OSTAR: Optimized Statistical Text-classifier with Adversarial Resistance
Authors: Yuhan Yao
Feifei Kou
Lei Shi
Xiao yang
Zhongbao Zhang
Suguo Zhu
Jiwei Zhang
Lirong Qiu
LI Haisheng
Venue: NeurIPS 2025 poster ()
Keywords: MGT detection、Adversarial Robustness、Contrastive Learning
Primary area: applications

Abstract: The advancements in generative models and the real-world attack of machine-generated text(MGT) create a demand for more robust detection methods. 
 The existing MGT detection methods for adversarial environments primarily consist of manually designed statistical-based methods and fine-tuned classifier-based approaches. 
 Statistical-based methods extract intrinsic features but suffer from rigid decision boundaries vulnerable to adaptive attacks, while fine-tuned classifiers achieve outstanding performance at the cost of overfitting to superficial textual feature.
 We argue that the key to detection in current adversarial environments lies in how to extract intrinsic invariant features and ensure that the classifier possesses dynamic adaptability.
 In that case,  we propose OSTAR, a novel MGT detection framework designed for adversarial environments which composed of a statistical  enhanced classifier and a Multi-Faceted Contrastive Learning(MFCL).
  In the  classifier aspect, our Multi-Dimensional Statistical Profiling (MDSP) module  extracts intrinsic difference between human and machine texts, complementing classifiers with useful stable features. 
  In the model optimization aspect, the MFCL strategy enhances robustness by contrasting feature variations before and after text attacks, jointly optimizing statistical feature mapping and baseline pre-trained models. 
  Experimental results on three public datasets under various adversarial scenarios demonstrate that our framework outperforms existing MGT detection methods, achieving state-of-the-art performance and robust against attacks.The code is available at https://github.com/BUPT-SN/OSTAR.

OSTAR: Optimized Statistical Text-classifier with Adversarial Resistance
Yuhan Yao Feifeii Kou 12+ Lei Shi Xiao Yang', Zhongbao Zhang', Suguo Zhu* Jíwei Zhang', Lirong Qiu Haisheng Li
School of Computer Science (National Pilot School of Software Engineering), BUPT
Key Laboratory of Trustworthy Distributed Computing and Service, BUPT, Ministry of Education 3 State Key Laboratory of Media Convergence and Communication, CUC *College of Computer Science and Technology, HDU School of Computer and Artificial Intelligence, BTBU * *Correspondence: koufeife houfeifei000@buppe edu cn
Abstract
The advancements in generative models and the real-world attack of machine- generated text(MGT) create a demand for more robust detection methods. The existing MGT detection methods for adversarial environments primarily consist manually designed statistical- based methods and fine-tuned classifier-based approaches. Statistical-based methods extract intrinsic features but suffer from rigid decision boundaries vulnerable to adaptive attacks, while fine-tuned classifiers achieve outstanding performance at the cost of overfitting to superficial textual feature. We argue that the key to detection in current adversarial environments lies in how extract intrinsic invariant features and ensure that the classifier possesses dynamic adaptability. In that case, we propose OSTAR, a novel MGT detection framework designed for adversarial environments which composed of a statistical enhanced classifier and Multi- Faceted Contrastive Learning MMFCL.. In Statistical Profiling (MDSP) module
the classifier aspect, our Multi-Dimensiin extracts intrinsic difference between human and machine texts, complementing classifiers with useful stable features. In the model optimization aspect, the MFCL strategy enhances robustness by contrasting feature variations before and after text attacks, jointly optimizing statistical feature mapping and baseline praitrdieed models. Experimental results on three public datasets under various adversarial scenarios demonstrate that our framework outperforms existing MGT detection methods, achieving state-of-the-art performance and robust against attacks. code is available at https: //tg//gttttt/ttt com/ BUPT-SN/OSST
Introduction
With the remarkable and rapid progress in Large Language Models (LLMs) 22,, the quality of machine-generane text has gradually achieved a level that is increasingly comparable to human- authored content. However, the widespread proliferation of such text substantially risks amplifying the dissemination of unreliable misleading information and diminishing motivation of human authors. As clearly shown in Figure ((a), which illustrates a real-world detection scenario, MGT texts are often attacked evade detection, critically challenging the robustness of existing detection methods 6 7 g Therefore, developing reliable detection methods that can robustly distinguish MGT from human-authored content has become crucial task in societal research.
S 3 the creative
As shown in Figure 1(b1) and Figure 1(b2), the current MGT detection methods for adversarial environments can be categorized into two approaches: statistical-based methods and classifier-based
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

