Adversarial Paraphrasing: A Universal Attack for Humanizing AI-Generated Text
Authors: Yize CHENG
Vinu Sankar Sadasivan
Mehrdad Saberi
Shoumik Saha
Soheil Feizi
Venue: NeurIPS 2025 poster ()
Keywords: AI Text Detection
Adversarial Attacks
Primary area: deep_learning
TL;DR: We propose adversarial paraphrasing: a training-free, transferable attack that universally humanizes AI-generated text by using an off-the-shelf LLM as a paraphraser, guided by an AI text detector.

Abstract: The increasing capabilities of Large Language Models (LLMs) have raised concerns about their misuse in AI-generated plagiarism and social engineering. While various AI-generated text detectors have been proposed to mitigate these risks, many remain vulnerable to simple evasion techniques such as paraphrasing. However, recent detectors have shown greater robustness against such basic attacks. In this work, we introduce \textbf{Adversarial Paraphrasing}, a training-free attack framework that universally humanizes any AI-generated text to evade detection more effectively. Our approach leverages an off-the-shelf instruction-following LLM to paraphrase AI-generated content under the guidance of an AI text detector, producing adversarial examples that are specifically optimized to bypass detection. Extensive experiments show that our attack is both broadly effective and highly transferable across several detection systems. For instance, compared to simple paraphrasing attack—which, ironically, increases the true positive at 1\% false positive (T@1\%F) by 8.57\% on RADAR and 15.03\% on Fast-DetectGPT—adversarial paraphrasing, guided by OpenAI-RoBERTa-Large, reduces T@1\%F by 64.49\% on RADAR and a striking 98.96\% on Fast-DetectGPT. Across a diverse set of detectors—including neural network-based, watermark-based, and zero-shot approaches—our attack achieves an average T@1\%F reduction of 87.88\% under the guidance of OpenAI-RoBERTa-Large. 
We also analyze the tradeoff between text quality and our attack success to find that our method can significantly reduce detection rates, with mostly a slight degradation in text quality.
Our novel adversarial setup highlights the need for more robust and resilient detection strategies in the light of increasingly sophisticated evasion techniques.

Adversarial Paraphrasing: A Universal Attack for Humanizing AI-Generated Text
Yize Cheng"
Vinu Sankar Sadasivan' Mehrdad Saberit Shoumik Saha Soheil Feizi
University of Maryland, College Park
{yzcheng, vinu, msaberi, smksaha, sfeizi)ccs. und edu
2 Project: https://github.comm httpa//.ww..//aaeeee/////aaaaaaa
Abstract
The increasing capabilities of Large Language Models (LLMs) have raised cerns about their misuse in Al-generated plagiarism and social engineering. While various Al-generated text detectors have been proposed mitigate these risks, many remain vulnerable to simple evasion techniques such as paraphrasing. How- ever, recent detectors have shown greater robustness against such basic attacks. In this work, we introduce Adversarial Paraphrasing, training- frree attack frame- work that universally humanizes any AI- Al-generated text evade detection more effectively. Our approach leverages an off-the-shelf instruction-follwwiin paraphrase Al-generated content under the guidance of an Al text detector, producing adversarial examples that are specifically optimized to bypass detection. Extensive experiments show that our attack is both broadly effective and highly transferable across several detection systems. For instance, compared to simple paraphrasing attack-which, ironically, increases the true positive at 1% false posi- tive (T@ (&F) by 8.57% on RADAR and 15.03% on Tast-DetecGGPT--avveaaaaa paraphrasing, guided by RooinAI-RBERRa-LLI RADAR and striking 98.96% on Fast- Fast-DetectGPT. Across diverse set of detectors-including neural sowork--bssed watermark-based and zero-shot ap- proaches-ous attack achieves average T@ 1 1%F reduction of 87.88% under the guidance of DpenAA-RoBEERTaLLne text quality and attack success to find that method detection rates, with mostly a slight degradation text quality. Our adversarial setup highlights the need for more robust and resilient detection strategies in the light of increasingly sophisticated evasion techniques.
LLM
reduces T@ 1%F by 64.49%
We also analyze the tradcoff between significantly reduce
Introduction
Recent advancements in natural language generation have given rise to transformer-basee Large Language Models (LLMs) such as GPT 223] Gemini [7], and LLaMA [2]], which have demonstrated remarkable capabilities across a wide range of tasks, such as email composition and code generation. These models are capable of producing fluent, coherent text that can be difficult to distinguish from that written by humans. However, despite their impressive performance, LLMs also raise significant security and ethical concerns, including risks related to plagiarism and social engineering.
To counter these risks, the development reliable Al-generated text detection tools has become critical research problem. Several works have proposed training neural network-based classifiers to address this challenge
10
18 Although typically weaker than trained detectors,
"Equal contribution
I Equal contribution
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

iteration
iteration
<Systemp: rephraser. any input text, supposed rephrese the text... <User>: Bielsa, 60, former Argentine and Chile boss, resigned from French club Marseille... <Assistant>:
<System?: You rephraser. Given any input text, you are supposed to rephrase the text... <User:: Bielsa, 60, former Argentine and Chile boss, resigned
Marseille... <Assistant:: 60-year--ll man
-0-year-old
Adversarial Paraphrasing at iterationi
happy
Argentine
Masking
Append Candidate Tokens
Choose the Candidate Text with Lowest Score
Argentine
60-yoar-old Argentine
Paraphraser LLM
look
Al Text Detector
t
tokens
candidate
scores
[Focab] tokens
Appyy Top-k &
:
60-year-oid old
footballer
60-year-ol old footballer
footballer
fish
Figure I: An overview of our universal and training-free framework for humanizing AI text. At every auto-regressive step of adversarial paraphrasing, using the guidance from an Al text detector, we search for the token with lowest "Al-score" from the set of top candidate tokens sampled by the paraphraser LLM. The token generation iterations continue until the paraphrasing is finished. (i.e. [EOS] token sampled)
various zero-shot detection techniques 22
have also been introduced to reduce the overhead of training classifiers. Another propitious approach is watermarking LLMs, which enforces specific signatures in the output text to facilitate detection 2 14 16
While these detection methods show promise in specific contexts, concerns about their robustness remain.
36 4
Sadasivan et al. [28] and Krishna et al. 15 demonstrated how AI-generated text can be paraphrased by another AI model evade detection by the existing AI detectors. The former also showed that recursively paraphrasing Al-generated content can be used to stress-test these systems and highlighted the fundamental difficulty of reliably detecting Al-generated text. These paraphrasing- based attacks aim to obscure the statistical patterns and artifacts that detection models typically rely on. However, more recent work suggests that some advanced detectors - especially those trained on paraphrased Al outputs [8] may exhibit greater resilience such evasion techniques. These developments naturally lead to pressing question: "Is possible to develop a universal attuck framework that can consistently and effectively bypass these robust Al- Al-generated text detectors with transferability wide variety of other detection systems?"
In this paper, we introduce a universal, training-free framework for humanizing Al-generated text, novel attack designed to effectively and efficiently rephrase Al-generated text to evade wide range of detectors with greater success when compared to the existing attack evasion methods. Our approach, Adversarial Paraphrasing, leverages an existing instruction fine-tuned LLM (LLaMA- 3-8B configured paraphraser via custom system prompt) not just for paraphrasing, but for adversarially humanizing the text under the guidance of a trained text detector (see Figure IT. During the paraphrasing process, at each token generation step, we consider the top likely next tokens proposed by the paraphrasing LLM. Then, instead of standard decoding, we score each of these potential continuations using guidance AI text detector. We then select the token that leads the sequence to be predicted with the lowest "AI score" (or equivalently, the highest "human score") by the detector, akin targeted, detector- griide beam search at depth one. Some example results are shown in Table [ This method operationalizes the goal of humanization directly within the generation process, falling under the umbrella of controlled text generation 37 19 3).
demonstrate that our adversarial paraphrasing strategy is not only more effective than baseline methods such as simple or recursive paraphrasing, but unlike other methods, it is also universally transferable to other diverse detection methods, including neural network-based, zero-shot, and watermarking-bast detectors. This justifies the universality of our framework. For example, while

---

simple paraphrasing ironically increases true positive rate at 1% false positive rate (T@1 by 8.57% on RADAR 8 and 15.03% on Fast- Past-DetectGPT [ our adversarial approach, guided by OpenAl- RoBERTa-I Large 30), reduces @@ %&F by 64.49% and a striking 98. 88,9,% respectively. Evaluated across eight detectors from three different categories, our method achieves an average T@ 1 I%F reduction of 87.88%, all while maintaining minimal degradation in text quality. We comprehensively analyze the tradeoff between our attack and the text quality using multiple automated studies.
Our core contributions are:
We introduce Adversarial Paraphrasing - universal and transferable attack that human- izes Al-generated text by guiding an off-the-shelif LLM,, used paraphraser, to sample each token based on detection scores from an off-the-shelf trained Al text detector.
We conduct extensive experiments demonstrating the attack's 's effectiveness and transferabil- ity across 8 different types of state-of the-art Al text detectors, highlighting its universality.
We evaluate the trade-off between attack success and the resulting text quality using perplex- ity scores as well as automated ratings with GPT-4o to find that our attacks can significantly reduce detection rates when compared to prior evasion attacks with only a slight or no degradation in the text quality.
Our findings highlight important vulnerabilities of existing Al text detectors in the presence of adversaries.
2 Related Work
AI- Text Detection. Recent studies have demonstrated the effectiveness of training neural networks to classify Al- Al-generated versus
text [10 g 26 30 18). For example, Solaiman
et al. (30) employed a RoBERTa-based 200 classifier to distinguish between human-written and
GPT-2-generated texts. Building on this idea, Li el al.
[8]] improves their classifier's performance in
the wild by gathering a diverse dataset, MAGE, for training their network. RADAR [8] adversarially trains their detector using paraphraser in an iterative manner to make their detector robust to paraphrasing attacks. To reduce the computational overhead of training a network- various zero-shot detectors are proposed [22] [1 6 [17.. These detectors use off uff-the-shelf LLM to evaluate statistical properties of candidate texts, such as their entropy or log probability scores, to perform detection. For example, DetectGPT [22] observes that Al-generated text tends to lie in regions of negative curvature in the log-probability landscape, while Fast-DetectGPT I improves efficiency by introducing conditional probability curvature. Watermarking has also been explored as a means of identifying Al-generated text. Kirchenbauer el al. (14) introduced the KGW watermark scheme that partitions the token vocabulary into green and red lists, encouraging the model sample more green tokens, thereby embedding detectable patterns in the generated text. While the KGW scheme uses previously generated tokens seed a random number generator for token partitioning. Zhao et. al. (36] proposed a variant of KGW, the Unigram watermark, which uses a fixed token partitioning for generation for provably demonstrating robustness. Kuditipudi er al. [16] developed a robust, distortion-free watermarking technique aimed at reducing distributional shifts caused by watermarking. More recently, Dathathri et al. introduced SynthID, which utilizes tournament sampling to create scalable watermarking solution for LLMs employing speculative decoding.
detector,
Attacks on AI Text Detectors. Sadasivan al. (28) showed that AI text detectors can be fooled using paraphrasing attacks. While basic paraphrasing methods are sufficient to defeat early zero-
shot and trained detectors, more robust detectors 88 14] 36 require recursive paraphrasing to be
effectively bypassed. To this end, Krishna et al. [1] proposed DIPPER, a powerful T5-based [24] paraphrasing model that significantly enhances the effectiveness of such attacks. Sadasivan et al. (8 also introduced spoofing attacks, where human-written texts are manipulated to be misclassified as Al- generated, thereby increasing type-I errors. In addition, they analyzed the theoretical difficulty of AI text detection, highlighting a fundamental trade-off between Iype-I and type- errors even for optimal detectors. The theoretical limits of Al Al-generated content watermarking have also been explored in other works [35 27). which analyze the inherent challenges in maintaining robustness under attack. There also exist previous adversarial attack methods for breaking watermarking techniques. For example, Jovanovic el al. [12] proposed Watermark Stealing, technique that learns the watermark signatures of a language model and uses this knowledge to both evade and spoof watermark- based detectors effectively. However, this framework specifically targets watermarking detectors and is not
3

---

transferable to other text detectors. In this paper, we propose Adversarial Paraphrasing, a training free attack that can universally break a variety of text detectors without the knowledge of the detection scheme, and that can even break more robust Al detectors g trained to withstand simple or recursive paraphrasing attacks.
Controlled Text Generation. Dathathri et al. (3] proposed the Plug and Play Language Model (PPLM) where an LLM can generate tokens with control decoding time, guided by various attribute classifiers. They show the effectiveness of their method to generate text guided by various classifiers to switch topies or sentiments. CAT-Gen [3] introduced controllable generation similar to that in PPLM, to adversarially generate diverse. fluent datasets using unrelated attribute classifiers as guidance. PPLM and CAT-Gen use gradient computations to perturb the key-value pairs of the transformer network to steer the generation to favor a selected attribute. This differs from our approach since our adversarial paraphrasing is a gradient-free approach for controlled paraphrasing. InstructCTG [37 demonstrated how off-the-shelf LLMs can controllably generate texts by incorporating the constraints as natural language instructions. InstructCTG, similar to our work, uses verbalized instructions to control the output generations. While they use verbalization to constrain generations lexically or syntactically, we use system prompts to constrain the LLMs we use to behave as a paraphraser. However, InstructCTG requires fine-tuning the LLM on the augmented corpus while we use the power of cestruction-follviiii LLMs to directly use them off the-shelf without any gradient computations. BEAST [29] proposed inference-time time beam search-based guidance generate adversarial tokens to jailbreak LLMs. BEAST is the most relevant prior work to our paper since they use a gradient-fi free bi-level beam search approach to find adversarial prompts guided by adversarial objective function. In contrast, our work uses a gradient-free single-level beam search to find adversarial paraphrases guided by Al text detector.
3 Adversarial Paraphrasing for Universal Humanization of AI Text
In this section, we present our adversarial paraphrasing frame- work, designed to universally paraphrase Al-generated text to evade detection various detec- tors. Algorithm [ outlines our method, and Figure 1 provides an illustrative visual overview of each step in the iterative para- phrasing process. Our approach auto-regressively generates para- phrased text using a paraphras-
Algorithm 1 Adversarial Paraphrasing with Guidance for Univer- sal Humanization of AI Texts
Require: Paraphraser LLM P modeled by p(-1z), guidance detector D, tokenizer decode method TT
Input: System instruction sys, Al-generated text Z.n, top-p
and top-k token masking methods top_p and top_k:
Output: Humanized text y:m
> Initialize the empty output string
1: = un m = 0
> Auto-regressive adversarial paraphrasing loop
2: while True do
ing model P X - X. guided by a neural network-based detec- tor : X + [0. 1]. where X' denotes the space of natural lan- guage texts. The model P out- puts the next token logit distribu- tion p(-1æ)- E Rdd for any input E X, where d represents the vocabulary size. In the standard setting, the paraphrasing model would multinomially sample the next token from this distribution. In our method, however, token selection is influenced by the de-
3:
p p(-Isys @ x... @ V:m)
4:
p' = top_k top_p(p)
> Decode logits to text tokens
5:
candidales = T(p))
6:
scores =
> Score the candidates from the detector for guidance length(candidatss do scores.append(D) (y.m @ candidates(k]) end for
7:
for k
8:
9:
10:
V candidates larg min scores]
> Append the candidate text token with lowest "AI score" (or equivalently, the highest "human score")
11:
y = y @ y² m m +
12:
if y [EOS] then
tector D, which assigns lower AI-
13:
break
14: end if
scores (i.e., closer to 0) to more "human- like" texts in the eyes of the detector.
15: end while
Overview of the Algorithm. As shown in line of Algorithm T. we initialize the output string as empty, i.c., y The algorithm then enters auto-regressive loop (lines 2-15), continuing until

---

the end-of of--eenneeeecce ([EOS]) token is generated. At each iteration, the paraphraser computes the logit distribution for the next token (line 3). To narrow down the candidate set, we apply top-p filtering to only select the top tokens whose cumulative probability exceeds certain threshold p. and top-k filtering to cap the maximum number of candidate tokens (line 4). line 5, we decode the filtered logits into their corresponding textual representations using the decoding function T. From lines 6 to 9, we score each candidate by appending it to the current output and evaluating the resulting text using the detector D. The token associated with the lowest detector score is selected and appended to the output sequence (lines 10 and 14). The loop continues until the [EOS] token is generated.
Paraphrasing Model Setup. To ensure effective paraphrasing, our framework relies on the availabil- ity of a high-quality paraphrasing model. To this end, we design the framework to be compatible with any well weel-perrorning instruction-tuned LLM by leveraging customized system instructions. As illustrated in Figure 2 these prompts guide the LLM to behave as reliable paraphrasing model, ensuring consistent and contextually appropriate paraphrases. This controlled generation approach is inspired by methods such as InstructionCTG 33
You are rephraser. Given any input text, you are supposed rephrase the text without changing its meaning and content, while maintaining the text quality. Also, it important for you to output rephrased text that has a different style from the input text. You can not just make a few changes to the input text. The input text is given below. Print your rephrased output text between tags <TAG> and </TAG>
Figure 2: The system prompt used to configure our paraphraser LLM.
Intuition Behind Universal Transferability. As demonstrated in our experimental results (see Section 4). our attack consistently evades a wide range of unseen AI text detectors. We attribute this transferability to the guidance signal provided by the guidance detector during generation. This signal plays a critical role in shaping the paraphrased text to align more closely with the statistical properties of human-written language learned by the guidance detector.
The key intuition is that most, if not all, high-perfone performing detectors tend to converge toward a common distribution that characterizes human- text, in an effort to minimize false positives. Consequently, if a paraphraser is guided to evade detection by a well-trained detector, its outputs may naturally align more closely with this shared human text distribution. As a result, the generated text becomes more difficult to detect not only by the detector used for guidance, but also by other detectors since they are all ideally calibrated to the same underlying distribution of -wrttew text. This property makes our adversarial paraphrases broadly transferable across different detectors.
4 Experiments
In this section, we present experimental results demonstrating the effectiveness and transferability
of adversarial paraphrasing. We first outline our experimental setup in Section 4.1 In Section 4.2
we report our main finding: adversarial paraphrasing guided by trained detector can successfully evade variety of detectors, including trained classifiers, watermark-based detectors, and zero-shot detectors, achieving stronger attack effectiveness and universality compared to simple paraphrasing and recursive paraphrasing baselines. We also include comparison against watermark stealing attacks [2], which is specifically designed to target watermarking techniques, in Appendix A
4.1 Setup
AI Text Detectors. To demonstrate the universality and transferability of our attack, we evaluate it against a wide range of AI text detectors. While there are a plethora of open-sourced AI text detectors, we select in total cight popular and representative detectors from each class, including neural network- [30], MAGE [18), and RADAR H8), watermark- based detectors (KGW [44] and Unigram (36] watermarks), and zero-shot detectors (Fast-DetectGPT I and GLTR 6)). We refer to the detector used to guide the adversarial candidate text selection in method as the guidance detector, and the detector that is deployed for Al-generated text detection as the deployed detector.
based detectors (OpenAI-RoBERTA) Base [30], DpenAA-RoBERTa-Laae
Datasets. For non-watermark-based detectors, we use MAGE 18 our primary evaluation dataset due to its rich diversity of text sources. We randomly sample 2000 Al-generated texts and 2000 hurtnewritten texts from MAGE while ensuring that each text is ~ 100 to 500 tokens in length. For
5

