means that there no societal impact of the work performed.
If the authors answer NA or No. they should explain why their work has no societal impact why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious unintended (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (c.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate

---

to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional unintentional) misuse of the technology.
there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification:
There are no such risks in our paper.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided relcasing unsafe images.
We recognize that providing effective safeguards challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
Justification:
We have cited the original papers and included proper license.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset used and, possible, include URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g.. website). the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, wwwpsspipeaattteeeeee thcode. com datasets has curated licenses for some datasets. Their licensing guide can help determine the license dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if has changed) should be provided.
this information is not available online, the authors are encouraged to reach out to the asset's 's creators.
13. New assets
25

---

Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification:
We do not release new assets.
Guidelines:
The answer NA means that the paper does release new assets.
Researchers should communicate the details the dataset/code/mooel as part their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset used.
At submission time, remember anonymize your assets (if applicable). You either create an anonymized URL or include an anonymized zip file.
Crowdsourcing and research with human subjects
For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Question:
Answer: [NA]
Justification: We have no crowdsourcing experiments and human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According to the NeurlPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: We have no crowdsourcing experiments and human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, not include any information that would break anonymity (if applicable), such as the institution conducting the review.
16. Declaration of LLM usage
Question: Does the paper describe the usage of LLMs if is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, formatting purposes and does not impact core methodology, scientific rigorousness, originality of the research, declaration is not required.
26

---

Answer: [Yes]
Justification: Pretrained LLMs are used as backbones in our method, which is clearly stated in this paper.
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs as any important, original, non ntn-standard components.
Please refer to our LLM policy (https: /ttt::://eeurps... cetpourrpssccoooffeeeeeee 2c0Connerrencccs/2225/////////// /LMM for what should or should not be described.
27


Reviews:
[{"review_id": "p2WPj76Qr0", "reviewer": "Reviewer_uVgU", "summary": "The authors propose IPAD (Inverse Prompt for AI Detection), a framework consisting of a Prompt Inverter that identifies predicted prompts that could have generated the input text, and two Distinguishers that examine the probability that the input texts align with the predicted prompts. Their experiments show that IPAD outperforms the strongest baselines on in-distribution data, out-of-distribution (OOD), and attacked data.", "questions": "- Does OOD distribution only contain HWT samples? Would recommend clarifying the composition of this dataset in the paper. \n- In Figure 3, while there is a general trend of the models performing worse when evaluated under adversarial attacks, there are some instances where the model actually performs better with the attack vs without. Is this a evaluation error, or is this expected?", "limitations": "Yes", "rating": 5, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths : \n\n- There are experiments for testing the method's performance in several settings : in-distribution, out of distribution, structured prompts, as well as adversarial inputs. This lends more credibility and depth to the technique. \n\n- The results are pretty solid, and demonstrate the effectiveness of this method compared to existing detection methods. \n\nWeaknesses : \n\n- Not necessarily a weakness, but a limitation of the proposed method is that it requires fine-tuning multiple models, which is a costly task, which makes it less accessible for easy adoption. Besides that, the methods requires multiple calls to LLMs for every example, which again is a costly operation.", "was_revised": true, "final_justification": "The authors clarified most of the questions I had regarding the results and the latency impacts of their method. \nI stand by my original ratings, as I feel they are still reflective of my assessment of the paper.", "rebuttal": "Thank you for your valuable feedback and the time dedicated to reviewing our work. We address your concerns and questions as follows.