MGT Detection(a)
Method Comparison(b)
Statixtical Metheds (bl)
Prompt
Inputtt
Statistically
Feature Analyze
Extract
Threshold Discrimination
Classification Methods (b2)
Human Machine
Generate
Pre-Trained Model
JCLS]
Classifier
Candidate
Train Text
Text
Fine-tune
Affacks
OSTAR (b3)
Datu Preparation
MDSP
MFCL
Attacked
Enhanced Classifier
CE Loes
Text
Total Loss
Detect
Pre- Trained
Grad
Model
Human/
Machine
Figure 1:
The real-world MGT detection task explanation and the difference between OSTAR and previous detection methods.
methods. While statistical-base methods | I0 demonstrate strong zero-shot generalizability across LLMs through intrinsic features (c.g.. n-gram distributions, syntactic anomalies), their de- tection performance is constrained by predefined static thresholds that fail to dynamically adapt to distribution shifts in textual feature patterns under adversarial attacks like lexical substitution or style transfer, leading to significant accuracy degradation. The classifier- based methods [12 [3] rely on pre-trained models (e.g.. BERT(14) extract deep semantic features through loss function optimization. Although achieving high accuracy on specific datasets, the learned feature representa- tions carry overfitting risks: models tend capture superficial correlation patterns in training data (e.g., Nomainn-specife sentence structures) rather than the intrinsic differences between human and machine-generann texts. This results in unstable feature representations, leading to sharp decline in detection performance when distributional discrepancies exist between testing and training data, Collectively, these limitations highlight critical gaps existing detection paradigms: statistical meth- ods lack adaptation to attacks, classifier-basee approaches struggle to capture the intrinsic invariant feature differences between human and machine texts under adversarial attacks.
Given the limitations of current methods in addressing textual attack, single-category detection methods now struggle achieve figh-precision MGT detection in adversarial environments. Our ob- servations reveal that classifier-based methods often demonstrate superior performance on individual datasets, yet exhibit significant performance degradation when confronted with attacked texts. In contrast, although statistics based detection methods show relatively weaker bascline metrics, certain textual feature statisties (such Lexical Diversity and Readability) maintain relatively stable devia- tions between attacked and original texts. This characteristic could serve as an effective mechanism enhance the robustness of classifier-based methods when operating in adversarial environments. The classifier- based methods can compensate for the shortcomings of statistical methods in feature dynamic adaptation caused by rigid thresholds, as they are capable of developing classification abilities tailored to specific datasets through loss function optimization.
Based the respective limitations and potential complementarity of the sratistical-basse methods and classifier-basse based methods, this paper proposes the Optimized Statistical Text-classifier with Adversarial Resistance (OSTAR) framework shown in Figure 1(b3). To improve the stability of detec- tion, we design the Statistically Enhanced Classifier, which captures the intrinsic text statistical fea- tures thereby enhancing classifier performance. Specifically, we manually design Multi nuutti-Dimensioall Statistics Profiling(MDDS) to extract and analyze statistical features of texts. These analyzed statis- tical features are then concatenated with the CLS embeddings generated by pre-trained models to form an enhanced classifier. To enable dynamic feature adaptation in adversarial environments, we categorize attacks into Perturbation and Paraphrases based on whether machine rewriting involved, distinguishing them by their impact text characteristics. Guided by this perspective, we design Multi-Feature Contrastive Learning (MFCL). This categorization effectively differentiates attack types by their intrinsic properties, and MFCL significantly enhances the robustness of our method in

---

adversarial scenarios. Extensive experiments across several datasets and adversarial environments consistently demonstrate that our proposed method outperforms previous approaches, establishing new state-of-the-ar performance.
The main contributions of our work are as follows:
We propose a novel MGT detection framework, OSTAR, which captures the intrinsic differences between seccine-generated text and authn-a text and enables dynamic adaptation of detection. To our knowledge, this is the first work to utilize statistical features to guide classifier- method, enhancing its robustness adversarial environments.
We manually designed the MDSP for intrinsic textual characteristics, which effectively captures intrinsic, relatively stable textual multi-dimensional statistical features across diverse scenarios. This mechanism provides solid foundation for classifier-based methods.
We categorize attacks into perturbations and paraphrases based on the intrinsic characteristics of their impacts, and design MFCL to comprehensively capture the manifold adversarial effects on text from multiple perspectives, significantly enhancing the overall robustness of our method.
Through extensive evaluations three public datasets under diverse adversarial scenarios, OSTAR achieves superior performance and robustness compared to state-of-the-an MGT detection methods.
2 Related Work
2.1 Machine-generated Text Detection
With the rapid development of LLMs, machine-generatee texts, also known as Al-generated texts Deepfake texts, have made it increasingly difficult for people distinguish them from human-authored texts [15]. Nowadays, common detection methods can be categorized into three watermrat -based (16). stadistics-based and classifier-based. The watermark-based methods achieve detection of machine-generated text by embedding subtle watermark during the text gen- eration phase and subsequently detecting the presence of watermarks in the generated content [8 19 20 21 22). Statistics-based methods often focus on identifying the inherent character- istic differences between human-authoree authored and machine- gennrrttd texts by establishing thresholds for differentiation, demonstrating applicability across various models IO 23 24 (25 [I]]. For ex- ample, Eduard 255 proposed distinguishing human and machine texts by analyzing differences in the intrinsic dimensionality of their generated embeddings, achieving stable detection performance across multiple cross-domain and cross-modes scenarios. Classifier-basee methods can be viewed as binary classification task, where the detector is typically trained on datasets generated by the target LLM to achieve nigh-peeformance detection for the target generative model 26 27 28 29 30 For example, SimpleAl [29] fine-tunes RoBERTa, removes biased training data for better generalization, and adds sentence-level data to capture local features. Current MGT detection methods excel on
clean data but falter against adversarial attacks. Howerver, many studies g 32
33
6 34] have
indicated that current MGT detectors exhibit vulnerabilitics in real-world detection scenarios, facing challenges to their robustness when subjected to various attacks and adversarial paraphrasing from other pre-trained models. Therefore, maintaining detection robustness in adversarial environments remains major challenge in current MGT detection tasks.
2.2 Contrastive Learning
Currently, in the field of natural language processing, contrastive learning methods can effectively enhance the robustness of frameworks against adversarial attacks 36 37 38
30
39
27
40) For
example, PairCFR (37] enhances the generalization performance of natural language processing tasks when handling counterfactually augmented data by promoting global feature aligument through con- trastive learning; DeTeCtive (38] boosts MGT detection generalization through multi-level contrastive learning that identifies cross-sample author style gaps under outtr--distributtin task; CoCo 30) tackles sparse training data via contrastive learning, achieving superior performance with minimal training datasets; PESCO[39] addresses the cold-start problem in Zero-Shot text classification by dynamically optimizing document-labe matching through self-training loop of contrastive learning.
3