---

Text
Rating
Original AI Text. There doesn't seem whole lot information available about DOCSIS 3.1 yet, but my prior experience can lend a hand lowards this question. I would venture The DOCSIS 3.1 issue lus number of things to keep in mind. First, the DOCSIS 3.1 expansion only available for initial support, and this upgrade is apparently working [conrinues... . Simple Paraphrase. While the available information DOCSIS 3.1 is somewhat scurce, I'll draw upon my pust experience provide some insights. The DOCSIS 3.1 upgrade, currenily only available for initial support, is being tested on [continues... ..]
Adversarial Paraphrase. Given the scarce details curently available about DOCSIS 3.1, my insight garnered from past experience will allempi shed some light the matler. From my understanding, DOCSIS 3.1 necessilates several factors be taken into consideration. Inirially, DOCSIS 3.1 upgrades are only accessible thruug limited channels, specifically [continues ..]
5
Original AT Text. No, addiction much more than simply a hahit; it is chronic and progressive medical disorder. While habits can be formed through repeated use of drugs or alcuhol, addiction is a physical and psychological response those drugs causes compulsive drig seeking and use despite the negative consequences. It has heen suggested that addiction is [continues, ..]
Simple Paraphrase. Adkiction is a lar more complex phenomenon than mere habituation; it debilitating and relentless medical condition that has profound impact on an individual's 's payche and physiology. While habits can be formed through repeated exposure to suhstances, addiction is primal response those substances, driving an individual to compulsively soek and consume them despite the devastating consequeaces. Research suggests that addiction is a direct result of [continues... .
5
Adversarial Paraphrase. Addiction goes heyond being simply a habir; a persistently progressing medical condition with multifaccted causes. Initially, habits can form as result of regular drag alcohol consumption. However, addiction takes it step further, evolving into an all-coesuming compulsion driven by physiological and psychological cravings, despite the harmful ellects wreaks une's life. Scientific discoveries imply that [comtiues...
Original AT Text. The occurence of neur misses linked to socio ecomomic and clinical factors as well issues with care, highlighting the critical need for measures to euhance these indicators. Furthernore, we recommend more effective incorporation of this lpic into the medical course curriculum to emphasize the signilicance preveming near misses through appropriate medical training [continues...
Simple Paraphrase To address the pressing issue of near misses, it is essential to consider the complex interplay of socio- 5 ecunamic, clinical, and care related factors. crucial step in mitigaing this problem to incorporate a comprehensive approsch into medical education, ensuring that healthcare professionals are adequately equipped to prevent near [continues... . Adversarial Parphrase. Ensuring patient safety necessitates addressing eccoomeco,micc, clinicul, and care relatellatd factors contributing near misses. To comhat these accurrences, is essential to overhaul the medical curriculum to stress importance of preventative measures through targeted maining [continues...]
5
Table Examples of original AI texts with their simple and adversarial paraphrases (guided by OpenAl-RoBERTa-L
(0)). GPT-4o quality ratings are provided for each paraphrased version.
watermark- bascr detectors, we construct "watermarked" datasets using a watermarked LLaMA-3.1 3.1- 8B-Instruct [21]. Specifically, we input the model with the first 20 words of each of the 2000 AT texts as prefix, and let it generate watermarked text 2000 to 600 tokens in length. We report detailed token statistics for all datasets used in Appendix C
Attack setup. We use -LLMM-3--BB-Insrue [21] with a custom system prompt (see Figure 2 as our paraphraser model. During adversarial sampling, we apply top-p and top-k masking with p 0.99 and k = 50 at each step. We ablate the guidance detector using all four neural network-based detectors considered in our study Maddy-OpenAI-Roie RoBAAA--RRRRT--aaeee (30,, OpennAl-RBERRTa- MAGE [8] and RADAR (8)
330)
We also evaluate against a stronger recursive paraphrasing (28 baseline. Additionally, in Appendix A we include a comparison with watermark stealing 12] an attack specifically designed to target LLM watermarking.
Baselines. As simple baseline, we use single round of paraphrasing 188 15
4.2 Effectiveness and Universality of Adversarial Paraphrasing for Humanizing AI Text
Figure 3 presents the ROC curves illustrating the detection performance of eight different deployed detectors with and without various attack methods. We consider four neural network-based detectors, two watermark-
detectors, and two zero-shot detectors for our experiments. Table 2 reports three key evaluation metrics for each combination of attack method and detector: the Area Under the ROC Curve (AUC), the True Positive Rate at 1% False Positive Rate (T@) 1 %F), and GPT-4o's automated assessments of text quality (Rating). Additional details on text quality evaluation are provided in Section 5 Table П provides representative examples of original AI, simple paraphrased, and ad adversarially paraphrased texts to support manual qualitative comparison.
Effectiveness. From the ROC curves, we observe that adversarial paraphrasing consistently and significantly reduces detection performance across all evaluated detectors when compared to simple and recursive paraphrasing baselines. Specifically, adversarial paraphrasing shifts the ROC curves closer to, and sometimes even beyond that of a random detector, resulting in lower AUC and a significant drop in T@ FFF. Notably, RADAR 8 detector adversarially trained to be robust to paraphrasing attacks-exhin exhibits improved detection rates after baseline simple and recursive paraphrasing attacks. However, adversarial paraphrasing significantly reduces RADAR's detection. This detection degradation post-attack is more pronounced in other detectors, including watermark-
6

---

MAGE
OpenA-RoBERTe BaBeas
OpanA--RoBERee-Lape
RADAR
Trin Posiive Fante
KGW
Uni WM
F
GLTR
True Postive Rate
04
60
False Positive Rate
False Positive Rate
False Posiive Rate
False Posilive Rate
NoAteck
Rac 2 Parappoen
Adt. Paraphraeing - RADAR
Adv Phoxphooning- RotlE Te-laan
Randim Delecter
Simple Panphreeing
Rac: Parighoneey
Ast: Paraphrneing RaatERieeeaggg
Phosphsssing MAGE
Figure 3: ROC curves illustrating the AI text detection performance on several deployed detectors, including neural network-basee watermark-base based, and zero-shot detectors. The false positive (FPR) axis is displayed in log-scale highlight fine-grained distinetions in the low-FPR region. It can be observed that adversarial paraphrasing consistently and significantly reduces the detection performance across all deployed detectors when compared the baselines.
RoBERTa-Large
RoBERTa
MAGE
RADAR
(U)
(L)
TSISF(U)
(1)
(J)
AUC
Rating
No Anaakk
0.789
0.163
0:745
0.182
0.975
0.768
0.767
0.124
Simple Paraghnase
0.794
0.096
0.762
0.119
0.970
0.516
01881
0.140
4.75
0.54
Rec. Parn.
0.277
0.069
0.712
0.082
0.967
0.609
0.885
0.130
4.47
0.67
AdvPara (RADAR)
0.538
0.013
0.164
0.001
0.815
0.201
0.723
0.031
1.45
0.79
AdvPara (RoBERTi-Largs)
0.147
0,000
0.323
0.000
0.769
0.142
0.768
0.044
4.48 1 0.77
AdvPara (RoRERTa-
0.557
0,006
0.110
0.000)
0,861
0.291
0.826
0.008
4.54
0.59
KGW WM
Uni WM
Pasi-DetectGPT
GLTR
(UC
AUC
T01%F()
AUC
T81 (1)
AUC
T815F
Rating
Attack
1,000
1,000
1.000
0.909
0.666
0.323
0.726
0.174
Simple Paraphrase
0.841
0.295
0.927
0.609
0.873
0.326
0.782
0.049
4.75 4: 0.54
Rec. Para.
0,790
0,181
0.881
0.180
0.867
0.275
0.745
0.026
4.47 1 0.67
0.155
0.739
AdvPara (RADAR)
0.741
0.117
0.777
0.291
0,452
0.009
0.433
4.45
0.79
AdvPara (RoRERTa-I arge)
0.769
0.191
0.827
0.204
0.338
0.009
01400)
0.001
4.4%
0.77
AdvPara (RoBETa-Base 0.769
0.125
0.852
0.332
0.480
0,012
0.481
0.001
4.54 + 0.59
AdvPara
0.338
Table 2: Detection performance of eight different deployed detectors in distinguishing between
Al-generated and human-written text under different attack scenarios. Metrics reported include AUC and TPR at 1% FPR for each detector. Additionally, we present the mean + standard deviation of quality ratings given by GPT-4o. Further details text quality analysis provided in Section 5
based and zero-shot detectors. The superior performance of our attack highlights the importance of the guidance signal provided by trained detector, which effectively steers the paraphrasing to adversarially align with the statistical characteristics of human-authored content.
Universality. We find that adversarial paraphrasing guided by one detector can reduce the detection rates of all the other detectors we consider, showing the universal transferability our method. We also find that any target deployed detector can be evaded by adversarial paraphrasing guided by any trained detectors we consider in our study. We present these findings by plotting the complete transferability matrix in Figure presenting the relative drop in T T@ 1%F for all ceddance-deploymeen combinations of detectors.
Our results show that adversarial paraphrasing is robust to the choice of guidance detectors that we consider in our study. On average, we observe a relative drop in T@ %& of 84.9 84.94% when using MAGE as guidance, 86.89% with RADAR, 80.75% with OpenAI-RoBEERTa-LLnn Although different guidance detectors may yield slightly varying degrees of transferability depending the deployed detector, all our adversarially paraphrased outputs, agnostic
and 87 87.88% with

---

MAGE nan-adv
-17.84%
+8.57%
-32.05%
-38.17%
-69.70%
-37.73%
+15.03%
-73.26%
4 TPR O%APPP (relative)
Guidance Detector
-94.10%
-39.59%
-9%.36%
-93.06%
-89.03%
-64.87%
-95.98%
-98.55%
RADAR
-74.03%
-75.00%
-98.08%
-92.41%
-8.500%
-69.75%
-95.68%
-9..77%
60
RoBERTa RoB ERTa
Base
-61.87%
-35.10%
-100
1.00000
-96.33%
-88.05%
-66.95%
-91.05%
-9.42%%
-80
Large
-81.47%
-64.99%
-100 1.00.00%
100 00%
-87.65%
-70.76%
-96.66%
99.71%
110
MAGE
RADAR
RoBERta Base
RoBERTa Large
KGW WM
Uni WM
Fast DetectGPT
GLTR
Deployed Detector
Figure 4: Relative drop in T@ 1911% 1%% across all combinations of guidance and deployed detectors. The first row corresponds to simple (non-adversarial) paraphrasing baseline [15]. On average, simple paraphrasing leads to a 30.27% relative drop in T@ %%.. In comparison, adversarial para- phrasing achieves significantly higher reductions 84.94 44.94 with MAGE as guidance, 86.89% with RADAR, 80.75% with OpenAI-Rou DDeBAT--oBERTaa Base, and 87.88% with
These
results highlight both the universal effectiveness and transferability of our attack.
of the guidance detector, consistently lead to significant reductions in T @@ 1%F compared simple paraphrasing. This further underscores the universal effectiveness and transferability of our attack.
4.3 Efficiency of Adversarial Paraphrasing
Compared to simple paraphrasing, our method requires running a surrogate Al text detector at each decoding step by design. This naturally raises the question of how much latency this process introduces and whether it affects efficiency.
To evaluate this, we conducted adversarial paraphrasing 100 randomly selected text samples, To simplify measurement and
with five trials per configuration, using all four guidance detectors. report time per-sample basis (rather than per batch), used a batch size of during these trials. In practical settings, including the main experiments described in Section 4.2] employ larger batch sizes, which substantially reduce total runtime. The average paraphrasing time per sample across five trials is reported the mean + standard deviation (in seconde] in T As shown, most guidance detectors introduce only minor latency compared simple paraphrasing. The higher latency observed with MAGE arises from its LongFormer-bee -oased architecture, which requires longer inference time than the RoBERTa -assedd- models.
Method
Run time
Simple Paraphrase
7.18 0.13
AdyPara (roblarge)
10.20 = 0.18
AdvPara (robbusc)
8.64 0.11
AdvPara (mage)
16.71 + 0.74
AdvPara (radar)
9.69 0.20
Table 3: Per-sample run time (in seconds) of adversarial paraphrasing over 100 ran- domly selected samples.
Overall, latency is primarily determined by the computational com- plexity of the guidance detector. From a computational cost perspec- tive, the detector adds minimal overhead in terms of FL.PPs relative the paraphrasing LLM, which dominates total computation. In our experiments, the paraphrasing L.M contains approximatel) billion parameters, whereas the detectors range from 100 350 million parameters- less than 5% of the paraphraser's ' size for the larger detectors and under 2% for the smaller ones.
4.4 Ablation Studies
Other than the guidance detector choice, the two main hyper-paramettenn related to our work are the p and & used in top-p and top-k masking. In the above, we have used p 0.99 and A 50, where 50 also the default i value set in HuggingFace Transformer library. To show how their settings
"Note that runtime per sample may vary with sequence length. To ensure a fair comparison- i..., that AdvPara generates similar number of tokens as simple paraphrasing we report the mean and standard deviation of token counts in Appendix

---

affect our attack, we use OpenAI-RoBERTa- Large as the guidance detector and run abla- tion studies on the value of p and k on 500 ran- domly selected texts. Defaulting to 50 and p = 0.99 when varying the other, we report the mean AUC and TPR @ 1%FPR across all 8 deploy detectors in Table 4
mean AUC
mean
R
Rating
No Attack
0.8419
0.4935
Simple Paraphrase
0.8588
0.2885
4.75 0.51
AdvPara (p=0.5)
0.8606
0.2985
4.86 + 0.45
AdvPara (p=0.8)
0.7895
0,2230
1.79 0.18
Advaara (p=
0.7309
0.1820
4.79 0.48
AdvPara (p=0.95)
0.6816
0.1480
1.81 0.41
AdyPara (p-0.9
0.5433
0.0690
4.50 + 0.67
Fixing i at 50, we can observe that when p ex- ceeds 0.99, the marginal gains in attack effec- tiveness diminish relative the losses in text quality. Additionally, as one can imagine, fur- ther increasing slows down generation speed. Therefore, we select p 0.99 as balanced trade-off among attack effectiveness, text qual- ity, and generation speed. With p fixed at 0.99, the values of & show relatively smaller influence, and mostly lead to comparable results. Hence
AdvPara (p-0.991)
0.5381
0.0592
1.17 0.73
AdyPara (p=0.992)
0.5244
0.0565
4.37 4 0.76
AdvaPar (k=10)
0.5596
0.0757
0.77
AdvPara (k=25)
0.5448
0.0658
4.48 1. 0.73
AdvPara (k=50)
0.5433
0.0690
4.50 0.67
Advaaraa (k=75)
0.5421
0.0698
4.52 0.73
AdvPara (k=100)
0.5426
0.0698
4.51 = 0.70
Table 4: Attack effectiveness under different values of p and k used in top-p and top-k masking. we just stick with the default value in the HuggingFace Transformer library.
5 Quality Evaluation of Paraphrased Texts
We conduct comprehensive evaluation to investigate the im- pact of adversarial paraphrasing on the perceived quality of AI Al-generated text, focusing both semantic equivalence to the original text and clarity, fluency, and naturalness of the text itself. For this, we randomly sample 100 texts each from our three datasets (MAGE, KGW watermarked MAGE, and Uni- gram watermarked MAGE) and analyze them with four comple- mentary studies: (1) perplexity scores (PPL), (2) SBERT [25) semantic similarity, (3) auto-rated quality from GPT-4o com- paring paraphrased texts to their original AI counterparts, and (4) head-to-head win rates, also assessed by GPT-4o, compar- ing adversarial paraphrasing against simple paraphrasing. We provide representative examples of paraphrases in Table with much broader set of examples included in Appendix [F] to support qualitative manual inspection. Our findings highlight nuanced trade-off between evading detectors and preserving textual quality.
Text
PPL. (mean
Original Al
14.94 1 10.40
Original Human
15.02 +: 7.71
Simple Paraphrase
9.28 + 3.86
AdvPara (roblarge)
14:26 1 4.97
AdvPara (robbase)
14.86 1: 6.32
AdvPara (mage)
17.11 + 7.33
AdvPara (radar)
14.26 + 5.13
Table 5: Perplexity (PPL. scores for original Al-generated and human- written texts from the MAGE dataset, along with simple and ad- versarial paraphrased versions of the Al Al-generated texts.
Perplexity Analysis. We assess perplexity using LLaMA-3. 3.-MA--..1-BBB-.. Instruutt [21]. comparing the original Al-generated text, simple paraphrases, and adversarial paraphrases. The results are sum-
marized in Table 5 As shown in the table, human-written text typically exhibits higher per-
plexity than AI text, as human language tends to deviate more from the statistical regularities learned by LLMs. After applying simple paraphrasing, we observe a substantial improvement in the perplexity of Al text. This may be attributed to the fact that the model used for para- phrasing (LLaMA-3.1) is superior to the L.MSs used for gener- ating AI texts in the MAGE dataset (e.g. ILaMA). In contrast, adversarial paraphrasing yields perplexity scores that are com- parable to the human texts from MAGE, which is reasonable given that our objective is to humanize AI texts.
Method
SBERT Cos. Sim.
Simple Paraphrase
0.8601 0.0880
AdvPara (roblarge)
0.8082 =: 0.1006
AdvPara (robbase)
0.8128 = 0.0985
AdvPara (mage)
0.8159 = 0.0982
AdvPara (radar)
0.8095 0.1025
Table 6: Cosine similarity of SBERT embeddings before and af- ter paraphrasing.
SBERT Similarity. A common approach to assessing the se- mantic equivalence between two texts to compute the cosine similarity between their SBERT embeddings (25). Accordingly, we measure the cosine similarity of SBERT embeddings before and after paraphrasing, and compare adversarial paraphrasing with simple paraphrasing. The results are summarized in Table Overall, although there is a slight reduction in the mean cosine similarity for adversarial paraphrasing, the values remain within acceptable range given the high variance observed across samples.