\n\n> **[W] Cost of Fine-tuning & Multi-Call Overhead**\n\n-  **Single-time training**: We only need to train our model once, and it can generalize across various LLMs. For instance, in addition to the four common LLMs shown in Table 1, we also include results from two more models used in \\[1] to support this argument:\n\n|  Original Generator |  Re-Generator      | HumanRec | MachineRec | AvgRec | AUROC  | F1     |\n| ------------------ | ----------------- | -------- | ---------- | ------ | ------ | ------ |\n| Claude Sonnet 3.5  | Claude Sonnet 3.5 | 98.2     | 100        | 99.1   | 0.982  | 0.9909 |\n| Claude Sonnet 3.5  | GPT-3.5-Turbo     | 97.5     | 99.6       | 98.55  | 0.9711 | 0.9853 |\n| Gemini-1.5-Pro     | Gemini-1.5-Pro    | 98.4     | 100        | 99.2   | 0.984  | 0.9919 |\n| Gemini-1.5-Pro     | GPT-3.5-Turbo     | 96.3     | 99.2       | 97.75  | 0.9553 | 0.9772 |\n\n-  **Efficient runtime**: Our model achieves high runtime efficiency compared to similarly sized models. \n    - As discussed in Section 2.3, the inference procedure of our framework is designed to be computationally efficient and accessible:\n\n    - It involves **three calls to `phi-3-medium-128k-instruct`**, a lightweight, open-sourced LLM.\n    - It includes **one call to GPT-3.5-turbo** via API, which introduces fixed latency but **no local compute cost**.\n\n    - The total computational complexity is bounded by: O(3 · L · n² · d + OpenAIapi) where `L = 32` is the number of layers, and `d = 3072` is the hidden dimension of phi-3. To support this, we compare the per-layer parameter cost (`L × d`) of phi-3 with other similarly sized models:\n\n| Model             | Layers (L) | Hidden Dim (d) | L × d     |\n|------------------|------------|----------------|-----------|\n| **Phi-3-14B-medium** | 32         | 3072           | **98,304** |\n| LLaMA-3-8B        | 32         | 4096           | 131,072   |\n| Qwen2-7B          | 28         | 3584           | 100,352   |\n\n- **Better than zero-shot methods**:\n####  On average, our fine-tuned approach consistently outperforms zero-shot baselines.\n| Setting        | Arxiv AUROC | Arxiv F1 | XSum AUROC | XSum F1 | Writing AUROC | Writing F1 | Review AUROC | Review F1 | Prompt Attack AUROC | Prompt Attack F1 | Paraphrase Attack AUROC | Paraphrase Attack F1 | Perturbation Attack AUROC | Perturbation Attack F1 | LongWriter MachineRec | Code-Feedback MachineRec | Math MachineRec | \n| -------------- | ----------- | -------- | ---------- | ------- | ------------- | ---------- | ------------ | --------- | ------------------- | ---------------- | ----------------------- | -------------------- | ------------------------- | ---------------------- | ---------------------- | ---------------------- | ---------------------- |\n| **Zero-shot**  | 67.22       | 80.60    | 67.54      | 81.83   | 72.15         | 84.09      | 66.92        | 80.63     | 68.65               | 81.98            | 67.54                   | 81.83                | 56.60                     | 78.05                  | 53.69 | 49.61 | 56.91 |\n| **Fine-tuned** | 82.21       | 90.79    | 83.14      | 91.23   | 84.95         | 92.33      | 78.68        | 88.43     | 85.80               | 92.90            | 83.14                   | 91.23                | 83.01                     | 90.83                  | 77 | 74.53 | 70.60 |\n\n\n> **[Q1] Does the OOD Distribution Only Contain HWT Samples?**\n\n- The OOD Distribution in Table 2 and 3 contians both HWT and LGT, while Table 4 only contains the LGT. Below we detail the dataset composition for OOD evaluation:\n\n| Table / Figure | Original Generator  | Re-Generator      | HWT Samples | LGT Samples | Source (Empty means the same as the line above)    |\n| -------------- | ------------------- | ----------------- | ----------- | ----------- | --------------- |\n| **Table 1**    | GPT-3.5-Turbo       | GPT-3.5-Turbo     | 1000        | 1000        | From OUTFOX     |\n|                | GPT-4               | GPT-4             | 1000        | 1000        |Prompt from OUTFOX, use corresponding LLM to generate|\n|                | GPT-3.5-Turbo       | GPT-4             | 1000        | 1000        |                 |\n|                | Qwen-Turbo          | Qwen-Turbo        | 1000        | 1000        |                 |\n|                | Qwen-Turbo          | GPT-3.5-Turbo     | 1000        | 1000        |                 |\n|                | LLaMA-3-70B         | LLaMA-3-70B       | 1000        | 1000        |                 |\n|                | LLaMA-3-70B         | GPT-3.5-Turbo     | 1000        | 1000        |                 |\n|                | Claude Sonnet 3.5   | Claude Sonnet 3.5 | 1000        | 1000        |                 |\n|                | Claude Sonnet 3.5   | GPT-3.5-Turbo     | 1000        | 1000        |                 |\n|                | Gemini-1.5-Pro      | Gemini-1.5-Pro    | 1000        | 1000        |                 |\n|                | Gemini-1.5-Pro      | GPT-3.5-Turbo     | 1000        | 1000        |                 |\n| **Figure 2**   | GPT-3.5-Turbo       | GPT-3.5-Turbo     | 500         | 