---

Adversarial Data Preparation(a)
Statistically Enhanced Classifier())
Perturbated
Paraphnazed
Stanksleul Feature
Sequential Sturisticul
Enhanced
Machune Texr
ExtrccionSS
Feature Anolysis (P))
Classifeen())
Port
Original Machine
Pana,
Payaserc
Spated
Multi-Faceted
Gemerate Tent
Pipasinn
4-D Analysis
Contrast Learning
(MFCL/e)
Original Human
Text
Pert
Para
Total
Pertunbatedd
Paraphrased
Loss
Human Tenz
Human Tixt
Multi Dimensional Statistical Profiling (MDSP)
Grad
Negaaig
Con
Prudtine
RoBERTa (E,)
JCLS/
Figure 2: An overview of our OSTAR framework. (a) Adversarial data generation and contrastive learning pair construction (b) Enhancing classifier performance via MDSP (c) Performing contrastive learning and computing loss through MFCL
Existing research demonstrates that contrastive learning exhibits broad applicability and effectively enhances model performance in natural language processing, particularly for MGT classification.
3 OSTAR: Framework and Algorithms
We start this section by giving an overview the framework of OSTAR. Then, we detail the specific methods for each step in Sections 3.1 to 3.3. Finally, we will summarize the entire training process into an algorithmic procedure in Section 3.4.
Abstract Methodology As shown in Figure during the training stage, our OSTAR consists of three parts as follows:
Part a (Adversarial Data Preparation): Prior training, we pre-process the original dataset O to construct the contrastive pairs. Specifically, we apply Perturbation Source Pert generate perturbation pairs and Paraphraser Para, produce paraphrase pairs.
Part b (Statistically Enhanced Classifier): During the initial stage of the training phase, statistical feature extraction performed each sentence using Statistical Feature Extraction
S.g. Once the S,p has processed the entire text, Sequential Statistical Feature Analysis W, will analyze the intrinsic statistical feature with sliding windows of length I and the 4-D Analysis method. Then, the outputs of W, are projected and concatenated with the CLS token from Pre-Trained Model (RoBERTa used in this paper) Eg for Enhanced Classifier C.y to classify.
Part (Multi-Faceted Contrast Learning): MFCL, perturbation contrastive learning and paraphrase triplet contrastive learning are designed for adversarial environments, optimized with updating and 7.
3.1 Adversarial Data Preparation
In terms of adversarial data preparation, as shown in Figure 2(a), we categorize training texts into two types: original human-authored and original mnchine-generated texts, and texts that may be encountered during detection (divided into Perturbation and Paraphrase). This design is based on the rationale that paraphrases often lead to changes in text ownership. such as transforming text from being generated by LLM to being written by Para,, or converting human- written text into machine- generated content. In contrast, perturbations do not involve ownership alteration but can affect text recognition accuracy. Therefore, we preprocessed the training set by Perly and Para,, then assigning positive and negative sample pairs according to Figure 2(a), and dynamically constructing the dataset in each epoch.

---

3.2 Statistically Enhanced Classifier
The Statistically Enhanced Classifier is composed of Multi- Dimensional Statistical Profiling section 3.2.1 and the Enhanced Classifier with Pre- Trained Model in section 3.2.2.
3.2.1
Multi-Dimensional Statistical Profiling (MDSP)
As shown in Figure 2(b), MDSP consists of two components: Statistical Feature Extraction and Sequential Statistical Feature Analysis.
Statistical Feature Extraction(S,,) With the increasingly powerful generative capabilities, relying solely on surface-level statistical features of text has become insufficient for robust MGT detection. While machine-generatee texts exhibit certain statistical similarity with human-authored texts in surface patterns, they still demonstrate discernible differences in intrinsic statistical characteristics such variations in sentence complexity, lexical diversity shifts, and semantic coherence dynamics within a document.
In this paper, focus extracting statistical features from three dimensions--ynnanne lexical, and semantic-by quantifying metrics such as the maximum dependency distance per sentence (syntax), the Flesch-Kincaid Grade Level (lexical complexity), and the variance across dimensions in semantic embedding projections (semantic coherence), thereby capturing multi-level discriminative patterns between human-authored and machine-generatee texts, the three-dimensional features extraction can be formally formulated as follows:
(s))
max head FFK
cos ee e;+1)
Lexical
Syntax
Semantic
where, represents a single sentence in an article, denotes the tokens in sentence s, head(t) is the head index of token f, max head(.) represents Maximum dependency distance parse tree, JFK () is the Standard Bescch-Kincii Grade Level formula, {ei, en denotes the sentence embeddings from MiniLM, cos(-) is inter-sentence cosine similarities.
Sequential Statistical Feature Analysis(W;) When performing statistical feature analysis, we employ sliding window of length with a step size to segment the text. For each feature dimension E {Syntax, Lexical, Semantic), ). we design 4-D Analysis module to analyze the statical feature and use a 4D-feature vector Fa R store the outputs, aggregating four key measures: mean value (μa), standard deviation (axz), autocorrelation coefficient (pa), and range (Ra). The process is formally formulated follows:
Pd = WE Σ
(k)
- Eyewr (y Ma (k)yz
F [Pd dd Pd. Ra]
N
Pd autocorr(Whh)
R(A) -oan(W"+m(iiee))
where W denotes the sequential statistical features k-th sliding window, y represents the statistical feature sentence within the window W
For an input text sequence $ = {s1, $2, sn) with n sentences, we compute window-based statistics across three linguistic dimensions (syntax, lexical, semantic) as follows:
BRW
Σ
<(Wl))
E 12
WWay
de Lem
w
where, THa E 12 denotes Raw temporal feature vector formed by concatenating window statistics across three dimensions, ((W)) denotes the k-th sliding window for (k) (k),, (k)), R(M), Wia {WL (dy..... , ) represents the Sliding windows for dimension d.
5