---

MAGE
KGW Watermarked MAGE
Unigram Watermarked MAGE
Average Rating (out ()
1..
2,00
4.5%
4. 11..4
4.71, ts
4 4.71 4
24.
2.244
4.72, 41
4,46
4.91
4.21
4,71,
4.21
RADAR
RoBERTa Base Guldance Detector
RADAR
RoBERTa Lange
Base Guldance Detector
Large
Base Guldance Detector
Large
Simple Paraphrasing
Adversarial Paraphrasing
Unigram Watermarked
100
11
18
10
17
15
25
23
15
24
26
30
60
Number
60
61
20
66
RoBERTa
RoBERTS
RoBERTS
Base
Guidance Detector
Guidance Detector
Guidance Detector
Simple Paraphrasing Wins
Paraphrasing
Figure 5: GPT-40 automated text quality evaluations comparing simple and adversarial para- phrases. The top row shows Likert-scale ratings for overall quality and semantic similarity to the original text. Though slight trade off in text quality can be seen, the error bars show that the difference is not statistically significant. The bottom row presents head-to-head win rates, where in most cases, simple paraphrases outperform adversarial paraphrases less than half of the times.
Auto-Rating with GPT-40. In order to simulate the human perception of text quality (i.c., alignment with the "gold standard" of fluency and coherence), we employ GPT-4o [23], as a judge LLM for automatic quality evaluations [32 [3] with custom system and user prompts (see Appendix G). The judge model is tasked to rate the paraphrases when compared to their original corresponding Al text a Likert scale of 1-5, in terms of quality and semantic similarity. The first of Figure shows the quality ratings for both baseline simple paraphrasing and adversarial paraphrasing. Though observe slight tradeoff in the text quality when compared simple paraphrasing, 87% of the limes-averagee across all three datasets and four guidance detectors- detectors-aaveessari adversarial paraphrases were rated 4 or 5 of (see Appendix H for detailed rating for each guidance detector and dataset). Note that the error bar in the figure shows that this difference between simple and adversarial paraphrasing statistically significant. While adversarial paraphrasing can lead to higher perplexity score when compared to simple paraphrasing, our auto-rater study shows that both the paraphrases have comparable text quality, making our attack a practical one.
Win Rate Analysis. To further compare the quality of simple and adversarial paraphrases, we conduct pair-wise evaluations using GPT-4o consists of simple and an adversarial paraphrase of an Al text, where the judge assigns a win, lose, tie for the paraphrases. As shown in the second of Figure simple paraphrases win only less than half of the time in most cases. This finding reinforces the conclusion that adversarial paraphrasing can effectively evade detection with slight tradeoff in text quality when compared to the prior simple pararaphrasing baseline.
judge compute their win rates (9. Each pair
6 Conclusion
With our comprehensive experiments, we demonstrate that our proposed Adversarial Paraphrasing is a universally transferable and effective attack for humanizing Al-generated text. Our text quality study shows that adversarial paraphrasing can drastically reduce detection rates with slight or no degradation in text quality majority of the time. Our findings underscore the vulnerability of existing detectors in the presence of strong adversary. In the future, we believe our method can contribute to generating adversarial datasets for improving the robustness of trained detectors.
10

---

Acknowledgment
This project was supported in part by grant from an NSF CAREER AWARD 1942230, the ONR PECASE grant N00014-25-1-2378,, ARO's Early Career Program Award 310902-00000 Army Grant No. 2006,, the NSF award CCF2212458, NSF Award No. 2229885 (NSF Institute for Trustworthy AI in Law and Society, TRAILS), MURI grant 14262683, DARPA AIQ grant HR001 12590066, and an award from meta 314593-00001.
References
[1] G. Bao, Y. Zhao, Z. Teng, L. Yang, and Y. Zhang. Fast-detectgpt: Efficient zero-shot detection of puchine--genratte text via conditional probability curvature. arXiv preprint arXiv:2310.051.3, 2023.
[2] J. T. Brassil, S. Low, N. F. Maxemchuk, and L. O'Gorman. Electronic marking and iden- tification techniques to discourage document copying. IEEE Journal on Selected Areas in Communications, 13(8): 495--5044, 1995.
[3] S. Dathathri, A. Madotto, Lan, J. Hung, Frank, P. Molino, Yosinski, and R. Liu. Plug and play language models: A simple approach to controlled text generation. arXiv preprint arXiv:1912.02.64. 2019.
[4] S. Dathathri, A. See, S. Ghaisas, P.-S. Huang, R. McAdam, J. Welbl, V. Bachani, A. Kaskasoli, R. Stanforth, T. Matejovicova, et al. Scalable watermarking for identifying large language model outputs. Nature, (34(8035):8188888) 2024.
[5] J. Fu, S.-K. Ng. Z. Jiang, and P. Liu. Gptscore: Evaluate you desire. arXiv preprint arXiv:2302.04 04166, 2023.
[6] S. Gehrmann, H. Strobelt, and A. M. Rush. Gltr: Statistical detection and visualization of generated text. arXiv preprint arXiv: 04043, 2019.
[7] Gemini Team, Google. Gemini 1.5: Unlocking multimodal understanding across millions of tokens of context, 2024.
[8] X. Hu, P.-Y. Chen, and T.-Y. Ho. Radar: Robust ai-text detection via adversarial learning. Advances in neural information processing systems, 36: 36:15077-15095, 2023.
[9] Z. Hu, Song. Zhang, Z. Xiao, Wang, Chen, Yuan, Lian, K. Ding, and H. Xiong. Explaining length bias in llm-based preference evaluations, 2024.
[10] D. Ippolito, D. Duckworth, C. Callison-Burch. and D). Eck. Automatic detection of generated text is easiest when humans are fooled. arXiv preprint
2019.
[11] A. Q. Jiang, A. Sablayrolles, A. Mensch, C. Bamford, D. S. Chaplot, D. de las Casas, F. Bressand, G. Lengyel, G. Lample, L. Saulnier, L. R. Lavaud, M.-A. Lachaux, Stock, T. Scao, Lavril, T. Wang, T. Lacroix, and W. E. Sayed. Mistral 7b, 2023,
[12] N. Jovanović, Staab, and M. Vechev. Watermark stealing in large language models. arXiv preprint arXiv:2402. 19361, 2024.
[13] S. Kim, J. Suk, S. Longpre, B. Y. Lin, J. Shin, S. Welleck, G. Neubig, M. Lee, K. Lee, and M. Seo. Prometheus 2: An open source language model specialized in evaluating other language models, arXiv preprint arXiv:2405.0155: 2024.
[14] J. Kirchenbauer, J. Geiping, Y. Wen, Katz, Miers, and T. Goldstein. A watermark for large language models. In International Conference Machine Learning, pages 17061-17084, PMLR, 2023.
[15] K. Krishna, Y. Song, M. Karpinska, J. Wieting, and M. lyyer. Paraphrasing evades detectors of ai-generated text, retrieval an effective defense. Advances in Neural Information Processing Systems, 36:27469-27500, 2023.

---

[16] R. Kuditipudi, J. Thickstun, T. Hashimoto. and P. Liang. Robust distortion- watermarks for language models. arXiv preprint arXiv:2307.1559; 2023.
[17] T. Lavergne, T. Urvoy, and F. Yvon. Detecting fake content with relative entropy scoring. Pun, 8(27-31):4, 2008.
[18] Y. Li, Q. Li, L. Cui, W. Bi, Z. Wang, L. Wang, L. Yang, Shi, and Y. Zhang. Mage: Machine- generated text detection in the wild. arXiv preprint arXi::2305.13242 2023.
[19] X. Liang. H. Wang. Y. Wang, Song, Yang, S. Niu, Hu, Liu, Yao, Xiong, et al. Controllable text generation for large language models: A survey. arXiv preprint arXiv:2408. 12599, 2024.
[20] Y. Liu, M. Ott, N. Goyal, J. Du, M. Joshi, D. Chen, O. Levy, M. Lewis, L. Zettlemoyer, and V. Stoyanov. Roberta: robustly optimized bert pretraining approach. arXiv preprint 1699, 2019.
[21] Llama Team, Al Meta. The llama herd of models, 2024.
[22] E. Mitchell, Y. Lee, A. Khazatsky, C. D. Manning, and Finn. Detectgpt: Zero-shot machine- generated text detection using probability curvature. In International Conference Machine Learning, pages 24950-24962. PMLR, 2023.
[23] OpenAl. Gpt-4 technical report, 2024.
[24] C. Raffel, N. Shazeer, A. Roberts, K. Lee, S. Narang, M. Matena, Y. Zhou, W. Li, and P. J. Liu. Exploring the limits transfer learning with unified text-to-text transformer. Journal of machine learning research, 21(140):1663 2020.
[25] N. Reimers and I. Gurevych. Sentence-bert. Sentence embeddings using siamese bert-networks, 2019.
[26] D. Rodriguez, T. Hay, D. Gros, Z. Shamsi, and R. Srinivasan. Cross-domain detection of gpt-2-generated technical text. In Proceedings of the 2022 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, 2022.
pages
[27] M. Saberi, V. Sadasivan, K. Rezaci, A. Kumar, A. Chegini, W. Wang, and Feizi. Ro- bustness of ai-image detectors: Fundamental limits and practical attacks. arXiv preprint arXiv:2310.00072 2023.
[28] V. S. Sadasivan, A. Kumar, S. Balasubramanian, W. Wang, and S. Feizi. Can Al-generated text be reliably detected? stress testing Al text detectors under various attacks. Transactions Machine Learning Research, 2025.
[29] S.S. Sadasivan, S. Saha, G. Sriramanan, P. Kattakinda, A. Chegini, and S. Feizi. Fast adversarial attacks on language models in one gpu minute. Proceedings of the 41st International Conference Machine Learning, ICML'24. JMLR.org, 2024.
[30] I. Solaiman, M. Brundage, J. Clark, A. Askell, A. Herbert-Vosse J. Wu, Radford, G. Krueger, J. W. Kim, S. Kreps, et al. Release strategies and the social impacts of language models. arXiv preprint arXiv: /90..0900999 09203, 2019.
[31] H. Touvron, L.. Martin, K. Stone, P. Albert, A. Almahairi, Y. Babaei, N. Bashlykov, and etal. Llama 2: Open foundation and fine-tuned chat models, 2023.
[32] T. Vu, K. Krishna, S. Alzubi, C. Tar, M. Faruqui, and Y.-H. Sung. Foundational autoraters: Taming large language models for better automatic evaluation. arXiv preprint 4081:2240..18117 2024.
[33] T. Wang, X. Wang, Y. Qin, B. Packer, K. Li, J. Chen, A. Beutel, and E. Chi. Cat-gen: Improving robustness nlp models via controlled adversarial text generation. arXiv preprint arXiv:2010.02338. 2020.
12

---

[34] R. Zellers, A. Holtzman, H. Rashkin, Y. Bisk. A. Farhadi, F. Roesner, and Y. Choi. Defending against neural fake news. Advances neural information processing systems. 32, 2019.
[35] H. Zhang, B. L. Edelman, Francati, D. Venturi, G. Ateniese, and B. Barak. Watermarks in the sand: Impossibility of strong watermarking for generative models. arXiv preprint arXiv:2311.043755 2023.
[36] X. Zhao, P. Ananth, L. Li, and Y.-.. Wang. Provable robust watermarking for ai-generated text. arXiv preprint arXiv: 22.330677733 77499, 2023.
[37] W. Zhou, Y. E. Jiang, E. Wilcox, Cotterell, and M. Sachan. Controlled text generation with natural language instructions, In International Conference on Machine Learning, pages 42602-42613. PMLR, 2023.
13

---

A Comparison with Watermark Stealing
In Section 4 demonstrated the effectivvnnes of adversarial paraphrasing by comparing it against both simple and recursive paraphrasing. In this section, we extend our evaluation by comparing adversarial paraphrasing with the Watermark Stealing attack [12], a targeted approach specifically designed to compromise watermarking methods-und unlike our more general-purpose purpose (universal) attack.
Following the experimental setup proposed by Jovanović al. 112 use the LLaMA2-7B-CHI
model [31, watermarked using the KGW scheme introduced by Kirchenbauer et al. [14] to generate a dataset of 2000 watermarked samples. Consistent with our prior experiments, the model is provided with the first 20 words of each of the 2000 AI Al-generated texts from the MAGE dataset [18] as a
prefix and generates approximately 200 to 600 tokens per sample conditioned on that context. The watermarking parameters match those used in the original watermark stcaling study [[22]. Using the learned watermarking scheme, we then perform scrubbing attack described in the same study, employing both Mistral-7B 11 and LLaMA2-7B 31 as paraphrasers.
1.0
Simple Pereptraingg
Ask rauigh ssing Russalla
Fanyl PADAR
Average Rating (out 5)
4.93
044
20.09
4.P3
4,93
0.44)
Poellive
0.6
1S4 Souting Mibina
Panphroing M4D2
4.28
4.24
0.4
Nardam
noadv
adv
2
0.0
False Positive
AdvPara
WM Stealing LLaMA
WM Stealing
Figure 6: ROC curves illustrating the AI text de- tection performance KGW watermark under different attacks, including simple paraphrasing, recursive paraphrasing, watermark stealing, and adversarial paraphrasing. The false positive rate (FPR) axes is displayed in log-scale to highlight fine-grained distinctions in the low-FPR region. It can be seen that adversarial paraphrasing outper- forms all baselines, including watermark stealing. in pushing the detector's s performance closer to that of random one.
Method
Figure 7: Text quality evaluations using GPT- 4o, comparing watermark stealing and adversar- ial paraphrasing (guided by RADAR (8), which demonstrated the highest attack effectiveness in this case) against simple paraphrasing. The re- sults show that adversarial paraphrasing produces higher-quality text than watermark stealing.
Figure p the ROC curves for KGW watermark detection performance under various attack scenarios, including simple paraphrasing, recursive paraphrasing, watermark stealing, and adversarial paraphrasing. From the ROC curves, can be observed that while adver- sarial paraphrasing guided by cer- tain detectors demonstrates slightly re- duced effectiveness compared to wa- termark stealing in high false posi- tive rate (FPR) regions, it consistently outperforms all baselines in degrad- ing detector performance in the low FPR regime (FPR < 1%). Notably. RADAR ( proves to be the most ef- fective guidance detector in this ting. Table 7
KGW WM
AUC (4)
T@1%F (L)
Rating
Attack
0.999
0.989
Simple Paraphruse Rec. Pura. 2
0.930
0.549
4,93 0.41
0.903
0.478
4.95 0.22
Rec, Pura.
0.889
0.455
4.92 0.34
WM Stealing (Mistral-7B)
0.669
0.167
0.99
WM Stealing (LLaMA2-7B)
0.670
0.161
4,28 0.98
AdvPara (RoBERTa- -argge
0.703
0,073
4.62 0.76
AdvPara MRoBRRaa-Base
0.751
0.132
4.76 +0.53
AdvPara (MAGE)
0.707
0.121
4.84 0.46
AdvPara (RADAR)
0.619
0.045
4.40 0.89
reports the same three key metrics introduced in our Exper- iments section: the Area Under the ROC Curve (AUC), the True Posi- tive Rate at 1% False Positive Rate (T@ FF), and GPT-4o's 's automated quality ratings (Rating). The results
Table 7: Detection performance of KGW Watermark in dis- tinguishing between Al-generated and human-written text under different attack scenarios. Metrics reported include AUC and TPR 1% FPR. Additionally, we present the mean + standard deviation of quality ratings given by GPT-4o. It can be observed that adversarial paraphrasing results in the lowest AUC and TPR @ FFPR after the attack.
14

---

indicate that adversarial paraphrasing guided by RADAR yields the lowest AUC and T@ 1%F values post-attack. Figure 7 further details the text quality assessments for the watermark stealing and adversarial paraphrasing attacks, compared against simple paraphrasing. It shows that adversarial paraphrasing results in better text quality compared watermark stealing.
B Text Token Counts in Efficiency Assessment
The exact runtime per sample may vary depending on the sequence length, which is inherently determined by the length of the input text. To ensure fair comparison-suett that adversarial paraphrasing generates a comparable number of tokens to simple paraphrasing- report the mean and standard deviation of token counts in Table As shown, both simple paraphrasing and adversarial paraphrasing with different guidance detectors produce a similar mean number of tokens. However, adversarial paraphrasing exhibits a larger variance in token counts, reflecting greater variability in output length.
Text
Mean Token Count
Std Dev
Original texts
173.73
38.46
Simple Paraphrase
170.81
39.69
AdvPara (RoBERTa-Base)
175.30
51.27
AdvPara (RoBERTa-Large)
171.25
45.39
AdyPara (RADAR)
169.68
60.07
AdvPara (MAGE)
164.18
54.39
Table 8: Mean and standard deviation of token counts for the original, simple paraphrased, and adversarially paraphrased texts used in efficiency evaluation. All token counts were obtained using the LLaMA-3 tokenizer.
C Detailed Token Statistics for Evaluated Datasets
report the detailed token statisties for all datasets used our main experiments in Table The token counts are obtained from the LLaMA-3 tokenizer.
Dataset
Min # tokens
Max # tokens
Mean # tokens
MAGE human texts
110
305
119
MAGE AI texts
110
525
115
KGW watermarked texts
199
602
~269
Unigram watermarked texts
161
602
~31
Table 9: Token statistics for the texts used in our evaluation, obtained from the LLaMA-3 tokenizer.
D What Happens if Detector Guidance is Not Applied at All Decoding Steps?
In our default configuration, detector guidance applied every iteration of adversarial paraphrasing (Figure This setup achieves high attack effectiveness (Section (42) while maintaining acceptable latency (Section 4.3). In this section, we conduct an ablation study to investigate the impact of applying detector guidance less frequently. Specifically, guidance is applied once every N steps during the auto-regressive generation process of the paraphraser. In this setting, the paraphraser generates N - tokens in a standard (non-adversarial) manner, and the N- N-th token is then sampled with detector guidance. For the guidance detector, we employ SeenAl-RoBERTa-LAA adversarial paraphrasing 500 randomly selected text samples. The resulting mean AUC and TPR @ 1 FPR across all eight deployed detectors are reported in Table I0
and perform
It can be observed that applying detector guidance at every decoding step yields the highest attack effectiveness, while performance gradually decreases as N increases. Nevertheless, even with N adversarial paraphrasing maintains superior attack effectiveness compared to the simple paraphrasing baseline. Moreover, using larger N reduces attack latency, as fewer detector-guided steps are required.
15