500         | From OUTFOX     |\n|                | GPT-4               | GPT-4             | 500         | 500         |                 | \n|                | GPT-3.5-Turbo       |  GPT-3.5-Turbo  + DIPPER Attack           | 500         | 500         | From OUTFOX|\n|                | GPT-3.5-Turbo       |  GPT-3.5-Turbo + OUTFOX            | 500         | 500         | From OUTFOX |\n| **Table 2**    |ArXiv, XSum, Writing, Review                 | | 500 each        | 500 each        | From DetectRL    |\n| **Table 3**    | Prompt, Paraphrase, and  Perturbation Attack     | | 500 each   | 500 each  | From DetectRL   |\n| **Table 4**    | LongWriter,Code-Feedback, Math |         | 500 each    |   0          |From Corresponding Dataset                 |\n| **Figure 3**   | GPT-3.5-Turbo       | GPT-3.5-Turbo     | 1000        | 1000        | Same as Table 1  Line 1|\n| **Tables 5–6** | GPT-3.5-Turbo       | GPT-3.5-Turbo     | 1000        | 1000        | Same as Table 1  Line 1|\n\n> **[Q2] Figure 3: Why Does Adversarial Attack Sometimes Improve Performance?**\n\n- This is **not** an evaluation error. We observed that **Prompt Attack** and **Paraphrase Attack** datasets yield slightly **higher AUROC** than the non-attacked Yelp dataset under the **FT Prompt** setting.\n\n* The *arxiv*, *xsum*, *writing*, and *review* datasets represent **standard OOD**.\n* The *prompt*, *paraphrase*, and *perturbation* datasets are **attacked OOD**.\n* These categories are **orthogonal**, so only **averages** across all settings are comparable.\n\nMost importantly, the **average AUROC without attacks is higher** than with attacks, which aligns with expected adversarial degradation."}, {"review_id": "aiJQKD5cam", "reviewer": "Reviewer_LAhb", "summary": "This paper design an AI detection pipeline centered around a reverse-prompting approach. It involves training three separate components — a Prompt Inverter, a Prompt-Text Consistency Verifier (PTCV), and a Regeneration Comparator (RC) based on a lightweight open model — which are then integrated into a unified detection pipeline. This approach helps to reveal the individual judgments made by each of the three components during the detection process, thereby improving the interpretability of the pipeline and supporting its overall reliability.", "questions": "### Questions for the authors:\n\n1. Could you please provide results with more recent and stronger baselines, for example from 2024 or 2025, to better demonstrate the advantages of your approach?\n\n2. The ablation study mainly focuses on data structures. Would you consider adding an ablation on the effects of the Prompt Inverter and the new modules compared to DPIC to strengthen your analysis?\n\n3. Could you provide more details about the fine-tuning data and any analysis on OOD scenarios or datasets, to better support the claims of generalization and robustness? I could not clearly find this information in the current manuscript.", "limitations": "yes", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 1, "significance": 1, "originality": 2, "strengths_and_weaknesses": "### Strengths:\n1. The design of the proposed pipeline effectively improves the interpretability of the detection process by making the decisions of individual components more transparent.\n2. The integration of prompt inversion with the detection pipeline is an interesting and promising idea that enriches the overall methodology.\n\n### Weaknesses:\n1. The experimental comparison is not sufficiently convincing. The baselines selected are quite outdated, and stronger baselines from 2024 and 2025 should be included for a more meaningful evaluation. Besides, the related work section is far from well-studied and lacks sufficient depth and coverage of recent literature.\n\n2. The core idea of the paper—reverse prompting—is very similar to existing work like DPIC, as the paper also mentioned. Although the authors briefly discuss differences in their Prompt Inverter (e.g., fine-tuning rather than zero-shot) and the introduction of an additional module, they do not provide sufficient evidence that these modifications address the major limitations of DPIC. The comparison mainly focuses on results, without clarifying how the proposed approach overcomes the known weaknesses of DPIC. Given that fine-tuned models are expected to outperform zero-shot models, the results alone do not convincingly demonstrate the superiority of the method. \n\n3. The writing quality of the paper is poor in several key aspects. For example, the experimental section should present the main results in a clear and direct way.", "was_revised": true, "final_justification": "All my concern has been addressed. I'd like to raise my score to 4.", "rebuttal": "Thank you for your valuable feedback and the time dedicated to reviewing our work. We address your concerns and questions as follows.\n\n>**[W1][Q1] The experimental comparison is outdated.** \n\n- We have already included two 2024 baselines (Binoculars [1] and Fast-DetectGPT [2]) in Table 2–4, \n- We have expanded the comparisons to include **five recent baselines from 2024 and 2025**.