---

Algorithm OSTAR train process
Require: Original dataset O (H,M), M), Perturbation Source Perty, Paraphraser Paras
Ensure: Trained parameters (Analyzer), (Classifier), Trained Model)
Frozen Components:
2: S.. Para. Pertæ
3: Trainable: W,, C., Eg
4: Adversarial Data Preparation:
5: Generate Pert & (c)
D Perturbation pairs Paraphrase pairs
6: Generate Pore Para.
7: Build D <- OUOOUU UUOOOUO UOA
8: for epoch to N do
9:
for batch (ar, Pert, Para)
do Statistical Feature Extraction:
10:
for each sentence 8; do
12:
Extract ((x)) = max FFx(())).FF((()). n-T Σ cos ex41)
13:
end for
14:
Sequential Statistical Feature Analysis:
15:
Apply sliding window (I = 3, step= on 4 sequence
Compute window 4-D stats: Traw 1 >m [kx oo Pk. Ru
17:
Project: T = San TEw + be)
Statistical Enhance:
19:
h (x(
> RoBERTa -332-im
20:
fa concat(h,, T
21:
Multi-Faceted Learning:
epplo
22:
Compute Para-contrast loss: Lrara log ex etalr
23:
Compute Pert-contrast loss: Leen +- BarSa
Parameter Update:
25:
T. 0 7 A) Lee + (A1 Lpan + A2 Lpen)
end for
27:
end for
return 7","""00"
3.2.2 Enhanced Classifier(C.)
The output Taw of Multi-Dimensionas Statistical Profiling is used to enhance classifier-based method by projection, the formula is as follows:
Proj tanh (W,, T + b.) E 04 where W, E R24x12
64 represents the projected features after nonlinear transformation, W, E RR 624x12 denotes the learnable projection matrix mapping raw features to latent space, tanh(-) is the hyperbolic tangent activation function constraining values to [-1, 1].
where, T
Then the Eg encodes the input text S and the resultant 768-dimensional CLS embedding from the last layer is concatenated with the projected statistical features for classification.
3.3 Multi-Faceted Contrast Learning(MFCL)
MFCL can be divided to Paraphrase Contrastive Learning(Paraa Para-contrast) and Perturbation Contrastive Leaminn(Pert-contrass In Para-contrast, anchors are defined as (original human write text) and (original machine generate text), where the positive and negative samples vary based on the anchor type: when the anchor H, positive samples consist of other original human texts while negative samples are Hparos whereas for machine-generated anchors (M), positive samples are Mp and negative samples include any human H. In Pert-contrast only positive cumples-correspooddng to adversarially attacked versions of the specified text (Hl pert M are utilized. The Multi-Face FacteeFaccted

---

Contrast can be formulated as follows:
3pp/T
LMFCI. X1
log
EvEP() SilT + EmeN(y StalT + +
Σ at aEA(t)
Biar
(5)
PEP())
Leso
Crea
where, p E P(i) and (i) denote the positive and negative sample sets for anchor Sip and Sin are similarity scores between anchor and its positive/negative samples, scaled by temperature to sharpen or soften the contrastive probability distribution; A(i) adversarially perturbed sample sets, Sia denotes the is the similarity scores between anchor and perturbed samples, weighted by attack impact ratio Sio and scaled by regularization coefficient r, X and A2 denote the weighting coefficients for Lara (paraphrase loss) and Lpen (perturbation loss), respectively.
The total loss function is composed of the Cross-Entrope LCB loss and LMFCL. formulated as:
Luuaal
(1 X) LCE + À LMFCL
(6)
where À are weighting coefficients.
3.4 OSTAR Algorithm
The overall training process of OSTAR is summarized in Algorithm 1. For given text, OSTAR extracts its statistical features supplementary information and concatenates them with embed- dings generated by pre-trained model. These representations are then aligned with Multi-Faceted Contrastive pairs to enhance the model's robustness against attacks.
4 Experiments
4.1 Experiment Setup
Datasets and Real-worid Attacks In this study, we employed three widely-used and moderately challenging datasets: (heckGPT[41], HC3 and cross-domain dataset generated by GLM-130B from the DeepFake(33). CheckGPT comprises 900,000 multi-domain samples (e. (e.g.news, reviews and articles) generated by ChatGPT[] using diverse prompts. HC3 is composed of question-anse answer pairs, where each question includes least one human-written response and one response, focusing open-ended questions across domains such as finance and medicine. DeepFake contains pross-domain texts generated by various I.LMs. To capture real-world MGT diversity, employ GLM-130DB [2] as the representative dataset. Adversarial attacks categorized into perturbation and paraphrase attacks. For perturbation, the specific perturbations adopted are as follows. For the paraphrase, we employ DIPPER 6 modify the text. More detailed dataset construction is shown appendix
Character-level Perturbations:
Space Insertion: Introduce extraneous whitespace within words (e.g., "hel_lo")
Punctuation Removal: Delete commas, periods, etc. (c.g., "Hello, world!" + "Hello world")
Initial Character Case Alteration: Randomize capitalization of word-initial letters (e.g.. "apple" - "Apple")
Word Merging:
Concatenate adjacent words (e.g., york" + "newyork")
Word-level Perturbations:
Keyboard Typos: Simulate typographical errors via adjacent key substitutions (e.g.. "house" - "hjuse")
Character WordCase: Randomly alter the case of letters within words (c.g., "example" + "ExAmPIE")
Spelling Errors: Insert phonetically plausible misspellings (e.g., "because" "becuz")
Adverb Insertion: Add semantically redundant adverbs within sentences (e.g., "He ran quickly" - "He ran extremely quickly")
7