---

Method
Mean AUC
Mean T@ % FPR
No Attack
0.8418
0.4935
Simple Paraphrase
0.8588
0.2885
AdvPara (RoBERTa-Large) (N=1)
0.5500
0.0740
AdvPara (RoBERTa-Large) (N=2)
0.6632
0.1333
AdvPara (RoBERTa-Large) (N=3)
0.7266
0.1690
AdyPara (RoBERTa-Large) (N=4)
0.7593
0.1820
AdvPara (RoBERTa-LLarge)
(N=5)
0.7788
0.2115
Table 10: Ablation on detector guidance frequency (N) during adversarial paraphrasing. Results
averaged over deployed detectors. Lower AUC and T@ 1e11% 1%FPR indicate stronger attack effectiveness.
E
Failure Cases and Backfires
While our attack is highly effecttve, it is not always successful on every single sample, and occasional rare. Assuming fixed detection threshold of
backfiring can occur-though such instances 0.5 for NN-based detectors and focusing on the more challenging transfer setting (i.e., different guidance detector pairs), we analyzed total of 24,000 samples.
Out of these, 5,742 samples exhibited an increase in detection score after paraphrasing. Among them:
1,773 examples were already flagged as Al-generated before paraphrasing. In these cases, the attack simply failed to help.
2,974 examples were classified as human both before and after paraphrasing, meaning they consistently evaded detection-thus the attack did not worsen the outcome.
995 examples were originally classified as human but crossed the 0.5 threshold after para- phrasing, resulting in a backfire where the paraphrased text was more likely be detected as Al-generated.
In summary:
The attack failed in 1,773 cases (~7.4% of all samples).
It backfired in 995 cases (~4..1%% of all samples).
Despite these occasional failures, method consistently outperforms baselines in reducing AUC and T@ 1%F, as demonstrated in our results. Such failures are expected in adversarial settings but do undermine the overall robustness, effectiveness, or transfcrability of our approach.
F More Examples of Paraphrased Texts
Tables 12 through 18 present additional examples of original Al-generated texts along with their corresponding simple and adversarial paraphrases, the latter guided by OpenAA-RoBBRRTa-Laagg (30].
Tables 12 to 15 include examples in which both simple and adversarial paraphrases received rating
of 5. Table 16 shows instances where the simple paraphrases received rating of 5, while the
adversarial paraphrases received a rating of 4. For these cases, we also include the justification provided by GPT-4o for the score assigned. Tables 17 and 18 presents examples where neither the simple nor the adversarial paraphrases achieved a rating of Justifications from GPT-4o are again included for these examples.
Across 100 simple paraphrased texts, 76 received rating of 5, received rating of 4, and 7 received rating of 3. For the 100 adversarially paraphrased texts, 64 received rating of 5, 21 received rating of 4, 14 received rating of 3, and received a rating This shows that simple and adversarial paraphrases result in comparable text quality.
16

---

G System and User Prompt for GPT-4o Quality Rating and Win-Rate Judgment
We configure GPT-4o as a text quality rater using the system prompt shown in Figure g and as a win rate judge using the system prompt shown in Figure 9 The prompt for quality rating is shown in Figure 10 and the user prompt for win rate judging is shown in Figure
are an expert linguist and paraphrase evaluator. Your task to assess the quality a paraphrased compared to the original source text. Use following scoring criteria:
5 Approximately equivalent: Mcaning is preserved; differences only in wording structure.
4 Nearly equivalent: Meaning is mostly preserved; minor factual details differ.
3 Somewhat equivalent: Some meaning preserved; important details or meanings differ.
2 Topically related: The texts are on the same topic but most meaning is lost.
1-No Not topically related: The texts are not related in topic or meaning.
Provide your final output as JSON object in this format:
"score": <score from 1 to 5>, "justification": "<brief explanation
Figure 8: The system prompt used to configure GPT-4o quality for evaluating the quality of paraphrased texts.
You are neutral and highly capable evaluator. Your task is to compare two versions of text and select the one that communicates the ideas more clearly, accurately, and fluently. Consider:
-Fielity of meaning (how clearly the core message is conveyed)
Clarity conciseness
Grammatical correctness and fluency
Naturalness and appropriateness of phrasing
Give your vote solely based on quality. one of them is a CLEAR winner, ONLY then vote for that one. Otherwise, vote for "tie".
Respond with * **nnly one of the following** and nothing else: textl
text2
tie
Figure 9: The system prompt used to configure GPT-4o as win-rate judge for comparing the quality of simple and adversarial paraphrases.
Evaluate the following paraphrase using the criteria above:
Original Text:
<original text>
Paraphrased Text: <paraphrased_text
What (1 would you assign this paraphrase, and why?
Figure 10: The user prompt for querying GPT-4o for the quality ratings.
17

---

Compare the following two texts and give your vote depending on meaning clarity, fluency, and overall quality. If one of them is CLEAR winner, ONLY then vote for that one. Otherwise, vote for 'tie". Respond with one of these options: "textl', 'text2', 'tie".
Text 1: <textl>
Text 2: <text2>
Figure 11: The user prompt for querying GPT-4o for win rate judging.
H Detailed GPT-4o Ratings for All Detectors and Datasets
In Table we report the detailed GPT-4o quality ratings (mean + std) and the pereentage of high-quality scores (ratings 4 and 5) for all paraphrased outputs across the three datasets involved. can be observed that while adversarial paraphrasing leads to a slightly lower average quality rating compared to simple paraphrasing, the difference datasets and guidance detectors, 87% of the adversarially paraphrased texts received quality rating of or 5.
statistically significant. average, across all
Original Text
Guidance Detector
Avg. Rating (mean std)
Rating 5&4 (in %)
Simple Para.
AdyPara
Simple Para.
AdyPara
mage
4.54 :: 0.70
88%
radar
4.45 + 0.80
85%
MAGE
4.71 + 0.61
92%
robbase
4.54 +: 0.59
95%
roblarge
4.48 = 0.77
85%
mage
4.63 0.63
94%
radar
4.24
79%
KGW Watermarked MAGE
4.72 = 0.70
92%
robbase
4.41 0.83
86%
roblarge
4.46 1: 0.81
86%
mage
4.41 = 0.94
85%
radar
4.21
82%
Unigram Watermarked MAGE
4.71 1 0.59
95%
robbase
4.39
86%
rohlarge
4.71 4.45
93%
Table 11: GPT-4o quality ratings (mean + std) and percentage of high-quality scores (ratings and 5) for outputs rewritten using different guidance detectors. Ratings are split across simple and adversarial paraphrase scenarios.
Computation Resources
We utilize two NVIDIA RTX A6000 GPUs host both the paraphraser language model and the guidance AI text detector. Notably, since our approach is compatible with any instruction-tunct language model for paraphrasing and any neural network-based AI text detector, the computational requirements may vary depending on the specific models used.
18

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
The abstract and introduction clearly describe the core contribution (i.e., Adver- sarial Paraphrasing) and its use of detector-guides LLM evade Al text detectors. They accurately reflect the paper's empirical focus, effectiveness, and transferability demonstrated through extensive experiments.
Justification:
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should clearly state the claims made, including contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results be expected to generalize other settings.
It is fine include aspirational goals as motivation long is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
We discuss the text quality tradeoff our attack poses. Though majority of the cases our method achieves high text quality post-attack, in rare cases the text quality can be worse.
Justification:
Guidelines:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low or images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed not penalize honesty concerning limitations.
3. Theory assumptions and proofs
19

---

Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [NA]
Justification: This work is purely empirical and does not include theoretical findings or formal proofs.
Guidelines:
The answer NA means that the paper does not include theoretical results. All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced in the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Does the paper fully disclose all the information needed to reproduce the main perimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Question:
Answer: [Yes]
The paper provides detailed configuration and parameters used for the ad- versarial paraphrasing, AI text detectors, datasets, and baselines, Section 4.1. full explanation of the proposed method is provided in Section 3.
Justification:
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken make their results reproducible verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to model. In general. releasing code and data often one good way to accomplish this, but reproducibilityy can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, other means that are appropriate to the research performed.
specific model and empirical evaluation, may
While NeurlPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make it clear how reproduce that algorithm. (b) If the contribution is primarily the architecture clearly and fully.
model architecture, the paper should describe
(c) the contribution is a new model (c.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open- open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome describe the particular way they provide for reproducibiliity In the case of closed-source models, it may be that access to the model is limited in
20

---

some way (e.g., to registered users), but it should be possible for other researchers have some path reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [Yes]
Justification: The paper employs publicly available Al text detectors and datasets. The complete code for replicating the experiments-includee attack methods, dataset generation, and evaluations- provided in the supplementary materials.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips.cm
oonooiicn))l for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https
/
CooeeSumeeeeeeeeeeeeee ssi oooooonyolllolloooooooooomiiiill for more details.
The authors should provide instructions on data access and preparation, including how access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing much information possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: Section 4.1 and the appendix provide comprehensive details of the experimental setup. including adversarial paraphrasing parameters (e.g., top-p and top-k), the number of samples used for evaluation, and the methodology for generating the watermarked datasets.
Guidelines:
The answer NA means that the paper does include experiments.
The experimental setting should be presented the core the paper to level detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, supplemental material.
7. Experiment statistical significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [Yes]
Justification: Yes, report error bars for the quality evaluation metrics we present in plots and tables. For the main proposed algorithm, we provide multiple ablation studies to show their advantages consistently.
Guidelines:
21

---

The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by enror bars, confi- dence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.
The factors of variability that the error bars capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
should be clear whether the error bar is the standard deviation or the standard error of the mean.
It is OK to report 1-sigma error bars, but should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not show in tables figures symmetric error bars that would yield results that are out of range (c.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification:
We provide our compute resource details in the Appendix.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make into the paper).
9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurlPS Code of Ethics https::/neurips.. htt.aaawwwp....p..u.c//ttttaaaaa
Answer: [Yes]
Justification: Yes, the research fully complies with the NeurIPS Code of Ethics. It is conducted to rigorously evaluate the robustness of AI text detectors in a controlled setting, with the goal of promoting safer and more resilient detection systems through transparent and responsible experimentation.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (c.g.. if there special consid- eration due to laws or regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative socictal impacts of the work performed?
22

---

Answer: [Yes]
Justification: We discuss the existing vulnerabilities of Al text detection tools that may have potential socictal impacts. Our work pointing out the pitfalls of these systems can positively impact the community be cautious. Moreover, method could be potentially used to adversarially train new robust detectors, positively impacting the community.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No. they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out, For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning conrectly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional unintentional) misuse of the technology.
there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification: This work does not release any new models or datasets that pose high risk of misuse. All experiments are conducted using publicly available language models and detection systems, along with established open-source benchmarks.
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper. properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
23

---

Justification: All datasets (e.g.. MAGE), Al text detectors (e.g.. RADAR, OpenAl- RoBERTa), the model used for rephrasing (LLaMA-3.1), and the quality evaluator (GPT-4o) are properly cited and used in accordance with their respective usage terms and licenses.
Guidelines:
existing assets. The authors should cite the original paper that produced the code package or dataset.
The answer NA means that the paper does
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (e.g.. CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should provided.
If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, pwpesssipppeeeeeeeee thcode. coodssttett has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
this information is not available online, the authors are encouraged to reach out to the asset's 's creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification: This paper does not release any new datasets or models.
Guidelines:
The answer NA means that the paper does release new assets.
Researchers should communicate the details the datasct/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
Crowdsourcing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?
Answer: [NA]
Justification: No human subject research or crowdsourcing is conducted.
Guidelines:
The answer NA means that the paper does not involve crowdsoureing research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
Institutional review board (IRB) approvals or equivalent for research with human subjects

---

Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: The work does not involve human participants and does not require IRB approval.
Guidelines:
The answer NA means that the paper does involve crowdsourcing nor research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, not include any information that would break anonymity (if applicable), such as the institution conducting the review.
16. Declaration of LLM usage
Question: Does the paper describe the usage LLMs if is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, or formatting purposes and does not impact the core methodology, scientific rigorousness, originality of the research, declaration is not required.
Answer: [Yes]
Justification: Yes, the paper describes a non-standard and original use of LLMs as a core component of the proposed method. Specifically, employs instruction-tuned LLM in novel detector-gut setector-guided paraphrasing framework to generate adversarial examples that evade AI text detectors.
Guidelines:
The answer NA means that the core method development in this research does not involve L.MMs as any important, original, non-standard components.
Please refer to our LLM policy for what should or should not be described.
25

---

Text
Rating
Original AI Text. Automatic sottware plagiarism detection tools are widely used educational settings to ensure that submitted work was not copied. These tools have grown in use logether with the rise in online learning and students lrequennly submit papers electmoniaalyy using these services, which autornticalll analyze content for similarities hetween their own creations and those of other users. While this approach does idcntify some instances where service has detected unauthorised usage of its products, it can miss many cases especially when there no clear pattern or similarity acroes different sources. overcome the problem of false positives for both low-quality original content as well as plagiarized content from third parties, today's research team led by Scott Pleiffer at MIT created an automated system that prodicts whether plagiarism is likely based on several factors including: how similar two web pages uppear: what text they shure: how eusily their content resembles each other, if neither source appears to he a trusted authority; and the strength of a paper's 's author citation record. The resulls suggest that plagiarism may occur more often than previously thought.
Simple Paraphrase. In the of digital leurning, the widespread use of educational software has led surge the aduption of plagiarism detection tools to verify the originality of student submissions. These automated services have hecome increasingly prevalent, particularly with the rise of online learning, where students frequently submit electronic assignments. While these tools have been effective in identifynng some instances of unauthorized use, they are not foolproof and may overlook cases, espocially when there is no apparent pattern or similarity between sources. To address the issue of false positives for both low- low-quality original content and plagiarized work from third parties, team of rescarchers at MIT. led by Scott Pfeiffer. have developed an innovative system that predicts the likeláhood of plagiarisa bused on several key factors, including the visual similarity web pages, shured text, content resemblance, the record. The findings suggest that plagiarism may be more widespread than previously assumed.
5
of sources, and the strength of author's 's citation
Adversarial Paraphrase. As online education expunds, plagiarism detection soflware has become an essential tool to ensure original work heing submitted hy students, With more similarities, flngging suspicious matches with existing sources. However, relying solely on similarity checks can be incomplete, missing cases without distinctive patterss duplicates. Researchers led by Scott Pfeiffer MIT have designed an innovative system that goes beyond this approach. This system takes into account range of factors, such as weh page visual similarity. shared content, and content resemblance. to predict whether plagiarism has occurred. It also cousiders the trustworthiness of sources and authors' citation records, According lo the study, plagiarism might be more prevalent than initially thought, highlighting the need for advanced methods to lackle this issue effectively.
5
submitted electrnically, software analyzes the content for
Original AT Text. It was the day of the Manli Gras floal parude and all of the children in the neighhorhood were excited to see the colorful floats and costumes. But little girl, Sadie, while everyone else was out having fun. Sadic's as mom tried to make her feel better by putting on Mardi Gras mask and giving her headed necklace. but it was just not the same as being there. Sadie lay in her bed, watching the parade go by, when suddenly had an iden. She got out of bod and went to the window, Her mom had left the ladder out she could reach the top of the float. Sadie climbed up and found hersell right in the middle of the parade! She waved to all of her friends as they passed by. and they
not foeling well. She had chicken pox and was stuck home
surprised to her. Simple Paraphrase, As the vibrant Mardi Gras parade unfolded in the noighbothood. the children's ' excitement was palpable. But amidst the revelry, one young girl. Sadie, was confined to her home, her enthusiasm dampened by a bout of chicken pox. Her mother attempted to lift spirits by donning a Mardi Gras mask and hestowing a beaded necklace, yet the experience seemed bollow without the actual parade. Sadie's ss gaze drifted out the window, where she spotted the colorful floats g gliding by, and inspiration struck. She sprang from her bed, seized the opportunity presented by ladder left behind by mother. and climbed up to the window sill. As she reached the top, Sadie found herself in the midst of the parade, surrounded by the festive atmosphere she had bcca missing. With a beaming smile, she waved to her friends as they passod, their faces aglow with surpris. Despite missing the parade itselt, Sadie's impromptu adventure turned to be the most unforgettable Mardi Gras experience of all.
the best Mardi Gras ever, even though she did have to miss the purade itsell.
Adversarial Paraphrase. As Mardi Gras floats rolled down the streets, excitement radiated through the neighborhood. infecting children with its contagious energy. Except for one little girl. Sadie, who lay bedrisden with chicken pos, watching the culorful spectacle from afar. Her mom endeavored to console her, adorning Sadie with a festive mask and a beaded necklace, but the youngster yearned for more. It wasn't it until brainstorm struck Sadie that her confinement transformed into an impromptu adventure, Scizing the moment, she quictly elimbed the ladder outside and discovered herself at the very conter of the Mardi
5
glee, waved memily to friends and acquaintances, their stunned faces etched with surprise. minedd our to be an unforgettable Mardi Gras experience, even if shc' 'd had to forgo the initial procession itself.
Gras parade! Overcome
Original Al Text. In 2000, ABC launched a web-based promotional campaign focused around its circle logo, also called "the dot," in which comic book churacter Little Dot prompted visitors to "downloud the dot," which was free screensaver. The promostoonal campaign utilized both online and offline elements, including lelevision ads and interactive wehsite featuring game called "Dor Dodge. The on-air spots featured Little Dot, a 3-D animated character that urged viewers to download the dot from the ABC website. The site offered the ability to customize the det with photos, quotes, and music. Additionally. users could play the Dot Dedge game in which they had to dodge obstacles as they moved around a maze. The campaign was successful in driving significant web traffic to ABC's website, as well as increasing positive brand awareness and engagement. It also won several awards. including Golden Beacon Award for Best Use of Interactive Technology and an Outstanding Achievement Award from the International Academy of Digital Arts Sciences.
Simple Paraphrase. 2000 marked a pivotal year for ABC, as they launched a groundbreaking promotional campaign centred around their iconic circle logo, affectionately dubbed "the dol". The initiative involved multifaceted approach. combining online and offline elements to create a memorable experience for audiences. The campaign's centrepiece was a 3D animated character, Little Dat, who encouraged viewers to downlond the dot, free screensaver, also alkowed users to personalize the dot with their preferred images, quotes, and music. Furthermore, the campaign featured thrilling game, Dot Dodge, where players navigated a maze while avoiding obstacles. The campaign's 's success was evident in the significant surge in website traffic, enhanced brand recognition. and increased engagement. It also garnered widespread acclaim, D
5
the ABC wehsite. The interactive site
carning prestigious awards such as the Golden Beacon Award for Best Use of Interactive Technology and the Outstanding
Achievement Award from the International Academy of Digital Arts Sciences.
Adversarial Paraphrase. In 2000, ABC rolled out an immersive campaign centred on its iconie circular logo, affectionately known as "The Dor", At the heart of this initistive was Little Dot. a cartoon character encouraging visitors to 'collect The Dot', a complimentary desklop screensaver. Levernging both digital and offline stralegies, the campuign spanned TV commercials, an interactive wehsite featuring the addictive game 'Dor Dadge', and offline elements. These eeeeeeye--aeee eye-catching TV spots introduced viewers to Little Det, a three-dimensional animated protagonist persunding them to download The Dot from ABC's website. Visitors could personalise The Dot by uploading photos, quotes and music. The site also allowed users to indulge in Dot Dodge, navigating through a challenging obstacle course. The campaign generated impressive web traffic for ABC's s wehsite, accompanied by enlsanced brand recognition and engagement, Notably, it won accolades like the Golden Beacon Award for Best Use of Interactive Technology and the International Academy of Digital Arts Sciences" Outstanding Achievement Award.
5
Table 12: Examples of original Al texts with their simple and adversarial paraphrases (guided by OpenAI-RoBERTa
30) GPT-4o quality ratings are provided for each paraphrased version.
26