\n\n|Method|Arxiv AUROC|Arxiv F1|Xsum AUROC|Xsum F1|Writing AUROC|Writing F1|Review AUROC|Review F1|\n|--|--|--|--|--|--|--|--|--|\n|DNA-GPT (2024) [3]|81.45|90.27|76.06|86.22|75.93|88.20|66.24|80.30|\n|RAIDAR (2024) [4]| 68.03|82.16|60.38|67.31|79.82|88.84|60.19|77.95|\n|FAID (2025) [5]|79.21|89.07|75.34| 86.27|78.92|89.25|68.99|82.67|\n|Advacheck (germgr) (2025) [6]|86.28|93.02|84.20|95.92|89.68|94.67|79.21|89.07|\n|Glimpse+Fast-DetectGPT (2025) [7]|93.16|96.55|96.23|98.11|90.25|94.90|89.17|94.28|\n|**IPAD (Ours)**|**100.00**|**100.00**|**99.85**|**99.92**|**99.40**|**99.70**|**98.25**|**99.10**|\n\n|Method|PromptAUROC|PromptF1|ParaphraseAUROC|ParaphraseF1|PerturbationAUROC|PerturbationF1|\n|--|--|--|--|--|--|--|\n|DNA-GPT (2024)|79.92|89.38|80.09|89.61|78.67|88.80|\n|RAIDAR (2024)|63.27|78.42|63.48|81.34|49.20|72.78|\n|FAID (2025)|72.57|86.49|72.91|85.60|72.02|84.51|\n|Advacheck (germgr) (2025)|92.67|96.21|86.46|93.11|84.99|92.09|\n|Glimpse+Fast-DetectGPT (2025)|90.29|95.01|93.24|96.53|86.27|92.77|\n|**IPAD (Ours)**|**97.30**|**98.59**|**96**|**98.04**|**98.10**|**99.10**|\n\n|Method|LongWriter|Code-Feedback|Math|\n|--|--|--|--|\n|DNA-GPT (2024)|65.9|40.3|50.6|\n|RAIDAR (2024)|52.3|48.7|67.9|\n|FAID (2025)|59.8|47.2|52.8|\n|Advacheck(germgr) (2025)|89.7|87.2|77.1|\n|Glimpse+Fast-DetectGPT (2025)|90.2|87.7|89.2|\n|**IPAD (Ours)**|**97.5**|**92.7**|**95.6**|\n\n- These results show that the updated baselines perform reasonably well, but still fall short of IPAD.\n\n>**[W2][Q2] Sufficient Evidence and Ablation Study Comparing with DPIC.**\n \n- **Both IPAD and DPIC consist of a Prompt Inverter (PI) and a corresponding classifier, and they have clear differences on both stages.**\n- **PI**:  \n    - DPIC uses **a fixed prompt for zero-shot prompt generation without any supervision signal**, and we found that **zero-shot prompt generation performs significantly worse than IPAD's fine-tuned PI** (see Table 5).\n    - IPAD **fine-tunes the PI using prompt-generated text pairs by using both general and essay-style data**, which results in more plausible prompts that benefits the AI detection performance.\n- **PI-Based AI Detection**:  \n  - DPIC simply adopts **a DNN model using text embeddings as input** to distinguish the human-written and AI-generated text.\n  - IPAD uses **two fine-tuned LLMs** to perform AI detection, including:\n    - (a) Prompt-Text\tConsistency Verifier (PTCV): measures the alignment between the *predicted prompt* via IPAD's PI and *input raw text*, i.e., **\"Can LLM generate [text] via prompt [IPAD's predicted prompt]?\"**.\n    - (b) Regeneration Comparator (RC): measures the alignment between the *regenerated text* via IPAD's PI and *input raw text*, i.e., **\"[Generated text using IPAD's PI as prompt] is LLM-generated, determine whether [text] is also LLM-generated?\"**. \n  - By using both PTCV and RC, our IPAD has more superior AI detection performance with promising **OOD performance and robustness.**\n\n- As suggested by the reviewer, the **fine-tuned Prompt Inverter** are always expected to outperform the zero-shot one as in DPIC. **To show the effectiveness of our AI detection modules PTCV and RC, we compare our methods with the modified DPIC using our fine-tuned PI instead of the zero-shot PI as in the original DPIC.**\n\n\n|Prompt Inverter (PI)|PI-Based AI Detection|Arxiv|Xsum|Writing|Review|\n|--|--|--|--|--|--|\nIPAD|DPIC|54.3|49.8|82.3|57.2|\nIPAD|**PTCV (IPAD w/o RC)**|**92.4**|**98.3**|**98.7**|**95.6**|\nIPAD|**RC (IPAD w/o PTCV)**|**98.7**|**97.3**|**94.5**|**96.7**|\nIPAD|**PTCV+RC (IPAD)**|**100**|**99.85**|**99.4**|**98.2**|\n\n|PI|PI-Based AI Detection|PromptAttack|ParaphraseAttack|PerturbationAttack|\n|--|--|--|--|--|\nIPAD|DPIC|46.2|42.3|41.5|\nIPAD|**PTCV**|**91.1**|**96.9**|**95.7**|\nIPAD|**RC**|**91.3**|**93.1**|**90.3**|\nIPAD|**PTCV+RC (IPAD)**|**97.3**|**96.0**|**98.1**|\n\n|PI|PI-Based AI Detection|LongWriter|Code-Feedback|Math|\n|--|--|--|--|--|\n|IPAD|DPIC|57.2|62.8|49.3|\n|IPAD|**PTCV**|**87.5**|**92.4**|**93.8**|\n|IPAD|**RC**|**94.7**|**91.8**|**89.2**|\n|IPAD|**PTCV+RC (IPAD)**|**97.5**|**92.7**|**95.6**|\n\n- From above, IPAD's PTCV and RC each bring significant gains, and their combination as the complete IPAD method achieves the best.\n\n>**[Q3] Details and analysis on fine-tuning data and OOD data.**\n\n- **Generalization**: To simulate biased training data selection, each training sample $X_i$, which is the embedding of the input text obtained from `Qwen1.5-7B-instruct`, is assigned a sampling probability $p_i=\\sigma(W\\cdot X_i)$, where $W \\sim \\mathcal N(a, 1)$ and $\\sigma(\\cdot)$ denotes the sigmoid function.\n\n   - We randomly sample 5,000 training samples according to $p_i$, and use a fixed set of 1,000 test samples for evaluation on both training PTCV and RC.\n\n|Method|Arxiv AUROC|Arxiv F1|Xsum AUROC|Xsum F1|Writing AUROC|Writing F1|Review AUROC|Review F1|\n|--|--|--|--|--|--|--|--|--|\n|a=5|91.74|97.18|92.98|96.72|91.32|95.20|92.99|95.30|\n|a=15| 91.08|96.71|92.13|96.52|90.39|95.47|93.95|95.28|\n|**Random**|**92.28**|**97.52**|**93.75**|**96.85**|**91.40**|**95.70**|**93.21**|**96.10**|\n\n- We additionally introduce label noise by randomly flipping 5% and 15% of the training labels within the above sampled training sets to evaluate the **robustness** of our method.