---

Table 1: Detection performance comparison under original datasets. The west-performing data under each metric has been bolded. Due dataset balancing, the values of accuracy, recall, and Fl score will be relatively close when the model is well-trained and the architecture is stable.
DeepFake
CheckGPT
HC3
Methods
ACC
Recall
F1
ACC
Recall
F1
ACC
Recall
F1
GPT-2
87.29
90.58
88.04
81.92
83.01
80.74
90.86
90.75
89.41
RoBERTa
91.68
91.57
91.66
88.77
87.82
88.78
94.32
94.31
94.32
CoCo
88.03
89.59
87.58
84.55
84.90
85.97
98.42
99.31
98.50
RADAR
55.49
55.49
58.05
63.04
63.26
63.01
89.57
89.57
90.39
Watermark
86.21
90.45
88.91
75.69
97.06
72.26
94.88
94.75
95.13
Binoculars
78.22
82.41
76.39
86.90
89.74
87.12
92,44
95.13
91.95
PECOLA
86.29
86.19
86.29
84.58
84.96
84.51
99.23
99.25
99.24
OSTAR
91.94
92.38
92.36
90.37
90.12
90.23
99.55
99.78
99.55
Adverb Append: Attach an additional adverb the end of sentences (e.g., "The task is done." + "The task is done. perfectly")
Sentence-level Perturbations:
Sentence Reversal: Invert word order (e.g.. "This a test." - "Test is this.")
Sentence Repetition: Duplicate clauses/phrases (c.g.. "I agree. I agree.")
To ensure a comprehensive and systematic evaluation of our work, we adopted widely recognized metrics for binary classification task AAcuracy (ACC), Recall, and Fi-score (F1)-to evaluate model performance.
Evaluation Metric
Comparison Methods We compare our method with classifier-based state-of-the-art MGT de- tectors, including: GPT-2 [33 and RoBERTa 44] fine-tuned as binary classifiers (124M/1 1OM
parameters); CoCo 30 employing contrastive learning with coherence graphs; RADAR 26 us- ing adversarial paraphrases for robustness; Binoculars [[]] leveraging cross-model probability divergence for zero-shot detection; the watermark- method Watermark (20) for reference. Statistic-based methods are excluded due to limited adversarial robustness; PECOLA 22 enhancing robustness via core-term perturbation.
To ensure experimental fairness, we utilized data-augmented datasets for training all classifier-based contrastive methods, with the exception of RADAR (whose code was unavailable, necessitating the use of their open-source model). For non-trainable approaches - including statistical-ban methods (e.g.. Binoculars) and watermark-based techniques (e.g., Watermark) no training phase was implemented, as their detection mechanisms rely on pre-defined heuristics rather than learnable parameters. All experiments strictly adhered to the original implementations' default training configurations. For methods requiring specialized data preprocessing pipelines (e.g., CoCo), we faithfully executed their prescribed preprocessing steps as outlined in their respective methodologies.
4.2 Performance Evaluation
Evaluation on Original Datasets The detection evaluation on the original dataset is shown in Table I. OSTAR achieved average Acc, Recall and 93.95% 94.09 94.09%, and 94.04% across the three datasets, outperforning the fine-tuned RoBERTa baseline by average improvements of 2.81 % (ACC), 2.85% (Recall), and 2.97% (F1). Morcover, compared to state-of-the-ar methods on the MGT detection task, OSTAR attained at least 1.32%. 1.42%, and 1.05% enhancements in ACC, Recall, and F1, respectively, while achieving the best performance across all three datasets. These results demonstrate that our method outperforms the baseline approaches in average detection quality under non-attack scenarios.
Furthermore, evidenced in Table 1, the incorporation of statistical feature analysis in our method consistently enhances the detection performance of the baseline RoBERTa model across all three datasets, empirically validating the efficacy of our feature analysis approach. Notably, the DeepFake dataset poses the greatest challenge for models. We attribute this to the fact that GL.M-10B- used model not adequately considered by conventional pre-
to generate DeepFake