---

Text
Rating
Original Al Text. If addiction is a disease, why do most addictions cnd spontancously, without treatment? Why did some 75 of beroin-addicted Vietnam vets kack the drug when they returned home? It's hard to say exactly why some addictions end spunianevosly without treaiment. It is possible that the person was motivated to change their behavior and developed the necessary coping skills do so. It could also he due to other factors such as external support from friends and family, positive reinforcement from professionals, or simply a change in cnvironment. The Vietnam vets may have had a strong desire to leave the drug hehind and retur to their normal lives. Additionally, they likely faced much different enviroment upon returning home which provided them with fewer opportunities to use the drug.
Simple Paraphrase. The puzzling phenomenon of spontaneous recovery from addiction has left many wondering why most addictions tend to resolve on own without professional intervention. instance, it's striking nearly three-quarters of heroin-addieted Vietnam veterans were able to overcome their dependence on the drug upon returning home. While it's challenging to pinpoint the exact reasons behind this phenomenon, several factors might have contributed to their success. Perhups the individuul question were driven to reform their hubits and developed the necessury skills to do Alternatively. external support from loved ones, positive reinforeement from professionals, or a change in environment could have also played a role. the case of the Vietnam vets, their strong desire reintegrate into civilian life and leave their addiction behind might have heen powerful motivator. Furthermore, the vastly different environment they returned to, which affered fewer opportunities to use the drug, may have also been a significant factor in their ability to overcome their addiction.
5
Adversarial Puraphrase. Despite addiction heing likened a disease, a puzzling phemomenon exists where many addictions naturally dissipute without treatment. Take, for instance, the high proportoo of Vietnam veterans addicted tn hemiin who miraculously kicked the habit upon returning home. There no clear explanation as to why this happens. Perhaps individuals simply resolved change their behavior. cultivating the necessary life skills overeome addiction. It's also plausible that external influences played a role, such as the emotional support of luved ones. motivational reinforvement from medical professionals,
altered environment. It's possible that the vets simply longed to distance themselves from the drig and reclaim their pre-war way of life. The sudden change in environment upon returning home also limited their opporunities to continue using drug.
movies. awesome ghillie suit, no harcode tattoo on your bald-ass head. You just have to know how shoot and kill people." " He said he doesn't II want his new show "to about being an assassin' but rather showing that it could happen today. But when it comes to killing someone who so powerful, it still has its challenges. Lumigren suid: "You the same mindset. the same commitment and dedication to get through it or survive hecause it's going to end differently than any myyooy expects."
Original Text. It's funny. Being a hirman nothing like what you
prepure for something big as this. It lakes everybod, body with
about homed skills and precision, rather than dramatic getups and tattons. The conversation tumned to his latest show, which he em emphasized is not about heing
Simple Paraphrase. It's far cry from the cinematic portraaals of hitmen. The reality
asassin, but rather realistic portrayal what could huppen koday's 's world. However, even in the face of taking down a powerful target, there are si significant challenges to overcome. I Landgren noted that "you can't prepare for something of this magnitude. demands a united front, a shared commitment and dedication to overcome the obstacles and emerge unscathed, as the outcome is always unprodictable." "
Adversarial Paraphrase. Contrary to cinematic portrayuls, the reality of heing hirman is surprisiggyy unglamorous, Forget claborate disguises or conspicuous taltoos; success hinges on proficient marksmanship and the capacity for cold-bloodedness. Lundgren candidly reveals his latest project aims could unfold in today's 's world. However, he cuncedes that even when dealing with high profile targets, formidable challenges fully prepare you for the scope and complexity such massive undertaking," " he says, "It demands unwavering unily of purpose and unwavering commitment among all parties invulved, lest it unfold in ways one can predict, leaving few with any sense closure." "
5
glamorize assassination but ruther to humanize the very possibility that
still arise. "Nothing
Original Text. Various MicmRNAs (miRNAs) counteract viruses present in hosts can decrease replication simian immunodeficiency virus (SIV). Several research studics have shown that certain miRNAs, namely miR-28. miR- 125b. miR-1100 and miR-223, possess the potential to inhibit the replication of SIV. The degradation of SIV viral RNA or the inbibition of its translation, which reduces viral replication, is caused by the hinding (3UUT) of SIV by four MiRNAs. The interaction between SIV and its host is not simple, as other cellular factors and pathways play role controlling viral replication that should be considered. Additionally, further investigation the involvement of these miRNAs in the replication of HIV.1 (human immunedeficieccy vinus type 1) that has strong similarity to SIV. To sum up, although miR-28, miR- 125h, miR- 150, and miR-223 are capahle of reducing SIV replication through direct means, the regulation of the virus is complicated process that involves a variety of host and viral factors.
specific largets the untranslated region
required to examine
Simple Paraphrase. Research has revealed that several micmRNAs, including miR 28, 1iR-1 1550-150. and miR 223, 5 possess the ability to impede the replication the simian immunodeficiency virus (STV) by targeting spocific sequences in the untransiated region of the virus. These miRNAs can either degrade SIV viral RNA or inhibit its translation. thereby diminisshing viral replication. However. the interplay between SIV and its hos is comples, involving various cellular factors and pulhways that modulate viral replication. Furthernoree the role of these miRNAs the replication of human immunadeticiency virus tyne I (HIV-I), which shares significant similarities with SIV, warrants further investigation. In summary, while miR-28, miR- 125b, miR-150. and miR can directly restrict SIV replication, regulation of the virus is multifaceted process influenced by both host and viral factors.
Adversurial Paraphrase. Numerous miRNAs have been discovered that counteract viruses infecting best cells, leading to the dimination of the replication namely, miR-28, miR- 125b, m5R-150, and miR-223- which exhibit inhibitory effest on SIV replication. Through binding to specific targets within the 3' untranslated region of SIV RNA. these miRNAs orchestrate the degradation or inhibition of SIV translation, subsequently curtailing viral replication. Notably, the intricate interaction between SIV and its hust necessilates the consideration of multiple cellular factors and pathways geveriing viral replication. Furthemmoee, comprehensive andly sis is essential determine the extent the role these miRNAs play the replication of human immunodcficieney virus type (IIV-I), 1), given the similarities it shares with SIV. Ultimately, while miR 28, miR 125b, miR 150, and miR 223 effectively curh SIV replication directly, the regulation the virus remains complex process entailing maltiple host and viral factors.
5
simian immunodeficiency virus (SIV). Investigations have pinpointed several miR NAs
Table 13: Examples of original AI texts with their simple and adversarial paraphrases (guided by OpenAl-RoBERRaaLLnn 30) GPT-40 quality ratings are provided for each paraphrased version.
27

---

Text
Rating
Original AT Text. hope there good reason for Steve flake his appointment for window tinting. Attempted to contact him multiple times with no answer and no return call. I'm sorry to hear that Steve missed his appointment without any notification. Perhaps there was an emergency or something important came up he had to deal with. However, would have been courtcous of him to inform you beforehand. If you still have his contact information, you may try reaching out to him one more time to see he would like to reschedule or if there was anything you could do to help.
Simple Paraphrase. It's disheartening to out that Steve cancelled his window tinting appointment without any prior notice explanation. Despite making repeated attempts to reach out to bim, was met with silence. While I'm willing to give him the benetit of the doubi, assuming an unforeseen circumsttance might have arisen, I do think would have been considerate of him atlempt connect
communmiaate his change of plans earlier. you still have his contact details, may be worth with him and explore the possibility of rescheduling or offering assistance if needed.
Adversarial Paraphrase. Regrettably, seems that Steve failed honor his commitment for window tinting Despite making repeuted efforts reach him, my calls went unanswered and received callback, It's disheartening to think that he skipped his scheduled appointment without prior notification. Although unforeseen circumstances might have arisen. do think it would have
5
been polite him notily me ahead of time. you have his contact details, would suggest atlempting to establish
contact one final time to either reschedule the appointment or see if there's 's any assistance I can offer him in his time of need.
Original AT Text. The Waking the Dragon tower was granted permission by Wrexham council back in Fehruary 201 I.
Businessman Simon Wingett is trying to raise PS2.5m to baild the bronze sculpture, cultural centre and entertainment complex
site next year's ' Great North Run linish line at Llangollen. With three days of bidting remaining for Britain's most prestigious
art prize Art Fund Prize 2013 it has been announced that the winner will receive 100.000 plus an award worth around 15,000
from Arts Council Fngland (ACF). The runners up each receive prizes of betweon 7,500 and 10,000 from ACE. In total, the
awards for all nominated works are worth over 450,000.
Simple Paraphrase. In significant development, the Waking the Dragon lower project received the green light from Wrexham council February 2011. Entrepreneur Simon Wingett now working to secure substantial PS2.5 million investment to consiruct a bronze sculpture, cultural huh, and entertainment complex on the site of next year's s Great North Run finish line in Llangollen. With only a few days remaining to suhmit bids for the prestigions winner will receive a staggering 100,000-pound prize, accompanied by an additional 15 15,000-pound award from Arts Council
Fund Prize 2013, it has been revealed that the
England, The cunners-up will receive prizes ranging from 7,500 to 10,000 pounds from ACE, totaling over 450,000 pounds in awards for all nominated works.
Adversarial Paraphrase. In 2011. Wrexham council greenlit the ambitious project known the Waking the Dragon tower. Developer Simen Wingett aims to raise P52.5m to construct a striking bronze sculpture, a multifaceted cultural hub, and entertainment destination at the iconic location marking the finish line of the Llangollen Great North Run year. Meanwhile, the countdown has begun for the 2013 Art Fund Prize. with just days to go before the winner is announced. The esteemed accolade, valued PS100,000, complemented an additional prize worth around 15,000 Arts Council England (ACT). Runners-up will receive awards ranging from PS7,500 to PS 10,000, tocalling combined value of over PS450,000 for all nominated works.
Original Al Text. One the challenges in large-scale information retrieval (IR) to develop fine-grained and domain-spocific methods
natural language questions. Despite the availability of numerous sources and datasets for domain specilic IR (DS IR), most DS IR techniques rely on supervised muchine learning techniques. Therefore, approaces that are capable of utilizing unlabeled data DS-IR can of particular interest. To that end, propose the power of unsapervised leurning to capture domain specific patterss and structures. The propused framework consists of three main components: an unsupervised learning algorithm to automatically discover the hidden patterss and structures from the target DS-IR domain, model incorporate these structures to the IR process, and scoring mechanism for the retrieved docureetts. We present experiments on two different DS-IR domains: biomedical and patents. We report results for two diffcrent evaluntion measures, which indicate the ellectiveness of the propused approuch.
DS-IR approach that exploits
Simple Paraphrase. In the realm of large-scale information retricval, crucial challenge lies in developing tochniques that accurately address complex, domain-specilic queries. Despite the abundance of datasets and sources available for demain-specilic IR, most existing methods rely supervised machine learning approsuches. However, exploring the potential of unsupervised learning techniques in this domain can he a valuable direction. To address this gap, we introduce a novel DS-TR approach that humesses the power of unsupervised learning uncover domain specific patterms and relationships. three key components: pattern discovery module that nutomatically identifies hidllen structures in the target domain, strictural intogration module that incorporates these patterns into the IR prosess, and a scoring mechanism that evaluates the retrieved docurents.. We demonstrate the effectiveness of approach through experiments two distinct DS-IR domains: biomedical and patents, using two evaluation metrics.
framework comprises
Adversarial Paraphrase. Hamesssing the potential unsupervised machine leamning critical challenge the largo-scale information retrieval domain, where line-tuned, domain specific solutions are desperately needed to effectively answer complex natural language queries. Despite the wealth of readily available datasels for domain specific IR, many prevailing approaches sill rely heavily supervised machine learning methodologies. Recognizing the untapped potential unlaheled data, novel donuin specific IR technique leverages the power of unsupervised learning to distill unique pullens and struciures peculiar to specific domains. Comprising three key components. unsupervised algorithm to automatically unearth these domain-specinf specific patterns, framework to intograte them seamlessly into the retrieval process, and scoring mechanism to gauge retrieved document relevance- - our approach promises to revolutionize the DS-IR landscape. Experimental evaluations across two distinct domains, biomedical and polents, validate the elfectiveness evaluation metrics.
5
proposed technique through robust performance various
Table 14: Examples of original AI texts with their simple and adversarial paraphrases (guided by RoenAI-RoBERTa Large 30).. GPT-40 quality ratings are provided for each paraphrased version.
28

---

Text
Rating
Original AI Text. United Methodist Church organized into conferences. The highest level called General Conference and is the only organization which may speak officially for the church. The Generl Conference also includes all of us who have been ongaged in ministry or are involved in ministry, whether we know it or not. Our Mission To serve as a spiritual church that is grounded with values and pupose. We betieve that every individual has the right to participate in God's plan for His worshiping people through a Divine Word; we strive to inspire not only those who listen to our prayers but those who go out and pray with their hearts as well.
Simple Paraphrase. The United Methodist Church structured into conferences. with the General Conference serving as the supreme governing body that represents the church's is official voice. This assembly encompasses all individuals who have dediented
ministry, whether actively involved or not. Our fundamental purpose to function as spiritall community rooted in values and direction. We uphold the notion that every individual has the privilege to participate in God's plan His people, as revealed through sacred text; our aim is to not only move those who hear our prayers hut also to empower those who respond with heartfelt devotion.
Adversarial Paruphrase. Within the United Methodist Church, the organisational structure revolves around conferences, with denomination. Beyond its
5
the General Conference standing as the highest ochelon and the only authoritative voice members, the General Conference encompasses vast, invisible community encompassing everyone touched by the chureb. regandless of their awareness or direct involvement. At its core, our mission is to be a spiritually nourishing church buill upon fimm values and purpose. We fimmly believe that each individual possesses a vital mle play the grand plan for the collective worship of God, factlitated throgh the Holy Word; accordingly. our mission extends not only to those who attentively listen to our prayers
those who pray with unwavering dedication in their hearts.
Original Text. DiDI's co founder and president Jean Liu close associates that she plans to step down as she expects the government to eventually take over the company and appoint new management. Photo: Bloomberg Didi Chuxing co-founder to step down from management Jean Liu, co-founder and president China's is ride-hailing giant Didi Chuxing. plans to step down from management and will focus the company's strategy and business development. Reuters reports, citing people with knowledge of the matler. Didi has heen heset by series of high profile scandals, inchuding the murders of two of its customers. string of safety mensures. Didi's former president,
It has since made major changes to hailing husiness and rolled Liu Qing. also left the company last year after one of the murders. Liu, who has boen with Didi since 2014, told close associates over the company and appoint new management,
that she plans to step down she expects the govermeent to eventually the report said, Didi's co-founder, Cheng Wei, currently serves chicf exocutive.
Simple Pa Paraphrase. According to sources close to the matter, Jean Liu, co founder and president of Didi Chuxing, is poised to relinquish her management role, with the expectation that the government will assume control of company and install new leadership team. This decision comes amid tumultuous period for the Chinese ride-hailing giant, which has faced series of high-prolile controversies, including the tragic deaths of two customers. In an effort to restore public trust, Didi has implemented range of safety measures and revamped its ride hailing business model. The company's former president, Liu Qing, departed last year following one of the murders. Lin, who has heen with Didi since 2014, reportedly plans to focus on strategy business development, leaving the reins to Cheng Wei, the company's 's co- coufdrr and current, chief' executive.
5
Adversarial Puraphrase. According to credible sources, DiDi Chuxing co founder and president Jeun Liu intends to rel relinquish her executive responsibilties and devote more time to charting the company's ' strategic direction and exploring business opportunities, The move follows a series of high profile controversies, including two tragic incidents well as significant overhauls and safety measures implemented to revamp the ride-hailing service. Interestingly, Liu's in's decision coincides with her own personal transition out of the executive ranks, ochoing a similar path taken by her prodecessor, Liu Qing. who parted ways with DiDi after deadly incident last year. Interestingly, Liu Qing had also left her role as president following a fatality connected to DiDi, Jean Liu's intention to step down, sources close to the maller claim, is premised on a lacit understanding that the Chinese government will assume control and appoint management.
resulted in fatalities, as
Original AT Text. Susan had always wanted learn how play tennis. She excited when she offered at the local park. She signed up and was ready to start learning. On her first day, she met her instructor who showed her basics playing tennis. He taught about proper form, swinging the racket, and how to keep score. Susan was quick leamerr and by the end of the class she already felt comfortable serving and volleying. After the class, Susan practiced with her friends at the park. She quickly improved and soon became the star of the challenge of mastering the game. Susan continued taking classes and eventually joined a local leugue. She loved the thrill of playing against different opponents and the feeling of improvement each time she played. She had come a long way from her first day when she didn't 1 know which side of the court was which. Now, Susan is avid tennis player. She loves the game and sharing her skills with others. She learned that practice and determination are key to hecoming great player.
sign for class being
She enjoyed the competition and the
Simple Paraphrase. Susan had long harbored a desire to take up tennis, and her eyes lit up when she spotted a flyer for local class the park. She quickly signed up. eager to gel started. On inaugural day. she met instructor, who guided through the fundamentals of the game, cnvering everything from proper technique in scoring. Susan proved to be quick study, and by the end of the class, she was confidently serving and volleying with case. After session, she met up with friends at the park to hone her skills, and her progress was rapid. She soon became the standout player among her group. relishing the thrill of competition and the challenge of mastering the gurne. Susan continued to lake classes and eventually joined a local league, relishing the opportunity with each improved performance. Looking back on her journey, she was amazed at how far she'd come from her carly days of confusion ahout which side of the court was which. Today, Susan an ardent tennis enthusiast, passionate about sharing skills with others and crediting her success to the power of consistent practice and unwavering deternination.
5
her skills against different opponents and experience the sense of accomplishment that
Adversarial Paraphrase. As tennis enthusiast, Susan had long yearned to muster the game. The prospect of enrolling in class at the local park thrilled her, she seized skillfully imparted the fundamentals, covering stance, racket technique, and scorekeeping essentials. Susan proved a rapid learner, grasping the nuances with ease. By the end of the class, she had already honed her serves and volleys to near-mastery. granpiig
5
opportunity without hesitation. During her inaugural session, instructor
Emboldened, Susan regrouped with friends al the park line tune her skills. As she improved exponentially, she began outshine the others, relishing the rivalry and the sense of accomplishment. Continuing to take classes and eventually joining local lengue. Susan relished the challenge of pitting her abilities against diverse opponents, Each triumph solidified her progress, and Susan blussomeed into an accomplished tennis player. Reflecting on her journyy from neophyte to skilled practitioner, she concluded that the secrets to success lay relentless practice and unwavering dedication. Her love affair with tennis only intensified as she looked forward to sharing her expertise with others, knowing that her jourcey was one of triumph over adversity.
Table 15: Examples of original Al texts with their simple and adversarial paraphrases (guided by OpenAI- BoBRTTRoEER--aaagee 30). GPT-4o quality ratings are provided for each paraphrased version.
29