\n\n|Method|Arxiv AUROC|Arxiv F1|Xsum AUROC|Xsum F1|Writing AUROC|Writing F1|Review AUROC|Review F1|\n|--|--|--|--|--|--|--|--|--|\n| Flip 5 %|89.12|92.48|87.26|91.35|91.72|94.28|90.83|94.20|\n| Flip 15 %| 88.01|91.28|86.53|90.83|88.27|93.04|87.88|91.7|\n|**Random**|**92.28**|**97.52**|**93.75**|**96.85**|**91.40**|**95.70**|**93.21**|**96.10**|\n\n- The results indicate that our method generalizes well even under biased sampling strategies, which induce distributional shifts. Moreover, the model remains robust under label noise, with only moderate degradation at 5% and 15% noise levels.\n\n>**[W3] Poor writing quality**\nThanks for pointing this issue. We will integrate the main results into a clear table at the beginning of Section 3. \n\n>**[W1] Related Work**\n\nThank you for your kind suggestion! We will add the following related work in our revised version. The state-of-the-art AI detection methods can be broadly divided into four categories:\n\n- **Probability‑based approaches** treat a language model’s output distribution as a signal. DetectGPT [8] and Fast‑DetectGPT [2] notes that LGT tends to lie in regions of negative curvature of a language model’s log‑probability function. Lastde [9] mines token probability sequences using time‑series analysis to capture temporal dynamics. Glimpse [7] extends white-box detectors to proprietary models by predicting full distributions from partial observations.\n\n- **Regeneration‑based methods** generate alternative versions of the text and compare them with the original. RAIDAR [4] and MAGRET [10] observe that LLMs modify human‑written text more than AI‑generated text when tasked with rewriting. DNA‑GPT [3] generates the remaining part of a truncated text and compares n‑gram differences. TOCSIN [11] measures semantic difference after random deletion of tokens and combining this signal with an existing zero‑shot detector. \n\n- **Syntax‑based methods** leverage structural linguistic cues rather than probability estimates. PRDetect [12] notes that HWT and LGT differ in their syntactic structures, so it extracts syntax‑tree features to achieve high accuracy and robustness. Text Fluoroscopy [13] extracts the layer with the largest distribution difference between first and last layers to detect synthetic texts across domains. \n\n- **Contrastive‑learning approaches** train detectors to learn writing styles or domain‑invariant features. FAID [5] collects a multilingual, multi‑domain dataset and introduces a fine‑grained classification framework. DeTeCtive [14] argues that detection should distinguish writing styles rather than simply classify LGT versus HWT. Advacheck’s multi‑task system [6] shares a transformer encoder among several heads, with one binary head for classification and auxiliary heads for domain classification.\n\n***\n**References**\n\n[1] Hans et al. Spotting LLMs With Binoculars: Zero-Shot Detection of Machine-Generated Text. ICML 2024.\n\n[2] Bao et al. Fast-DetectGPT: Efficient Zero-Shot Detection of Machine-Generated Text via Conditional Probability Curvature. ICLR 2024.\n\n[3] Yang et al. DNA-GPT: Divergent N-Gram Analysis for Training-Free Detection of GPT-Generated Text. ICLR 2024.\n\n[4] Mao et al. Raidar: generative ai detection via rewriting. ICLR 2024.\n\n[5] Ta et al. FAID: Fine-grained AI-generated Text Detection using Multi-task Auxiliary and Multi-level Contrastive Learning. arxiv 2025.\n\n[6] Gritsai et al. Advacheck at GenAI Detection Task 1: AI Detection Powered by Domain-Aware Multi-Tasking. 2025.\n\n[7] Bao et al. Glimpse: Enabling White-Box Methods to Use Proprietary Models for Zero-Shot LLM-Generated Text Detection. ICLR 2025.\n\n[8] Mitchell et al. DetectGPT: zero-shot machine-generated text detection using probability curvature. ICML 2023.\n\n[9] Xu et al. Training-free LLM-generated Text Detection by Mining Token Probability Sequences. ICLR 2025.\n\n[10] Huang et al. MAGRET:Machine-generated Text Detection with Rewritten Texts. ACL 2025.\n\n[11] Ma et al. Zero-Shot Detection of LLM-Generated Text using Token Cohesiveness.EMNLP 2024.\n\n[12] Li et al. PRDetect: Perturbation-Robust LLM-generated Text Detection Based on Syntax Tree. NAACL 2025.\n\n[13] Yu et al. Text fluoroscopy: Detecting LLM-generated text through intrinsic features. EMNLP 2024.\n\n[14] Guo et al. Detective: Detecting ai-generated text via multi-level contrastive learning. NeurIPS 2024."