---

Table 2: Detection performance of OSTAR and the baselines on datasets with attack. We adopt FI- score as the evaluation metric when facing attack, where we categorize attack into PerturbattoonPertt) and paraphrases(Paraa) The best-performing data under each metric has been highlighted in bold.
DeepFake
CheckGPT
HC3
Methods
Ori.
Pert.
Para.
Ori.
Pert.
Para.
Ori.
Attack
Para.
GPT-2
88.04
74.23
73.41
80.74
70.58
72.56
89,41
82.72
81.63
RoBERTa
90.12
77.10
79.00
88.78
80.62
81.59
94.32
90.27
90.95
CoCo
87.58
69.54
76.95
85.97
70.38
74.58
98.50
90.09
90.98
RADAR
58.05
48.54
47.11
63.01
60.21
67.42
49.78
47.52
58.47
Watermark
88.91
66.35
47.01
72.26
55.16
50.07
95.13
69.05
68.16
Binculars
76.39
45,42
51.23
87.12
52.32
54.54
91.95
72.34
78.68
PECOLA
86.29
78.13
60.08
84.51
62.64
60.71
98.35
65.09
68.82
OSTAR 92.36
81.27
81.46
90.23
84.48
86.04
99.55
95.72
97.52
Table 3: Results of the ablation study on DeepFake dataset with adversarial attacks We selected Accuracy and Fi-score for evaluating, with the best-performing results highlighted in bold.
Orginal
Pert.
Para.
Model
ACC
F1
ACC
F1
ACC
F1
OSTAR (Plain)
90.34
90.12
81.10
77.10
82.61
79.00
OSTAR (Feature Extract)
90.72
90.58
81.67
77.08
82.97
79.27
OSTAR (Feature Extract+Anallsis)
92.17
92.87
82.51
80.25
83.88
80.17
OSTAR
91.94
92.36
84.34
81.27
84.75
81.46
trained frameworks, thereby requiring re-adaptation to its unique text generation patterns. Our method achieves significant improvements on GLM-13055 demonstrating that the statistical feature analysis approach we proposed serves as a universal feature analysis method for MGT.
Evaluation on Attacked Datasets The ability of detection methods to maintain robustness across diverse attack types constitutes fundamental research problem, this capability directly determines their practical applicability in real-world environments. The changes the model's Fi-score across the three datasets under these two types of attacks serve the robustness measure for method. As shown Table 2, our proposed OSTAR framework achieves state-of-the-arr F1-scores across all 9 experimental scenarios, which encompass three diverse public datasets (CheckGPT, HC3, and DeepFake) under three distinct conditions (original, perturbation-attakked and paraphrase-attacked environments). Under adversarial perturbations, OSTAR exhibits maximum Fl degradation of only 11 11.09% on the challenging DeepFake-Perturbatte Perturbation subset, significantly outperforming the statistical method Binoculars, which suffers 30.97% degradation this stark contrast underscores the inherent limitations of relying solely on static statistical thresholds for real-world robustness. Moreover, with an average F1 degradation of 6.30% against combined perturbation and paraphrase attacks across all datasets, OSTAR surpasses even the most robust baseline model, RoBERTa (which shows 8.49% degradation), thereby highlighting our framework's ' superior adversarial resilience. Furthermore, OSTAR achieves an average F1 improvement of 4.43% over the RoBERTa baseline, with a maximum gain of 5.5% observed on the HC3 dataset under adversarial attacks-these results collectively demonstrate substantial robustness enhancement and validate the effectiveness of our approach in practical settings.
4.3 Ablation Study
To better validate the necessity of each module in our model, we conducted ablation studies on Deep- Fake dataset. The reason why chose the Deepfake dataset as it showed the sharpest performance drop under adversarial environments, best demonstrating our method's robustness in adversarial scenarios. The ablation study structure designed follows:
OSTAR R (Plain) removes the entire Statistical Feature component, retaining only the RoBERTa part. During model training, it also eliminates MFCL while keeping solely the CE loss.

---

Deep Fake
HC3
CheckGPT
68
68-
Abaatuts Differmns (%6)
50-
Abwolute Differstee (%)
50-
Abonluic Differums (ho)
50-
30
30-
30
20-
20-
0-
Syntax
Semantic
Range
Figure 3: The MDSP performance on three datasets. The vertical axis shows the average absolute difference in MDSP statistical features between human and machine texts across three datasets, demonstrating MDSP's distinct discrimination capability.
OSTAR (Feature Extract) retains the three-dimensional feature extraction component but bypasses analysis processing of these features. Instead, it directly applies global average pooling and projects the results to corresponding dimensions for concatenation with RoBERTa's embeddings. The final classification is performed using linear classification head with CE loss.
OSTAR (Feature Axtract+Anallsis) incorporates the complete Statistical Enhancement component but excludes Multi-Faceted Contrastive Learning during training.
Table 3 shows that both Statistical Enhancement and
Contrast Learning significantly boost the model's detection performance and adversarial robustness. Our OSTAR achieves optimal performance when facing perturbations and paraphrases attacks. Under these attacks, the ACC drops by 7.60% (perturbation) and 7.19% (paraphrases), while Fl-score declines by 11.09% and 10.90% respectively - significantly smaller degradation compared models without MFCL, demonstrating the necessity of our method. The progressive performance improvements from OSTAR (Plain) OSTAR (Feature Extract) + OSTAR (Feature Extract+ Analysss validate the effectiveness of MDSP. Notably, using only feature extraction yields marginal gains and degrades performance under perturbations, likely due to redundant features overlapping with CLS embeddings from pretrained models. While OSTAR with MFCL shows slightly lower performance the original dataset compared to non-MFCL counterparts (attributed to MFCL training exclusively on attacked data, reducing fidelity to original distributions), this degradation remains within acceptable range (0.23% in acc and 0.51 % in Fl).
4.4 Statistical Feature Evaluation
As demonstrated in Figure 3, our statistical text analysis method, evaluated on three public datasets(HC3, CheckGPT, DeepFake), reveals an average discrepancy of 30.95% between MGT and human-authored texts, proving its significant discriminative power for MGT detection. Ex- tended analysis of our MDSP framework shows in Appendix A. This suite of stable and quantifiable intrinsic statistical features effectively uncovers systematic biases in the linguistic patterns of machine- generated texts. It serves as critical anchor point for the OSTAR framework. enhancing detection robustness adversarial environments by compensating for the tendency of pure neural network features to deviate under attacks.
5 Conclusion
In this paper, we propose OSTAR, robust MGT detection framework that synergizes the intrinsic invariant feature extraction capability statistics-based methods with the dynamic adaptability of classifier-based approaches. Specifically, we design the MDSP module to manually extract and analyze statistical features across multiple intrinsic dimensions, enhancing classification through feature fusion. To address adversarial environments, we categorize attacks into Perturbation and Para- phrase based on their impact mechanisms, and accordingly develop MFCL to improve robustness by disentangling adversarial effects through multi-persppetivv feature alignment. Extensive experiments across three public datasets with 9 kinds of perturbations and a paraphraser, validate the effectiveness of OSTAR and demonstrate its robustness under various attacks.
10