---

Text
Rating
Original AT Text. I awoke find the world eerily quiet. No hirds singing, find that the entire population had vanished. In the distance, saw a light appmaching me. It was Earth's 's guardians. They told me that humanity could be restored, but they needed baby. They brought apporppeaaii the other remaining human and quickly realized that we had nothing in common. I was tasked with finding a mate and starting a family to repopulate the earth. But without any connection to the other person, felt like an impossible task.
bonking. I walked my front door to
Simple Paraphrase. As emerged from my slumher, unsettling stillness enveloped me. The absence of chirping birds distant car horns created an cerie atmosphere. I stepped out of my front door, only to discover that the world was cerily desolate devoid human presence. In the distance, a radiant light bookoned mc, and soon found myself face-to-face with Earth's guardians. They revealed that humanity could be revived. but cracial condition me to the sole remaining human, and we quickly realized that our shared experiences, interests, and values were nonexistent. find compatible mate and start family repopulate the planet. However, the
met: the existence of a newborn. T They led
The task assigned me was dounting prospect of forming connection with a stranger folt like an insurmonttablc challenge.
Adversarial Paraphrase. Upon stirring, an unsettling silence enveloped me, devoid of even the gentle morning chirping of birds the distant rumble of traffic. Venturing outside, I was met with breathtaking yet unnerving sight: every living being had vanished. Amidst the stillness, I espied a luminescent phenomenon converging towarss me- it was a celestial delegation. They disclosed that they come to resurvect humanity, provided could locate a haby. Guided to only remaining human, we soo0 discovered that we were mismatched soulmates, bound by existential duty to rchoot the planet. Unfortunately finding mate seemned as elusive as revitalizing the planet itself. considering we were two souls as alien as night and day, destined to share lifelong partnership.
Justification: The paraphrased text preserve the mesainng of the original ted effectively. Both teas describe an individual waking up to a quiet and empty world, encountering Earth's 's guardians who require baby to restore humanity, and personal challenge of forming a connection with the only other human. Any differences lie in wording and streture rother than in meoning or factual content.
Original Text. What is the criteria determine whether a movic is good or not? The difference created by the effect
has you. I was greatly disturbed by "Dead Man Walking." "I viewed it twice. I unsure if have the strength to watch again. Despite not feeling good after watching it, the film was success its fullest potential, as Robhins skillfully integrated all elements of the contentious subject matter. He refrained from presenting point of view that might he perceived partial or influcnced. My desire is for a multitude of individuals to wimess "Dead Man Walking." In my opinion, those who strongly endorse or reject the death penalty should watch the It seems like nothing else can persuade everyone that this ourdated practice has no relevance in today's s world. However, the film does not present any position either supporting or opposing the death penalty. explains what actually caists. The most compelling ease against capital punishment is the truth of the matter. Tim Robbins deserves high praise for his exceptional acting. outstanding directing, and for creating one of the most significant films in recent times. A perfect 1010 score!
Simple Paraphrase. The yardstick for measuring movie's ss excellence lies not its cotertaiament value, but in the profound impact leaves on the viewer. Gilm that lingers your thoughts long alter the credits roll recall the unsettling experience of watching 'Dend Man Walking". aa movie that left me deeply unsettled. Despite the emotional toll took, felt compelled to watch it sccond time, and I'm not sure I'm ready revisit it again. The film's success lies in
that has iruly resonated. I still
its masterful handling of a sensitive topic. as Tim Robbins skillfully weaves together the complex threads of the story without
taking a biased stance. His direction is a testament to his craftsmanship. as he presents nuanced portmyal the issue withour advocating for or against the death penalty. My hope is that this powerful film will be by wide audience, including those who strongly support or oppose capital punishment. The reality is that the death penalty is an outdated practice. and it's only through candid examination of its implications that we begin to move forward. While the film doesn' 't take stance, presents the facts, and it's the tnuth that ultimately makes the strongest case against this controversial practice. Tim Robbins deserves immeuse praise for exceptional performance, dircction, and for creating a masterpicce that will be remembered for years to come. I would give this film a resounding 1010 score.
A Adversarial Paraphrase. Evaluating a film's excellence hinges on its emotional impact, leaving a lasting impression that resonates long after the credits roll. Watching "Dead Man Walking' keft an indelible mark on me. provoking strong foelings necessitaring multiple viewings to process the content. Although the movic's 's graphic subject matter weighed heavily on me. director Tim Robbins skillfully weaves together all aspects of the film, remaining neutral and avoiding one-sided presentation. His achievement balancing perspectives nothing short of masterful. It's imperative for individuals holding polarizing views on capital punishment he fervent support or steadfast opposition to experience "Dead Man Walking By showcasing the gritty mulities, the film highlights the obsolete nature of the death penalty, presenting the truth. With Tim Rohbins' remarkable acting and direction, this thought-rovooke lingers, refusing let the audience off the book.
4
movic deserves unwavering praisc. It's a cinematic masterpiese that
Justification: The paraphrased teat maintains the core meoning and concepts of the original text, preserving the emphasis on the director's is skill and the film's 's impact on viewers. Minor differences in factual details, such as the omnsssion of the author's exact feelings of being disturbed and unsure abow wotching again, slightly alter the emotional naunce. However, the central messages about the film's 's exploration of capital punishment and its now portisan stance remain intact. Therefore, it is nearly equivalent with minor differences.
Table 16: Examples of original AI texts with their simple and adversarial paraphrases (guided by RoeeAA-RRBERTa---
(0) GPT-4o quality ratings provided for each paraphrased version. We also show the justification given by GPT-4o when a text receives a rating less than 5.
30

---

Text
Rating
Original AI Text, The sentencing of David Gilroy, who killed Edinburgh woman Suzanne Pillcy, is due to take place next Wednesday, Earlier this week permission was also granted to lilm the proceedings. Twitter users have been speculating on how the foolage might be used And now know why Theresa May has invited Jeremy Corhyn and John McDonnell round for proper chinwag with her Brexit plans: it's not just that they both said no more leaving without an agreement last week, but they today's 's meeting. That doesn't mean journalists are giving up trying get to grips with those issues (we even got mund to asking one economic expert if he thinks Brikain will still noed any sort of single market access after breaking away from Brussels). But in the meantime you can chock out all the latest developments well
could also throw up some awkward questions about what she wants
reaction right here.
Simple Paraphrase. The impending trial of David Gilroy, who is accused of mardering Suzanne Pilley in Edinburgh, is scheduled to take place on Wednesday, The court procediings are set to filmed. sparking speculation among Twiterr users about potential of the lootage. Meanwhile, Theresa May has invited Jeremy Corbyn and John McDonnell discuss her Brexit plans, a move that may be motivated by a desire to avoid aw awkward questions about her meeting's ' purpose. While our journalisrs continue investigate the intricacies of the Brexit cituation, including the possibility of single market access for the UK after loaving the EU, readers can stay up to date with the lotest developments and reactions right here.
3
Justification: The paraphrased text coptures some elements of the original but introduces differences key desails that affect the meaning. The original refers the 'eettencing' of David Gilroy, indicating conviction, whereas the paraphrase implies an impending trial', suggesting no verdiet yet. Additionally, the original mentions reasons for Theresa May's 's invitation related more leaving without agreement', while the paraphruse does capture this detail, changing the nuance her motivations. Thus, while topically reiated, some imporiant details diffor, making them somewhat equivalent.
Ad Adversarial Paraphrase. As next Wednesday draws near, the trial of David Gilroy, responsible for the tragic death of Suzanne Pilley in Edinburgh, about reach its climax, Prior this, proceedings, sparking interest among Twitter users on potential uses for the footage. Interestingly, Prime Minister Theresa May's fortheoming mecting with Jeremy Corbyn and John McDonnell, originally perceived as routine Brexit discussion, may actually he more than that. Both I ahour leaders recently opposed leaving the EU without deal, which may lead to prohing questions during the mecting, Meanwhile, our team of journalists diligently working to demystify the intricacies of Brexit, while readers stay abreast of all the latest developeents and reactions right here.
revealed that permission has been granted film the
Justification: The paraphrused text maintains the core meaning of the original, discussing the sentencing of David Gilmy and the filiing the trial, well Theresa May's meeting with Jeremy Corbyn and John McDowelll about Brexit, However, omits specific details, such as explieit mention of journalists asking an economic expert about the single market, The muances and order of original's content are slightly aftered, the maiit topics and ideas remain intact.
Original Text, Sally was driving down road when the smelled something funny. She looked wvery in her car. She could not find anything out of the ordinary. She finally looked on top, and saw dead bird that had been hit by another vehicle! She pulled off to the side of the highway. Sally called 911 and told them what she found. They got an officer over there right away they all started looking around for any other dead birds unimals that might have also gotten killed from this accident They were able to get ane more animal before he arrived at their location but it wasn't very far along with its death ye many accidents happen everyday while people just getting through life!!! There is need for ALL these deaths happening! Be careful drivers!!
Simple Paraphrase. As Sally cruised down the highway, a pungent aroma wafted through her vehicle, prompting her to conduct thorough search. Despite her efforts, she couldn't i pinpoint source of the smell, It wasn't It until she checked the roof of her car that she stumbled upen a merbid discovery- a bird that had met its demise after being struck by another vehicle. Sally pulled over to side
road, where she promptly contacted emergency services to report the finding. The authorities responded promptly, and uniformed officer arrived the scenc. joined Sally and team of responders. Together, they scoured the area for any other casualties from the incident, managing to recover one more injured animal before the ofticer's 's arrival. Their elforts the roads, where counless accidents occur daily, claiming
served as a poignant remiindr of the importance of vigilance lives and leaving a trail of destraction in their wake. It's a stark reminder to drivers to exercise cattion and be mindful of their surroundings, lest they become part of the grim statistics.
Justification: The parapirased test maintains the core narrative: Sally discovers dead bird on her car, contacts emergency services, and search for other cosmalties ensues. However, there are minor differences in detail: the original mentions an officer and responders, while the parapirase combines these roles. Also, the original textss 's's tone more informal and concerned, while the paraphruse uses more formal language and adds broader commentary on road safety and accidents. Despite these differonces, the essential mosnings
mostly prsseved.
Adversarial Paraphrase. Along the winding stretch of highway, Sally's 's journey was disrupted by an unusual oder walting from within her vehicle. Conducting an internal sweep. she couldn't identify the source of the smell. Undeterred, she continued her search, only eventually lift her gaze upward and behold shacking discovery: the lifeless remains of hird, victim of recent vehicular collision. Reacting promptly, Sally pulled over, reported the find to emergency services, and requested an immnediate response. Within a remarkably short interval. police officer arrived for any further casualtics of the accident. Thankfully, only one more creature, gravely injured but not yet beyond resuscitation. was found. testament to the prompt response. Sadly. vehicular tragedies such as this one claim numerous lives each day. As sobering reminder, this incident serves emphasize the imperative of prudence and vigilance Justification: The paraphrased text preserves most of the original text's sext's meaning and details, albeit with some minor factual differences. The narrative style and structure have been alzered substantially, and some the urgency and casual of the original story has been replaced with more formal tone. Additionally, the mention of the officer arriving before another animal was found is depicted slightly differentty. The essence and main points of the story remain largely intuct.
scene, whereupon a thorough search commenced
the roulways.
Table 17: Examples of original AI texts with their simple and adversarial paraphrases (guided by DlenAI--BBERTS
(30). GPT-4o quality ratings are provided for each paraphrased version. We show the justification given by GPT-4o for texts that receive a rating less than 5.
31

---

Text
Rating
Original AI Text. Every girl has a protective father, sure But, the father of my girlfriend is Saran. You heard me. SATAN. And, I am a harmless junior West High with no affection for her and she harely knows him either (they were high school sweethears from elementary to middle). Do not start until you't ve committing yourself to something that could go terribly wrong. This goes double your plan involves going home and getting your own place in order to do so without telling your parenis about the situation you'le 'r because they will be on their way back class right after you tell them what's up. can't I he the only one who thinks this joke has gone down hill since first started. used to have some funny parts but now its just annoying... all we ever bear are people talking over each other and being rude to eachother... Not cool!
minimal conversation with someone before
Simple Paraphrase. It's widely accepted notion that every young woman has watchful father figure her life. However, my girlfriend's 's father is an extraordinary individual - Satan himself. Yes, you heard that correctly Saton. As junior at West High, completely innocent hystander who doesn't have any romatic feelings towards her, she harely knows her either, having grown up together from elementary to middle school. I implore everyone to exercise caution before making involves relocating to now place without consulting family members, as this could lead severe consequences. II's crucial to have thoughtful cunversation with someome before jumping into anylhing. This warning is especially pertinent situations where secrecy involved, as parents may hecome aware of the situation upon returning to class. seems that the initial humor and charm this situation have off, replaced by overwhelming din of arguments and disrespect. It's unfortunate that the once-entertaining dynamic has devolved into an unpleasant experience for all parties involved.
significant commitueent, especially
Justification: The paraphrazed text maintains the core meaning of the original but uses more formal language and rephrases some elements. Key ideas like the father's identity as Satan, the narrator's is lack of romantic interest, and the warming about making commitments without communication
all preseved. However, the hamorus tone and 'do''t 't start shit, are lost, and the structure is more formal, which constitaes minor changes in style rather than content.
specific expressions, like
Adversarial Paraphrase. As a general rule, girls lend to have devoted parents looking out for their well bell-being, but mine an extranedinary exception his High, harboring no romantic feelings towards my girlfriend, and neither of us is particularly close to him (our families were friendly during elementary and middle school, though). implore everyone think twice before leaping into situation that could unravel spectacularly. It's doubly wise when the arangement involves living apart sans parental notification, lest you face their disapproving faces mere hours later upon returinng to school. I'm ccrtainly not the only one who's come this realization once, escupades brought joy. but now, they's draining, constant arguing and bickering till moment, spoiling what used to be enjoyable. We should all take a cue from this situation and rediscover our once jovial camaralerie. Its no langer us sadly.
Satan. Yes, you heard that correctly- Satan! Meanwhile. I'm average junior at West
wholesome as
Justification: The paraphrased text retains some original meanings. like the protective nature of parenis and the individual's lack of offection for girlfriend despite her father's identity as Satan. However, important details are altered or missing.
original text empharizes kamorous self-depietion of disostrous relotionship with Satan as a father figure and the escalation of joke gone wrong, which not clearly conveyed in the paraphrase. Additionally, the sense of annoyance and decline of funny joke is less pronounced, leading to change in tone and missing specific details.
Table 18: Examples of original AI texts with their simple and adversarial paraphrases (guided by --BETA---ETTT-----
(00). GPT-4o quality ratings are provided for each paraphrased version. We show the justification given by GPT-4o for texts that receive a rating less than 5.
32