}, {"review_id": "5wvY1chCZX", "reviewer": "Reviewer_P69T", "summary": "The paper proposes a methodology for detection of AI-generated text involving 3 components. The first is a prompt inverter that generates the prompt P that is most likely to have generated the input text T (the text to be classified as AI-generated or not). The underlying model is based on Phi3-medium-128k-Instruct & is trained using datasets containing prompt, text pairs. The second component, also based on Phi3 medium Instruct, is a fine-tuned classifier that verifies if T could have been generated using P. This is followed by a third component that first uses an LLM (gpt-3.5 turbo) to generate text T’ using the (generated) prompt P. Thereafter, a fine-tuned classifier (based on Phi3 medium Instruct) verifies if T & T’ could have been generated using the same prompt P. The final classification is dependent on a weighted combination of the probabilities obtained from both the verification classifier components. \n\nIn comparison with related baselines, the method shows significant improvement in AUROC on both in & OOD datasets. The paper includes experiments to demonstrate the necessity of each of the verifier components for the task, and also attempts to individually measure the performance of each of the 3 components against specific baselines.", "questions": "- Lines 200-209: When comparing against SBERT & BART-large-cnn, were the thresholds determined using a validation dataset? Which dataset(s) did this come from?\n- Lines 200-209: In comparing with ChatGPT, how did the authors arrive at the prompt used (Appendix D)? Were other less convoluted prompts tried as well, especially those that break the task down into steps and involve querying the LLM at each step? The gap in performance reported in Table 6 between ChatGPT & IPAD is large, and given that a) IPAD was fine-tuned, b) a validation set was used for threshold selection, it would be a fairer comparison to try to use a more optimal prompt with ChatGPT & perhaps report the average performance across a variety of prompts.\n- Sec 2.2: Some clarity on the validation set here would be helpful\n- Lines 152-156: Could you elaborate on why F1 scores were not also reported?\n- Sec 3.3: What was meant by IPAD version 2 in line 219? Also, w.r.t the study here, it would help to know the human judgements obtained by the baselines, for each of the explainability dimensions. Was the rating on a 1-5 scale? Further, how were judgements from the 10 participants combined for the final rating?", "limitations": "Yes", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths:\n- The paper is well-written & clearly outlines the methodology, and experiments conducted for the task. \n- The proposed approach is novel, and the paper contains detailed experiments on both in & OOD datasets for the problem, with current baselines used for comparison. Experiments have also been included to highlight the necessity of each of the verifier components with the prompt inverter (Sec 3.2.1). Further, attempts have been made to compare each individual component separately against relevant baselines which is commendable.\n\n\nWeaknesses:\n- The motivation behind using Phi3 medium Instruct as the underlying model for all the components is not provided. Were other models considered and discarded? \n- The statistics of the datasets used are not detailed. It would be useful to understand the proportion of human generated & AI generated texts in them, to better comprehend the results.\n- The experimental results focus on AUROC & Recall as metrics. To take into account dataset imbalance, F1 scores should also have been included.\n- Sec 3.2.2 Lines 200-209 & Sec 3.3 would benefit from further clarifications on the experiment setup. (Pl refer to Questions Section below for details)", "was_revised": true, "final_justification": "I appreciate the detailed results presented by the authors in the rebuttal. I already have assigned a positive score (Accept) that remains unchanged at this time.", "rebuttal": "Thank you for your valuable feedback and the time dedicated to reviewing our work. We address your concerns and questions as follows.\n\n> **[W1] The motivation behind using Phi3 medium Instruct as the underlying model for all the components is not provided. Were other models considered and discarded?**\n\n- **Low Computational Costs** compared with other similar-sized models. \n  - As discussed in Section 2.3, the inference procedure of our framework is designed to be computationally efficient and accessible:\n  - It involves **three calls to `phi-3-medium-128k-instruct`**, a lightweight, open-sourced LLM. - It includes **one call to GPT-3.5-turbo** via API, which introduces fixed latency but **no local compute cost**.\n\n   - The total computational complexity is bounded by: O(3 · L · n² · d + OpenAIapi) where `L = 32` is the number of layers, and `d = 3072` is the hidden dimension of phi-3. To support this, we compare the per-layer parameter cost (`L × d`) of phi-3 with other similarly sized models:\n\n| Model             | Layers (L) | Hidden_Dim (d) | L × d     |\n|------------------|------------|----------------|-----------|\n| **Phi-3-14B-medium** | 32         | 3072           | **98,304** |\n| LLaMA-3-8B        | 32         | 4096           | 131,072   |\n| Qwen2-7B          | 28         | 3584           | 100,352   |\n\n> **[W2 Q4] The experimental results focus on AUROC & Recall as metrics. To take into account dataset imbalance, F1 scores should also have been included.