---

Acknowledgments
This work was supported by the National Natural Science Foundation of China (62002027, 024720422622522735622277770
the Beijing Municipal Natural Science Foundation (L.257023, L.233034), the Fundamental Research Funds for the Central Universities (No. CUC25SG013) the Fundamental Research Funds for the Beijing University of Posts and Telecommunicationn((aaaa No. N00200,, the National Natural Science Foundation of China Youth Project (Grant No. 62402057) and the State Key Laboratory of Cyberspace Security Defense (No.2025-C08).
References
[1] Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et Language models are few-shot learners. Advances in neural information processing systems, 33: 13:187711901, 2020.
[2] Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, et al. Llama 2: Open foundation and fine-tuned chat models. arXiv preprini arXiv:2307.0922 2023.
[3] Rowan Zellers, Ari Holtzman, Hannah Rashkin, Yonatan Bisk, Ali Farhadi, Franziska Roesner, and Yejin Choi. Defending against neural fake news. Advances in neural information processing systems, 32, 2019.
[4] Yuta Yanagi, Ryohei Orihara, Yuichi Sei, Yasuyuki Tahara, and Akihiko Ohsuga. Fake news de- tection with generated comments for articles. In 2020 IEEE 24th International Conference on Intelligent Engineering Systems (INES), pages 85-90. IEEE, 2020.
[5] Xiaohui Song, Longtao Huang, Hui Xue, and Songlin Hu. Supervised prototypical contrastive learning for emotion recognition conversation. arXiv preprint (tt::::221000877. 2022.
[6] Kalpesh Krishna, Yixiao Song, Marzena Karpinska, John Wieting, and Mohit lyyer. Paraphras- ing evades detectors of ai-generated text, but retrieval is effective defense. Advances in Neural Information Processing Systems, 36:27469-27500, 2023.
[7] Junchao Wu, Shu Yang. Runzhe Zhan, Yulin Yuan, Lidia Sam Chao, and Derek Fai Wong. A sur- vey on llm-generated text detection: Necessity, methods, and future directions. Computational Linguistics, pages 1-66, 2025.
[8] Ying Zhou, Ben He, and Le Sun. Navigating the shadows: Unveiling effective disturbances for modern ai content detectors. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 10847-10861, 2024.
[9] Kangxi Wu, Liang Pang, Huawei Shen, Xueqi Cheng, and Tat-Seng Chua. LImdet: A third party large language models generated text detection tool. arXiv preprint arXiv:2305. 15004, 2023.
[10] Eric Mitchell, Yoonho Lee, Alexander Khazatsky, Christopher D Manning, and Chelsea Finn. Detectgpt: Zero-shot machine-generated text detection using probability curvature. In Interna- tional Conference on Machine Learning, pages 24950-24962. PMLR, 2023.
[11] Abhimanyu Hans, Avi Schwarzschild, Valeriia Cherepanova, Hamid Kazemi, Aniruddha Saha, Micah Goldblum, Jonas Geiping, and Tom Goldstein. Spotting llms with binoculars: zero-shot detection of machine- generated text. In Proceedings of the 41st International Conference on Machine Learning, pages 17519-17537, 2024.
machine-generated
[12] Amrita Bhattacharjee, Raha Moraffah, Joshua Garland, and Huan Liu. Eagle: A domain generalization framework for ai-generated text detection. arXiv preprint arXiv:2403. 15690, 2024.
[13] Suriya Prakash Jambunathan, Ashwath Shankarnarayan, and Parijat Dube. Convnlp: Image- based text detection. 2024 IEFE International Conference on Big Data (BigData), pages 2260-6268. IEEE, 2024.
11