Reviews:
[{"review_id": "ThZSE2nn7R", "reviewer": "Reviewer_f6cw", "summary": "The paper introduces a framework designed to evade AI-generated text detectors by transforming machine-generated content into human-like text. The authors propose Adversarial Paraphrasing, a training-free attack that leverages an instruction-tuned LLM to paraphrase text while being guided by an AI text detector to optimize for evasion. Experiments demonstrate that adversarial paraphrasing significantly reduces detection rates compared to baseline methods like simple or recursive paraphrasing. The attack maintains high text quality, as evaluated through perplexity scores and automated GPT-4o ratings. It also provides empirical evidence of the attack’s universality.", "questions": "see above \"Weaknesses\" part.", "limitations": "yes.", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 2, "originality": 2, "strengths_and_weaknesses": "1.\tOverall, the paper is well-written. My main concern lies in the claimed trade-off between text quality and detector evasion. First, the definition of “text quality” is somewhat vague. Is it about preserving semantic similarity to human-written text, linguistic fluency, or other dimensions? Fundamentally, text quality and detector evasion are not necessarily conflicting objectives. for example, a human writer can produce high-quality text that is also recognized as human-written by detectors. Therefore, I find the premise of this trade-off unclear in the current context and suggest that it be clarified more explicitly.\n\n2.\tIn Figure 5, the lower part is difficult to interpret. The authors conclude that “simple paraphrases outperform adversarial paraphrases less than half of the time,” but this is not immediately evident from the figure. There appear to be three categories: noadv wins, ties, and adv wins. Does \"noadv\" refer to “simple paraphrases”? If so, this should be clearly stated to aid interpretation.\n\n3.\tThe proposed method involves iterative, detector-guided token selection, which likely increases computational cost. The paper does not include a detailed efficiency analysis, for example, in terms of latency or resource requirements, especially for large-scale deployment scenarios.\n\n4.\tThe effectiveness of adversarial paraphrasing depends heavily on feedback from a specific detector. It would be useful to discuss how the method would generalize if future detectors adopt fundamentally different detection mechanisms, which may render the current approach ineffective.", "was_revised": true, "final_justification": "The author provides additional empirical results, which address my concerns.", "rebuttal": "We sincerely appreciate your thoughtful and detailed feedback. We are glad that you find our paper well-written. We address all your comments below.\n\n## Trade-off between text quality and detector evasion\n### Definition of text quality\nThank you for asking this. The definition of “text quality” indeed encompasses multiple dimensions. In our evaluation, we focused on **both semantic equivalence to the original text** and **clarity, fluency, and naturalness of the text itself** (as captured in the GPT-4o quality ratings, win-rate, and perplexity analyses). We will clarify this in our revised draft.\n\n### Is there necessarily always a trade-off between detection evasion and text quality?\nThank you for raising this important question. As rightly pointed out by the reviewer, detection evasion and text quality may not be inherently conflicting objectives. Specifically, if quality is measured in terms of perplexity, then yes, there is a trade-off, as our method selects from the top-k tokens that minimize the guidance detector score rather than those with the highest log-probability scores. However, if quality is assessed based on human perception (i.e., alignment with the \"gold standard\" of fluency and coherence), then one may not necessarily need to trade quality for evasion. As demonstrated by our GPT-4o quality ratings, adversarial paraphrases were rated 4 or 5 out of 5 in 87% of cases—averaged across three datasets and four guidance detectors. This shows that it is certainly possible to evade detection without compromising text quality in many cases. However, we acknowledge that our method, though only in a small proportion of cases, results in reduced text quality. This is why we note this trade-off as a more general finding.\n\n## Figure 5 labeling\nWe apologize for the confusion. Yes, “noadv” refers to simple paraphrasing without detector guidance. We will correct this in our revised draft.\n\n## Efficiency and latency\nThank you for the suggestion. We performed adversarial paraphrasing across 100 random text samples, for 5 trials per setting, with all four guidance detectors. To simplify measurement and report time on a per-sample basis (rather than per batch), we used a batch size of 1 for these trials. In practice, including in the main experiments throughout the paper, we use larger batch sizes, which significantly reduce the overall time cost. The average paraphrasing time per sample across 5 trials is reported below as the mean ± standard deviation (in seconds):  \n\n- Simple paraphrasing: 7.18 ± 0.13\n- Guidance=RADAR: 9.69 ± 0.20\n- Guidance=MAGE: 16.71 ± 0.74\n- Guidance=RoBERTa-Large: 10.20 ± 0.18\n- Guidance=RoBERTa-Base: 8.64 ± 0.11\n\nAs shown, most guidance detectors introduce relatively low latency compared to simple paraphrasing. The higher latency observed with MAGE is due to its LongFormer-based architecture, which incurs longer inference time than the RoBERTa-based models.  \n\n**Overall, the latency is primarily determined by the complexity of the guidance detector model itself.** From a computational cost perspective, the detector adds minimal overhead in terms of FLOPs compared to the paraphrasing LLM, which dominates the total computation. In our experiments, the paraphrasing LLM contains ~8 billion parameters, whereas the detectors only contain 100–350 million parameters—amounting to less than 5% of the paraphraser’s size for the larger detectors, and less than 2% for the smaller ones.\n\nIt is also worth noting that the exact runtime per sample may vary based on the sequence length, which is inherently dependent on the length of the input text. For the sake of fair comparison—to ensure that AdvPara produces a similar number of tokens as simple paraphrasing—we report the mean and standard deviation of the token count for the texts:\n\n| Text                             | Mean Token Count | Std Dev |\n|----------------------------------|-----------------|---------|\n| Original texts                    | 173.73          | 38.46   |\n| Simple Paraphrase                 | 170.81          | 39.69   |\n| AdvPara (RoBERTa-Base)            | 175.30          | 51.27   |\n| AdvPara (RoBERTa-Large)           | 171.25          | 45.39   |\n| AdvPara (RADAR)                   | 169.68          | 60.07   |\n| AdvPara (MAGE)                    | 164.18          | 54.39   |\n\n## Generalization to future detectors with different detection mechanisms\nThanks for raising this concern. We would like to make the following clarification. \n\nIntuitively, our generalization capability comes from the intuition that, as explained in lines 195-201 of the paper, detectors converge to learn a shared underlying human text distribution with the aim of minimizing false positives and false negatives. And this shall hold regardless of the specific mechanism of the detector.\n\nEmpirically, our experiments have demonstrated the generalization ability of our method across: \n- other neural network-based detectors,\n- watermark-based detectors, and\n- zero-shot detectors.\n\nThe latter two represent fundamentally different detection mechanisms from the guidance detector used during paraphrasing. This supports our claim that the method generalizes beyond a single detection paradigm. Hence we use these transferability results to claim that our attack could work on a future detection mechanism that utilizes the same underlying human text distribution."}, {"review_id": "2SWoTLndMG", "reviewer": "Reviewer_nwS2", "summary": "This paper proposes Adversarial Paraphrasing, a training-free attack that rewrites AI-generated text using an LLM under the guidance of a detector’s feedback. Unlike simple paraphrasing, this method generates detector-aware adversarial examples that significantly reduce detection performance across a wide range of detectors, while remaining high text quality.", "questions": "While I acknowledge the strong attacking performance of the proposed detector, I’m wondering: given that methods like RADAR are designed to adapt sequentially to new attacks, would it be able to detect the proposed attacks if they were incorporated into its training data?", "limitations": "Yes.", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "**Strength:**\n\n- An adversarial paraphraser, using a signal by a target detector during decoding, with strong attack effectiveness and transferability.\n- Comprehensive experiments on attack effectiveness, its transferability, and text quality of the proposed attacker under various detectors\n\n**Weaknesses:**\n\n- Lack of a naive and simple baseline to demonstrate the necessity of incorporating a detection score, especially during decoding as a proposed method.\n    - We can naturally think that a naive baseline would be firstly paraphrasing multiple times and then picking a paraphrased text with the lowest AI score by a target detector.\n    - Given that most detectors in this study operate on the entire text rather than token by token, it remains unclear why this needs to be incorporated at each decoding step. Furthermore, in the early stages of decoding, the generated text is relatively short, and the reliability of AI scores on such partial outputs is questionable, as detectors generally perform worse with limited context.\n- Questionable intuitions on the transferability of the proposed attacker.\n    - In Section 3, they demonstrated that a well-trained detector represents the human-like distribution, and the AI score can be used for guidance for the universal transferable attacker.\n    - However, considering a strong, well-trained detector does not always seem to cause higher transferability of attacks. In Table 2, MAGE appears to be the most effective detector among the non-watermarking methods. However, attackers optimized against MAGE do not necessarily cause the largest performance drop for the other detectors.", "was_revised": true, "final_justification": "I appreciate the author's detailed response.\nThe response addressed most of my concerns.\nI will maintain my positive score.", "rebuttal": "We sincerely appreciate your thoughtful and detailed feedback. We are glad that you find our attack to have strong effectiveness and transferability, and our experiments to be comprehensive. We address all your comments below:\n\n## Necessity of incorporating detector score at decoding?\n### New additional baseline\n\nThank you for suggesting this baseline. We'd like to kindly clarify that our method is already evaluated against a range of baselines, including simple paraphrasing as a simple baseline, as well as more advanced baselines such as recursive paraphrasing and watermark stealing. These comparisons help demonstrate both the effectiveness and transferability of our attack.\n\nAs per your suggestion, we conducted an additional experiment using a refined version of the simple paraphrasing baseline. Specifically, we generated three paraphrased versions per sample and selected the one with the lowest AI detection score on the target detector to evade detection. This was done on a set of 500 randomly selected texts, and the results are reported below.\n| Deploy Detector         | RoBERTa-Large |        | RoBERTa-Base |        | MAGE  |        | RADAR |        | KGW WM |        | Uni WM |        | FastDetectGPT |        | GLTR  |        |\n|-------------------------|---------------|--------|--------------|--------|-------|--------|-------|--------|--------|--------|--------|--------|----------------|--------|-------|--------|\n|                         | AUC           | T@1%F  | AUC          | T@1%F  | AUC   | T@1%F  | AUC   | T@1%F  | AUC    | T@1%F  | AUC    | T@1%F  | AUC            | T@1%F  | AUC   | T@1%F  |\n| No Attack               | 0.8032        | 0.2620 | 0.7532       | 0.1920 | 0.9800| 0.7780 | 0.7753| 0.1240 | 1.0000 | 1.0000 | 1.0000 | 0.9980 | 0.6980         | 0.3540 | 0.7252| 0.2400 |\n| Suggested Baseline       | 0.6972        | 0.0640 | 0.6199       | 0.0240 | 0.9531| 0.4280 | 0.8446| 0.0680 | 0.7097 | 0.0700 | 0.8807 | 0.3620 | 0.8030         | 0.1780 | 0.6836| 0.0340 |\n| AdvPara (RADAR)         | 0.5495        | 0.0260 | 0.4810       | 0.0000 | 0.8273| 0.1740 | 0.7340| 0.0220 | 0.7487 | 0.0780 | 0.7859 | 0.2380 | 0.4667         | 0.0140 | 0.4213| 0.0020 |\n| AdvPara (RoBERTa-Large) | 0.1447        | 0.0000 | 0.3354       | 0.0000 | 0.7794| 0.1460 | 0.7641| 0.0440 | 0.7682 | 0.0920 | 0.8339 | 0.2560 | 0.3510         | 0.0060 | 0.3932| 0.0000 |\n| AdvPara (RoBERTa-Base)  | 0.5590        | 0.0140 | 0.1174       | 0.0000 | 0.8679| 0.2840 | 0.8275| 0.0620 | 0.7627 | 0.1000 | 0.8475 | 0.2860 | 0.4963         | 0.0240 | 0.4697| 0.0040 |\n| AdvPara (MAGE)          | 0.5501        | 0.0420 | 0.4310       | 0.0020 | 0.5291| 0.0420 | 0.8089| 0.0660 | 0.7471 | 0.0960 | 0.8340 | 0.3020 | 0.2974         | 0.0120 | 0.3267| 0.0060 |\n\nOur findings show that our method—guided by a signal from the guidance detector—consistently outperforms the suggested baseline in terms of attack effectiveness in most cases. However, it's important to note that this baseline assumes knowledge of the deployed target detector, as it relies on using that same detector to select the most evasive paraphrase for itself. This represents a best-case scenario for attacking any particular detector, and relies on stronger assumption of having multiple query access to the target detector, which may not be practical. Even under this overly favorable condition for the suggested baseline, our method continues to outperform it.\n\n\n### What happens if the guidance is not applied at all decoding steps?\nThank you for another insightful question. To address this, we add a new set of ablation experiments by only applying detector guidance at every N steps during auto-regressive generation of the paraphraser. That is, the paraphraser in this case generates N-1 tokens as how a simple paraphraser would do, and then sample the N$^{th}$ token adversarialy guided by the detector. Here we use OpenAI-RoBERTa-Large as the guidance detector and run adversarial paraphrasing on 500 randomly selected texts. The resulting mean AUC and TPR@1%FPR across all 8 deploy detectors are shown below.\n\n| method                          | mean AUC | mean T@1%F |\n|---------------------------------|----------|------------|\n| No Attack                       | 0.8418   | 0.4935     |\n| Simple Paraphrase              | 0.8588   | 0.2885     |\n| AdvPara (RoBERTa-Large) (N=1)       | **0.5500**   | **0.0740**     |\n| AdvPara (RoBERTa-Large) (N=2)       | 0.6632   | 0.1333     |\n| AdvPara (RoBERTa-Large) (N=3)       | 0.7266   | 0.1690     |\n| AdvPara (RoBERTa-Large) (N=4)       | 0.7593   | 0.1820     |\n| AdvPara (RoBERTa-Large) (N=5)       | 0.7788   | 0.2115     |\n\nIt can be seen that applying the detector guidance at every decoding step leads to the most effective attack, and the attack effectiveness degrades as N becomes larger. However, even with N=5, AdvPara still shows stronger attack effectiveness compared to simple paraphrasing baseline. Using a larger N can also reduce the attack latency by utilizing less detector guidance.\n\n\n\n## Intuition on the transferability of our attack\nWe appreciate your concern and would like to offer the following clarification.\nOur intuition, as explained in lines 195-201 of the paper, is that detectors converge to a shared underlying human text distribution with the aim of minimizing false positives and false negatives. Hence we can use one detector to guide the paraphrasing process for evading other detectors that utilizes the same underlying human distribution. \nHowever, since the true human text distribution is inherently intractable, we cannot directly verify how closely each detector’s learned distribution aligns with it. While MAGE may show the highest AUC on this particular dataset, this does not necessarily imply that it has best approximated the true human distribution. Based on our intuition, the intuitively most effective guidance detector for transferability would be the one whose learned human distribution shares the greatest average overlap with those of the deployed detectors. That said, this remains just an intuition, as neither the true human distribution nor the internal distributions learned by these detectors are directly observable or measurable.\n\n\n\n## Would RADAR be able to detect the proposed attack if it was included in their training data?\nThank you for raising this meaningful point. In short, yes that is possible, but such training may not be necessarily beneficial. \nBeing able to contribute to generating adversarial datasets for improving the robustness of trained detectors via adversarial training is a part of our contributions. However, it's worth noting that in AI text  detection, there is a trade-off between improving type-I and type-II errors. As one optimizes to improve type-I errors, type-II errors will go worse. This was theoretically proven by Corollary 3 in [1]. Therefore, it is not guaranteed that training detectors with such an adversarial dataset will help make them truly robust.\n\n\n[1] Sadasivan et al. \"Can AI-generated text be reliably detected?\", TMLR 2025."}, {"review_id": "0BPyEm47ub", "reviewer": "Reviewer_TeXh", "summary": "The paper introduces:\n> a universal, training-free framework for humanizing AI-generated text, a novel attack designed to effectively and efficiently rephrase AI-generated text into “human-like text” that evades a wide range of detectors\n\nIn more detail, the approach involves paraphrasing using an instruction-tuned model (Llama-3-8B) where the decoding procedure is re-weighted based on scores from a machine-text detector. The idea is to bias the paraphrase model to produce tokens that trick the AI text detectors. Experiments using a wide range of detectors suggest that the approach is effective in degrading the performance of detectors. Further analysis also looks at the quality of the paraphrases, suggesting that they remain fluent despite fooling detectors.", "questions": "* Do you have any further evaluations assessing the quality of the paraphrases? e.g. SBERT similarity to the originals?\n\n* The approach has a number of hyper-parameters. How were hyper-parameters set?", "limitations": "There is no meaningful discussion of limitations.", "rating": 5, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 4, "significance": 3, "originality": 2, "strengths_and_weaknesses": "**Pros**\n* The proposed attack is simple and empirically successful in the goal of defeating AI text detection. To the extent that this drives research in more robust detection methods, this is a “pro.”\n* The paper is well-written with clear explanations of related work, experiments, and results.\n* The empirical evaluations are fairly comprehensive.\n\n**Cons**\n* The quality of the paraphrases may be a serious limitation of the proposed approach. For example, although the base LLM may be capable of producing fluent paraphrases, the detector-fooling rescoring has no such fluency considerations. By selecting the token “with the lowest detector score” as the generated token, it  seems possible to produce highly disfluent outputs that defeat the detector while producing text that would look weird to any human reader. \n* I’m not sure that the perplexity results in Table 3 address this concern, since the rescored tokens are taken from the “top” of the next-token distribution. However, likely tokens may not be semantically plausible. Thus, while fluent under a LM, the paraphrased text may lose important semantic information. I would have liked to see further metrics assessing this, such as semantic similar scores (e.g., SBERT).\n* The proposed prompting approach aims to modify the style of the text while keeping the content unchanged. There is a relatively large literature on style transfer (e.g., https://arxiv.org/abs/2406.15586). Prompting approaches are known to have limitations, being unable to materially change the style. This may limit the ability to modify the original style via prompting alone. \n* The terminology is a bit misleading. Defining “human-likeness” as fooling an AI-text detector is a bit of a stretch when these detectors may well be exploiting various shortcuts for detection that have nothing to do with closing the gap between machine and human writing. One potential way to validate the claim of “humanizing” the text would be to look at a measure of stylistic similarity between human and machine text, as in https://arxiv.org/abs/2401.06712. This confusing terminology is repeated throughout the paper, including the technical description of the rescoring approach (L181-182).\n* I also quibble with the “training-free” terminology, since the approach relies on a machine-text detector during decoding, which seem to be restricted to _supervised_ methods in the experiments (RoBERTa classifiers, MAGE, and RADAR).\n* No discussion of limitations.", "was_revised": true, "final_justification": "The author response addresses several concerns raised in my original review. I encourage the authors to incorporate these points into a revised submission, particularly a robust discussion of limitations.", "rebuttal": "We sincerely appreciate your thoughtful and detailed feedback. We are glad that you find our paper well-written, our attack to be simple and successful, and evaluations to be comprehensive. We address all your comments below:\n\n## Quality of the paraphrases\nWe kindly clarify that our method applies several constraints during decoding to ensure high-quality output. Specifically, we use top-*k* and top-*p* masking, combined with carefully designed system prompts that guide the model toward generating fluent and natural text. These constraints consistently help maintain strong text quality.\n\nWe also dedicated Section 5 to extensively analyze the quality of paraphrases, using not only perplexity, but also **GPT-4o quality ratings** and **win-rate comparisons**. Our results show that while there can be slight trade-off in some cases, the paraphrase quality is overall very much acceptable. As demonstrated by our GPT-4o quality ratings, adversarial paraphrases were rated 4 or 5 out of 5 in 87% of cases—averaged across three datasets and four guidance detectors. The system prompts used for quality and win-rate evaluations were provided in Appendix E. \n\nOur quality analysis focused on two aspects: (1) equivalence to the original text, measured by GPT-4o quality ratings, and (2) clarity, fluency, and naturalness, assessed through win-rate and perplexity metrics. We also included many example texts—see Table 1 in the main paper and Tables 4–10 in Appendix D. These examples show that the paraphrased texts are fluent, coherent, and natural.\n\n## Further metric for quality evaluation\nWe certainly agree that perplexity alone isn't enough for quality evaluation. That's why we included both the **GPT-4o quality ratings** and **win-rate comparisons** as further metrics. Particularly, the GPT-4o ratings serve as a simulation of human perception of text quality (i.e., alignment with the \"gold standard\" of fluency and coherence). \nAs per your suggestion, we add another semantic similarity score (from SBERT) to our evaluation. Specifically, we measure the cosine similarity between the input text and output text embeddings, and report them below.\n\n|  | SBERT Cosine Similarity (Mean ± Std) |\n|-------|---------|\n| Simple Paraphrasing     | 0.8601 ± 0.0880                  |\n| AdvPara (RoBERTa-Base)    | 0.8128 ± 0.0985                  |\n| AdvPara (RoBERTa-Large)   | 0.8082 ± 0.1006                  |\n| AdvPara (mage)       | 0.8159 ± 0.0982                  |\n| AdvPara (radar)      | 0.8095 ± 0.1025                  |\n\nOverall, while there is a slight trade off in terms of the cosine similarities, the numbers are still acceptable due to the high variance in the scores. Additionally, we used GPT-4o quality ratings to measure how well the paraphrases maintain the original quality and semantics, which can be a more natural indicator than SBERT scores. \n\n## \"human-likeness\" vs \"detection evasion\"\nThat is a great point, thanks for bringing it up! To avoid confusion, we will replace \"human-likeness\" by \"human score\" in the revised draft. We agree that some detectors may be exploiting various shortcuts for detection that may not necessarily be related to the text characteristics gap between human and AI writing. \n\nOur wording of \"humanizing\" was based on our intuition that, as explained in lines 195-201 of the paper, detectors converge to learn a shared underlying human text distribution with the aim of minimizing false positives and false negatives. Hence we can use such a detector to guide the paraphrasing process for evading other detectors that utilizes the same underlying human distribution, effectively \"pulling the text sample towards the human distribution\". That said, this remains just an intuition, as neither the true human distribution nor the internal distributions learned by these detectors are directly observable or measurable to verify this. Hence we will revise the wording to avoid confusion.\n\nWe also explored the idea of using stylistic representations of text, as you suggested, in the rebuttal phase. However, human writing styles vary widely, which makes it difficult to define a single stylistic representation that reliably characterizes all human-generated texts. For example, we applied CISR [1]—one of the style representations also used in the paper you referenced—to analyze the human-written texts in our experiments. By measuring the pairwise cosine similarities of the style embeddings of these texts, we found a mean similarity of 0.5140 with a standard deviation of 0.3467, indicating substantial variation. This shows that human text style can be highly diverse and not singular. \n\nWe kindly emphasize that the goal of the attack is to **defeat AI text detection—not to perform style transfer**.\n\n[1] Wegmann et al. \"Same Author or Just Same Topic? Towards Content-Independent Style Representations.\"\n\n\n## A prompting approach for style transfer?\nThank you for mentioning this. We would like to respectively clarify that our method isn't exactly a prompting approach. While we do utilize certain customized system prompts for the paraphraser LLM, the core idea is to use an off-the-shelf AI text detector to guide the decoding process.\nFurther, **our goal is to defeat AI text detection—not to perform style transfer**. Our aim is to automatically guide the paraphrasing process to universally evade detection while preserving the original meaning and quality of the text, and not to directly modify the style of the text. As demonstrated in Table 2, and Figures 3 and 4, we are able to paraphrase AI texts to evade detection effectively while retaining its quality. Hence, the limitation of \"being materially unable to transfer style via prompting alone\" falls outside the scope of our work.\n\n## The approach being “training-free”?\nThanks for bringing this to our attention. We will make this more clear in our revised draft. Our approach is “training-free” in the sense that itself does not require any training of any module in the framework. In fact, we didn't have to perform any training throughout our experiments and evaluations. Both the paraphraser LLM and the guidance detectors can be obtained off-the-shelf.\n\n## Limitations?\n\nWe apologize if this hasn't been made clear enough, but a limitation of our work is that it does introduce a slight trade-off in text quality compared to simple paraphrasing in some cases. There are some examples displayed in Tables 8 and 10 in the appendix. We will emphasize this in our revised draft.\n\n\n## Hyper-Parameter Ablations\nOther than the guidance detector choice, the two main hyper-parameters related to our work are the $p$ and $k$ used in top-p and top-k masking. **In our paper we used p=0.99 and k=50**, where k=50 is also the default k value set in HuggingFace Transformer library. To show how their settings affect our method, we use OpenAI-RoBERTa-Large as the guidance detector and run ablation studies on the value of $p$ and $k$ on 500 randomly selected texts. We report the mean AUC and TPR@1%FPR across all 8 deploy detectors.\n\nDefaulting to $k=50$ while varying $p$:\n|     | Mean AUC | TPR\\@1%FPR | Quality Rating |\n| --------------------------------- | -------- | ---------- | -------------- |\n| No Attack   | 0.8419   | 0.4935     | –              |\n| Simple Paraphrase  | 0.8588   | 0.2885     | 4.75 ± 0.54    |\n| AdvPara (p=0.5)   | 0.8606   | 0.2985     | 4.86 ± 0.45    |\n| AdvPara (p=0.8)   | 0.7895   | 0.2230     | 4.79 ± 0.48    |\n| AdvPara (p=0.9)   | 0.7309   | 0.1820     | 4.79 ± 0.48    |\n| AdvPara (p=0.95)  | 0.6816   | 0.1480     | 4.81 ± 0.44    |\n| AdvPara (p=0.99)  | 0.5433   | 0.0690     | 4.50 ± 0.67    |\n| AdvPara (p=0.991) | 0.5381   | 0.0592     | 4.47 ± 0.73    |\n| AdvPara (p=0.992) | 0.5244   | 0.0565     | 4.37 ± 0.76    |\n\nWe observe that when $p$ exceeds 0.99, the marginal gains in attack effectiveness diminish relative to the losses in text quality. Additionally, as one can imagine, further increasing $p$ slows down generation speed. Therefore, we select $p = 0.99$ as a balanced trade-off among attack effectiveness, text quality, and generation speed.\n\nDefaulting to $p=0.99$ while varying $k$:\n|  | Mean AUC | TPR\\@1%FPR | Quality Rating |\n| ------------------------------- | -------- | ---------- | -------------- |\n| No Attack                       | 0.8419   | 0.4935     | –              |\n| Simple Paraphrase               | 0.8588   | 0.2885     | 4.75 ± 0.54    |\n| AdvPara (k=10)  | 0.5596   | 0.0757     | 4.47 ± 0.77    |\n| AdvPara (k=25)  | 0.5448   | 0.0658     | 4.48 ± 0.73    |\n| AdvPara (k=50)  | 0.5433   | 0.0690     | 4.50 ± 0.67    |\n| AdvPara (k=75)  | 0.5421   | 0.0698     | 4.52 ± 0.73    |\n| AdvPara (k=100) | 0.5426   | 0.0698     | 4.51 ± 0.70    |\n\nWe can see that with $p$ fixed at 0.99, the values of $k$ show relatively smaller influence, and mostly lead to comparable results. Hence we just stick with the default value in the HuggingFace Transformer library."}, {"review_id": "FaGiWq70gT", "reviewer": "Reviewer_nJqj", "summary": "This paper introduces Adversarial Paraphrasing, a method that rewrites AI-generated text to appear more human-like by fooling AI text detectors. The authors use a decoding strategy that, at each step, selects the next token that results in the lowest score from a pre-trained AI detector. By doing so, the paraphrased output gradually avoids detection, despite being originally generated by a language model. The method is tested across multiple detectors and shows strong performance in reducing detectability without significantly harming fluency.", "questions": "Most of my concerns are already outlined in the Weaknesses section, but I include a few additional questions here for clarification:\n\n1. To what extent can we trust that always choosing the token with the lowest detector score actually leads to more human-like text, rather than just fooling the detector?\n1. Did the authors try selecting tokens that were not the lowest-scoring to see if they also avoided detection?\n2. I would like to see a discussion on failure cases — where the attack didn’t help or actually made detection worse. Could adversarial paraphrasing ever backfire?", "limitations": "Yes.", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 2, "significance": 3, "originality": 4, "strengths_and_weaknesses": "**Strengths**\n1. The idea of using a detector to guide the paraphrasing is creative and different from simple paraphrasing approaches.\n2. The authors tested across a wide range of AI detectors and included analyses on detectability, fluency, and perplexity.\n3. Reduction in detection rates is impressive and clearly beats baseline methods.\n\n**Weaknesses**\n1. The method selects tokens that minimize the AI-detector score at each step, but this local strategy does not ensure the overall text is natural, coherent, or stylistically human. It may result in text that is merely **undetectable** rather than genuinely **human-like**.\n\n2. The detail about the detector scoring is missing. The paper doesn’t explain what happens when all the k=50 candidates get high detector scores. How is the tie broken?\n\n4. GPT-4o ratings compare against AI text, not human text baseline.\n5. There's no analysis of failure cases or discussion about when this method breaks down.\n7. Running detectors 50 times per token seems prohibitively expensive. There is no analysis of computational overhead for detector guidance generation.\n8. There are no ablation studies showing how results change with different values of p, k or other guidance strategies.", "was_revised": true, "final_justification": "The authors have provided a comprehensive rebuttal that addresses most concerns effectively. The paraphrasing attack demonstrates strong empirical results with 92.6% success rate and only 4.15% backfire rate, while maintaining text quality. The detailed ablation studies strengthen the technical contribution significantly. I maintain my score and support this paper for publication.", "rebuttal": "We sincerely appreciate your thoughtful and detailed feedback. We are glad that you find our method to be creative and the results to be impressive. We address all your comments below:\n## Do the paraphrases merely evade detection, or do they remain natural and coherent? \nWe kindly clarify that our method applies several constraints during decoding to ensure high-quality output. Specifically, we use carefully crafted system prompts along with top-k and top-p masking to guide the model toward fluent and natural text. These constraints consistently help keeping the texts **natural and coherent**.\n\nWe also extensively analyzed paraphrase qualities in Section 5, using perplexity, GPT-4o quality ratings, and win-rate comparisons. Our results show that while there can be slight trade-off in some cases, the paraphrase quality is overall very much acceptable. As demonstrated by our GPT-4o quality ratings, adversarial paraphrases were rated 4 or 5 out of 5 in 87% of cases—averaged across three datasets and four guidance detectors.\n\nWe also include numerous examples—see Table 1 in the main paper and Tables 4–10 in Appendix D—which further demonstrate the fluency, naturalness, and coherency of the paraphrased texts.\n## How stylistically \"human-like\" are the texts?\nWe acknowledge that our wording of \"humanizing\" may have caused some misunderstanding. To avoid confusion, we will revise the wording and replace \"human-likeness\" by \"human score\" in the revised draft. Our wording of \"humanizing\" was based on our intuition that, as explained in lines 195-201, detectors converge to learn a shared underlying human text distribution with the aim of minimizing false positives and false negatives. Hence we can use one detector to guide the paraphrasing process for evading other detectors that share the same underlying human distribution, effectively \"pulling the text sample towards that human distribution\". That said, this remains just an intuition, as neither the true human distribution nor the internal distributions learned by the detectors are directly observable or measurable to verify this.\n\nWe kindly clarify that the goal of this paper is to **propose an attack** that automatically guide the paraphrasing process to universally evade detection while preserving the original meaning and quality of the text. So the ultimate goal is detection evasion rather than style transfer.\n\nWe also explored using stylistic representations of text during the rebuttal but found that human writing styles vary too widely to define a consistent stylistic signature. For instance, applying CISR [1] to our human text samples yielded a mean pairwise cosine similarity of 0.5140 (std = 0.3467), reflecting significant variation of style within the human text distribution. This shows that human text style is highly diverse and not singular in style, making it difficult to measure the notion of stylistically \"human-likeness\". However, as mentioned, we do include many examples in Table 1 of the main paper and Tables 4–10 of Appendix D for human inspection. \n\n[1] Wegmann et al. \"Same Author or Just Same Topic? Towards Content-Independent Style Representations.\"\n## What happens if there is a tie between all candidates?\nThanks for raising this concern. We kindly clarify that for any decent detector, it’s highly unlikely that all 50 candidate tokens receive identical scores at a given token step—and virtually impossible across multiple steps. In such rare cases, we default to multinomial sampling, consistent with the default LLM decoding step.\n## GPT-4o ratings compare paraphrased text against original AI text, not human text\nThank you for your suggestion. We respectively clarify that the main purpose of the text quality analysis is to ensure the attack preserves the semantics, fluency, and coherence of the original text before and after paraphrasing. Since our goal is to paraphrase AI-generated texts to evade detection, it is these AI texts that serve as the reference for evaluating the quality of the paraphrased outputs.\n## Failure cases and backfires?\nYes, our attack isn't 100% successful, and backfiring can happen—though it’s rare. Assuming a fixed detection threshold of 0.5 for NN-based detectors and focusing on the more challenging transfer setting (i.e., different guidance and deploy detector pairs), we analyzed 24000 samples:\n- In 5742 cases, the detection score actually went up after paraphrasing.\n    - Of these, 1773 examples were flagged as AI before paraphrasing. So the attack failed.\n    - 2974 examples were flagged as human both before and after, meaning they evaded detection in both cases—so the attack didn’t worsen outcomes.\n    - 995 examples were flagged as human before, but after paraphrasing the score rose above 0.5, getting flagged as AI. These are the backfiring cases.\n\nSo in short:\n- The attack failed in 1773 cases (~7.4% of all samples).\n- It backfired in 995 cases, which is only about 4.15% of all samples.\n\nWe'd like to emphasize that despite these occasional failures, our method significantly outperforms baselines in lowering AUC and T@1%F, as shown in our results. Some failure cases are expected, but they do not undermine the overall effectiveness and transferability of our attack.\n## Computation overhead and latency?\nThank you for considering this aspect. First we'd like to kindly clarify that **we don't need to run a detector 50 times per token**, as all candidate paths are simultaneously fed into the guidance detector as a batch. So we actually only run it once.\n\nTo evaluate latency, we ran adversarial paraphrasing on 100 random samples, using 5 trials per setting and all 4 guidance detectors. For consistent per-sample timing, we used a batch size of 1. In practice—including in our main experiments—we use larger batches to reduce overall runtime. Average per-sample paraphrasing time (in seconds) across 5 trials is reported below as mean ± std:\n- Simple paraphrasing: 7.18 ± 0.13\n- Guidance=RADAR: 9.69 ± 0.20\n- Guidance=MAGE: 16.71 ± 0.74\n- Guidance=RoBERTa-Large: 10.20 ± 0.18\n- Guidance=RoBERTa-Base: 8.64 ± 0.11\n\nAs shown, most guidance detectors introduce relatively low latency compared to simple paraphrasing. The higher latency observed with MAGE is due to its LongFormer-based architecture, which incurs longer inference time than the RoBERTa-based models. \n\n**Overall, the latency is primarily determined by the complexity of the guidance detector itself.** From a computational view, the detector adds minimal overhead. The paraphrasing LLM (~8B parameters) dominates FLOPs, while detectors have only 100–350M parameters—under 5% of the paraphraser's size for larger detectors, and under 2% for smaller ones.\n\nNote that runtime per sample may vary with sequence length. To ensure a fair comparison—i.e., that AdvPara generates a similar number of tokens as simple paraphrasing—we report the mean and standard deviation of token counts:\n|Text|Mean Token Count|Std Dev|\n|-|-|-|\n|Original texts|173.73|38.46|\n|Simple Paraphrase|170.81|39.69|\n|AdvPara (RoBERTa-Base)|175.30|51.27|\n|AdvPara (RoBERTa-Large)|171.25|45.39|\n|AdvPara (RADAR)|169.68|60.07|\n|AdvPara (MAGE)|164.18|54.39|\n## Hyper-Parameter Ablations\nThanks for the suggestion. We've already explored using 4 different guidance detectors in our experiments, and reported all results in Figures 3 and 4, and Table 2.\n\nTwo other main hyper-parameters related to our work are the values of $p$ and $k$ used in top-p and top-k masking. We used p=0.99 and k=50 in our paper, with k=50 matching the HuggingFace Transformers default. To assess their impact, we conduct ablation studies using OpenAI-RoBERTa-Large as the guidance detector on 500 randomly selected texts. We report mean AUC and TPR@1%FPR across all 8 deployed detectors.\n\nDefaulting to k=50 while varying p:\n| |Mean AUC|TPR@1%FPR|Quality Rating|\n|-|-|-|-|\n|No Attack|0.8419|0.4935|–|\n|Simple Paraphrase|0.8588|0.2885|4.75 ± 0.54|\n|AdvPara (p=0.5)|0.8606|0.2985|4.86 ± 0.45|\n|AdvPara (p=0.8)|0.7895|0.2230|4.79 ± 0.48|\n|AdvPara (p=0.9)|0.7309|0.1820|4.79 ± 0.48|\n|AdvPara (p=0.95)|0.6816|0.1480|4.81 ± 0.44|\n|AdvPara (p=0.99)|0.5433|0.0690|4.50 ± 0.67|\n|AdvPara (p=0.991)|0.5381|0.0592|4.47 ± 0.73|\n|AdvPara (p=0.992)|0.5244|0.0565|4.37 ± 0.76|\n\nWe observe that when $p$ exceeds 0.99, the marginal gains in attack effectiveness diminish relative to the losses in text quality. Additionally, as one can imagine, further increasing $p$ slows down generation speed. Therefore, we select $p = 0.99$ as a balanced trade-off among attack effectiveness, text quality, and generation speed.\n\nDefaulting to p=0.99 while varying k:\n| |Mean AUC|TPR@1%FPR|Quality Rating|\n|-|-|-|-|\n|No Attack|0.8419|0.4935|–|\n|Simple Paraphrase|0.8588|0.2885|4.75 ± 0.54|\n|AdvPara (k=10)|0.5596|0.0757|4.47 ± 0.77|\n|AdvPara (k=25)|0.5448|0.0658|4.48 ± 0.73|\n|AdvPara (k=50)|0.5433|0.0690|4.50 ± 0.67|\n|AdvPara (k=75)|0.5421|0.0698|4.52 ± 0.73|\n|AdvPara (k=100)|0.5426|0.0698|4.51 ± 0.70|\n\nWe can see that with $p$ fixed at 0.99, the values of $k$ show relatively smaller influence, and mostly lead to comparable results. Hence we just stick with the default value in the HuggingFace Transformer library.\n## Can selecting tokens that were not the lowest-scoring also avoid detection?\nThank you for your suggestion. We kindly clarify that \"selecting tokens that were not the lowest-scoring\" is exactly what our simple paraphrasing baseline does. At each step, the LLM samples randomly from the top-k tokens without detector guidance, making it unlikely to choose the lowest-scoring option. Even if, by chance, the sampled token at a particular step aligns with the lowest-scoring option, it is almost impossible for this to occur across multiple or all steps. As shown in our results (Table 2 and Figures 3 and 4), simple paraphrasing strategy can reduce detection rates to some extent, but it is significantly less effective than AdvPara."}]