**\n\n- For Tabel 1, we could include the F1 scores since we referred to OUTFOX which does include the F1-score in their results (OUTFOX Table 3). \n\n| Original Generator | Re-Generator    | HumanRec | MachineRec | AvgRec | AUROC | F1    |\n|--------------------|-----------------|----------|------------|--------|-------|-------|\n| gpt-3.5-turbo      | gpt-3.5-turbo   | 98.50    | 100.00     | 99.25  | 100.00| 98.50 |\n| gpt-4              | gpt-4           | 98.70    | 100.00     | 99.35  | 100.00| 98.70 |\n|                    | gpt-3.5-turbo   | 96.10    | 100.00     | 98.05  | 99.96 | 96.10 |\n| Qwen-turbo         | Qwen-turbo      | 98.60    | 99.80      | 99.20  | 99.96 | 98.40 |\n|                    | gpt-3.5-turbo   | 98.40    | 99.50      | 98.50  | 99.86 | 97.91 |\n| LLaMA-3-70B        | LLaMA-3-70B     | 98.70    | 100.00     | 99.35  | 100.00| 98.70 |\n|                    | gpt-3.5-turbo   | 98.60    | 100.00     | 99.30  | 100.00| 98.60 |\n\n\n- For Table 2 and 3, we referred to DetectRL, which does not include F1-score in their results (Table 5). Therefore, we reimplemented the baseline results in Table2 and 3 using the datasets described in the response of reviewer uVgU A2 (500 LGT and 500 HWT under each dataset) :  \n\n| Method            | Arxiv AUROC | Arxiv F1 | Xsum AUROC | Xsum F1 | Writing AUROC | Writing F1 | Review AUROC | Review F1 |\n|-------------------|-------------|----------|------------|---------|----------------|------------|---------------|------------|\n| DetectLLM (LRR)   | 48.15       | 69.70    | 49.20      | 67.70   | 58.67          | 74.38      | 58.21         | 75.42      |\n| DetectLLM (NPR)   | 53.80       | 73.12    | 56.95      | 76.05   | 54.90          | 73.13      | 50.12         | 68.02      |\n| Binoculars        | 83.99       | 91.60    | 88.88      | 94.66   | 94.37          | 97.18      | 89.91         | 94.73      |\n| Fast-DetectGPT    | 42.00       | 60.81    | 40.90      | 66.91   | 51.09          | 71.98      | 54.61         | 73.72      |\n| Rob-Base          | 81.14       | 90.28    | 90.04      | 94.97   | 86.24          | 93.07      | 87.85         | 93.54      |\n|**IPAD(Ours)**|**100.00**|**100.00**|**99.85**|**99.92**|**99.40**|**99.70**|**98.25**|**99.10**|\n\n| Method          | Prompt Attack AUROC | F1    | Paraphrase Attack AUROC | F1    | Perturbation Attack AUROC | F1    |\n| --------------- | ------------------- | ----- | ----------------------- | ----- | ------------------------- | ----- |\n| DetectLLM (LRR) | 50.12               | 70.68 | 49.20                   | 67.70 | 53.97                     | 72.88 |\n| DetectLLM (NPR) | 75.03               | 86.02 | 56.95                   | 76.05 | 6.79                      | 59.52 |\n| Binoculars      | 78.11               | 89.49 | 88.88                   | 94.66 | 76.91                     | 87.64 |\n| Fast-DetectGPT  | 43.79               | 64.86 | 40.90                   | 66.91 | 44.39                     | 71.94 |\n| Rob-Base        | 92.16               | 96.02 | 90.04                   | 94.97 | 92.04                     | 95.88 |\n|**IPAD(Ours)**|**97.30**|**98.59**|**96**|**98.04**|**98.10**|**99.10**|\n\n- For Table 4, we only have LGT for the three structured datasets, therefore we only include the Machine-rec score. \n\n> **[Q1] Validation set in lines 200-209**\n\n- We use the in-distribution 1,000 LGT and 1,000 HWT which are both generated by gpt-3.5-turbo. And we split them into **500 validation set** and **500 testing set** each. We used the validation set to determine the threshold.\n\n> **[Q2] In comparing with ChatGPT, how did the authors arrive at the prompt used (Appendix D)?**\n- The prompt in IPAD's Appendix D is from DPIC's Appendix B Table 5. \n\n>  **[Q2] Were other less convoluted prompts tried as well, especially those that break the task down into steps and involve querying the LLM at each step?**\n- Yes, we did explore alternative prompts beyond the original DPIC. In particular, we evaluated three prompts: RPE [1], DP1[2], and DP2 [3]. The results show that IPAD's Prompt Inverter has better performance.\n* Prompts\n| Source| Prompt|                                                                                                                                                                                                                          \n| --- |--|\n| **\\[1] RPE** | You are an expert prompt detective. Given the following LLM response, guess a likely prompt that could have produced it. Return only the prompt. `<INPUT>`                                                                                 |\n| **\\[2] DP1** | What question are you asked if you can generate the following answer? `<INPUT>`                                                                                                                                                            |\n| **\\[2] DP2** | Assume you are the prompt reconstructor who can help the user generate the prompts based on the given answers. Can you generate the original prompts for the following answer? `<INPUT>`                                                   |\n| **DPIC**     | I want you to play the role of the questioner. I will type an answer in English, and you will ask me a question based on the answer in the same language. Don’t write any explanations or other text, just give me the question. `<INPUT>` |\n\n* LGT Results\n| Metric           | RPE          | DP1      | DP2      | DPIC     | Prompt Avg | IPAD  |\n| ---------------- | ------------ | -------- | -------- | -------- | ---------- | ----- |\n| BART-large-CNN ↓ | **-1.98**    | -2.43    | -2.18    | -2.12    | -2.1775    | -1.84 |\n| Sentence-BERT ↑  | **0.58**     | 0.41     | 0.43     | 0.46     | 0.47       | 0.69  |\n| BLEU ↑           | **7.28E-03** | 3.46E-05 | 9.32E-05 | 5.61E-05 | 1.87E-03   | 0.24  |\n| ROUGE-1 ↑        | **0.17**     | 0.09     | 0.08     | 0.04     | 0.095      | 0.51  |\n\n* HWT Results\n| Metric           | RPE          | DP1      | DP2      | DPIC     | Prompt Avg | IPAD  |\n| ---------------- | ------------ | -------- | -------- | -------- | ---------- | ----- |\n| BART-large-CNN ↓ | **-2.78**    | -3.03    | -2.85    | -2.47    | -2.7825    | -2.22 |\n| Sentence-BERT ↑  | **0.47**     | 0.35     | 0.39     | 0.42     | 0.4075     | 0.57  |\n| BLEU ↑           | **8.42E-04** | 3.65E-06 | 3.25E-05 | 8.75E-06 | 2.22E-04   | 0.13  |\n| ROUGE-1 ↑        | **0.12**     | 0.12     | 0.04     | 0.06     | 0.085      | 0.39  |\n\n[1] Li, H., & Klabjan, D. (2024). Reverse Prompt Engineering. arXiv e-prints, arXiv-2411.\n\n[2] Sha, Z., & Zhang, Y. (2024). Prompt Stealing Attacks Against Large Language Models. CoRR.\n\n>**[Q5] Was the rating on a 1-5 scale? Further, how were judgements from the 10 participants combined for the final rating?**\n- Yes it is on a 1-5 scale. The assessment questions are listed as follows:\n| Aspects                                             | Questions                                                                                         | Rates (1-5) |\n|-----------------------------------------------------|---------------------------------------------------------------------------------------------------|-------------|\n| 1. **Transparency, Scrutability, and Education**     |  Do you think IPAD provides clearer and more understandable explanations for its decisions?**      |             |\n| 2. **Trust and Persuasiveness**                      | Do you find IPAD’s outputs more trustworthy and convincing?                                     |             |\n| 3. **Satisfaction, Effectiveness, and Efficiency**   | Do you think IPAD is more effective and efficient in performing its detection tasks?            |             |\n| 4. **Debugging and Error Handling**                  |  Does IPAD allow you to identify and correct its mistakes more easily?                           |             |\n\n> **[Q5] What was meant by IPAD version 2 in line 219?**\n- Sorry, this is a typo. It should be just \"IPAD\". Thank you for pointing it out. We will revise it accordingly."}]

Author rebuttal:

Meta-review: The paper proposes a method for LLM-generated text detection that extends the existing previous work on inverse prompt regeneration for the same task (already proposed by DPIC) with two distinguishers: 1) Prompt-Text Consistency Verifier (PTCV) for assessing the alignment between the predicted prompt and text to be verified, 2) Regeneration Comparator (RC) which measures the consistency between the input text and a regenerated text given the inverted prompt using a fast closed source but powerful (for everyday tasks, especially the ones used in the evaluation datasets) model gpt-3.5-turbo. The proposed method has some similarities with DPIC, which is used as a baseline, but the performance is improved mainly because the prompt inverter is finetuned / trained and also due to the improved distinguishers. 

The main strengths of the paper are the clear approach, which extends and adds some degree of novelty to DPIC, good experimental setup focusing on in-domain, OOD, and adversarial attacks for LLM generated text detection. The paper also has good ablations and the authors have provided additional data in the rebuttal that can be used to improve the paper and also increase the scores of at least a reviewer - I expect this new results to be added to the camera ready.

At the same time, the paper has the following weaknesses. On my side, the main problem is that it does not use several existing datasets for the detection of LLM generated texts to show that IPAD is better. I would have liked to see results using at least one of RAID (Dugan et al., 2024), M4GT (Wang et al., 2024a) or MAGE (Li et al., 2024). Some of these datasets actually have out-of-domain data, e.g. completely different prompts from different domains - I feel that the OOD data chosen in the paper is used a lot for LLM alignment and thus may not be representative for real-world usage plus it might exhibit important biases. Second, the degree of novelty compared to DPIC is not substantial. Third, the experimental setup is difficult to follow at times and the paper has some presentation issues as also signaled by at least a reviewer.

Given all these points and the feedback from the reviewers, I feel the paper is borderline above the acceptance threshold and I hope the authors are able to improve it for camera ready.
Decision: Accept (poster)