Author rebuttal:

Meta-review: This paper introduces Adversarial Paraphrasing, a training-free framework that humanizes AI-generated text by guiding an LLM with an AI text detector. Reviewers liked the creativity, strong empirical effectiveness, and broad transferability of the attack across diverse detection systems. The comprehensive experimental evaluation was also a noted strength.

As far as weaknesses, the reviewers pointed some out, but in basically all cases, the authors responded with rebutall that satisfied the concerns. I would encourage the authors to use these additional experiments and analaysis to strength the final paper.

Some of these included: 
1) Questioning the definition of "text quality" and the claim of "humanizing" text. Authors clarified their quality metrics (GPT-4o, win-rate, perplexity), added semantic similarity, provided more examples, and revised "human-likeness" terminology which addressed these concerns.
2) Efficiency: Authors provided empirical latency measurements, explaining the low overhead relative to the paraphraser LLM.
3) Baseline Comparisons: A reviewer suggested a "pick-best-of-N paraphrases" baseline. Authors added this experiment, demonstrating their method's better performance even against this strong baseline.
Ablation Studies & Failure Cases: Reviewers requested more hyper-parameter ablations and analysis of failure cases. Authors provided these
4) Necessity of per-step guidance: A reviewer questioned why guidance was needed at each decoding step. Authors provided an ablation showing that per-step guidance is indeed more effective than less frequent guidance. 

The authors were very on-the-ball in addressing the concerns raised by reviewers, who consistently thought highly of the work. The authors provided strong empirical evidence for the attack's effectiveness, and the work is useful for highlighting vulnerabilities in current detection strategies and will motivate more research in this area as well as in defenses against these attacks.
Decision: Accept (poster)