---

[14] Jacob Devlin, Ming- Wei Chang, Kenton Lee, and Kristina Toutanova. Bert: Pre-training of deep bidirectional transformers for language understanding. In Proceedings of the 2019 conference of the North American chapter of the association for computational linguisties: human language technologies, volume (long and short papers), pages 4171-4186, 2019.
[15] Daphne Ippolito, Daniel Duckworth, Chris Callison Burchh, and Douglas Eck. Automatic detection of generated text is easiest when humans are fooled. In Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, pages 1 1880-18222 2020.
[16] Vinu Sankar Sadasivan, Aounon Kumar, Sriram Balasubramanian, Wenxiao Wang, and Soheil Feizi. Can ai-generated text be reliably detected? arXiv preprint arXiv:2303 2023.
[17] Abe Hou, Jingyu Zhang, Yichen Wang, Daniel Khashabi, and Tianxing He. k-semstamp: A clustering-basee semantic watermark for detection machine-generatee text. In Findings of the Association for Computational Linguistics ACL 2024, pages 1706-1715, 2024.
[18] Yijian Lu, Aiwei Liu, Dianzhi Yu, Jingjing Li, and Irwin King. An entropy-based text water- marking detection method. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 1724-11735, 2024.
[19] Jie Ren, Han Xu, Yiding Liu, Yingqian Cui, Shuaiqiang Wang. Dawei Yin, and Jiliang Tang. robust semantics-base -ased watermark for large language model against paraphrasing. In Findings of the Association for Computational Linguistics: NAACI. 2024, pages 613-625, 2024.
[20] John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. watermark for large language models. In International Conference on Machine Learning, pages 17061-17084. PMLR, 2023.
[21] Eva Giboulot and Teddy Furon. Watermax: breaking the Ilm watermark detectability-rooustnee quality trade-off. In The eiiht Annual Conference on Neural Information Processing Systems.
[22] Shengchao Liu, Xiaoming Liu, Yichen Wang. Zehua Cheng, Chengzhengxu Li, Zhaohan Zhang, Yu Lan, and Chao Shen. Does detectgpt fully utilize perturbation? bridging selective perturbation to fine-tuned contrastive learning detector would be better. arXiv preprint arXiv:2402.000 002600 2024.
[23] Zae Myung Kim, Kwang Lee, Preston Zhu, Vipul Raheja, and Dongyeop Kang. Threads of subtlety: Detecting machine-generatee texts through discourse motifs. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume I: Long Papers), pages 5449-547 5474, 2024.
[24] Zhongping Zhang, Wenda Qin, and Bryan Plummer. Machine- generated text localization. In Findings of the Association for Computational Linguistics ACL 2024, pages 8357-8371, 2024.
[25] Eduard Tulchinskii, Kristian Kuznetsov, Laida Kushnareva, Daniil Cherniavskii, Sergey Nikolenko, Evgeny Burnaev, Serguei Barannikov, and Irina Piontkovskaya. Intrinsic dimension estimation for robust detection of ai- ai-generated texts. Advances Neural Information Processing Systems, 0.:39257-392777 2023.
[26] Xiaomeng Hu, Pin-Yu Yu Chen, and Tsung- Yi Ho. Radar: Robust ai-text detection via adversarial learning, Advances in neural information processing systems, 36: 15:15777-5 2023.
[27] Guanhua Huang, Yuchen Zhang, Zhe Li, Yongjian You, Mingze Wang, and Zhouwang Yang. Are ai-generated text detectors robust adversarial perturbations? In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume I: Long Pupers), pages 6005-6024, 2024.
[28] Bairu Hou, Joe O' O'conoor, Jacob Andreas, Shiyu Chang, and Yang Zhang. Promptboosting: Black-box text classification with ten forward passes. In International Conference on Machine Learning, pages 13309-13324. PMLR, 2023.
12

---

[29] Biyang Guo, Xin Zhang, Ziyuan Wang, Minqi Jiang, Jinran Nie, Yuxuan Ding, Jianwei Yue, and Yupeng Wu. How close chatgpt to human experts? comparison corpus, evaluation, and detection. arXiv preprini 2.Xiv23301.075550 2023.
[30] Xiaoming Liu, Zhaohan Zhang, Yichen Wang, Hang Pu, Yu Lan, and Chao Shen. Coco: Coherence-enhancee machine- generrated text detection under low resource with contrastive learning. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, pages 16167-16188, 2023.
[31] Junchao Wu, Runzhe Zhan, Derek Wong, Shu Yang. Xinyi Yang. Yulin Yuan, and Lidia Chao. Detectrl: Benchmarking llm-generated text detection in real-world scenarios. Advances in Neural Information Processing Systems, 37:100369-10040,, 2024.
[32] Liam Dugan, Alyssa Hwang. Filip Trhlik, Andrew Zhu, Josh Magnus Ludan, Hainiu Xu, Daphne Ippolito, and Chris Callison-Bal BurnnhBBrhhhh Raid: A shared benchmark for robust evaluation of machine- generated machine-generated
text detectors. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 14463-1249) 2024.
[33] Yafu Li, Qintong Li, Leyang Cui, Wei Bi, Zhilin Wang, Longyue Wang. Linyi Yang, Shuming Shi, and Yue Zhang. Mage: Machine geneene--eeerrted text detection in the wild. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 36-53,22 2024.
[34] Ji Gao, Jack Lanchantin, Mary Lou Soffa, and Yanjun Qi. Black-box generation of adversarial text sequences to evade deep learning classifiers. In 2018 IEEE Security and Privacy Workshops (SPW), pages 50-56. IEEE, 2018
[35] Junkang Wu, Jiawei Chen, Jiancan Wu, Wentao Shi, Xiang Wang, and Xiangnan He. Un- derstanding contrastive learning via distributionally robust optimization. Advances in Neural Information Processing Systems, 01-22297-23322 2023.
[36] Yuanmeng Yan, Rumei Li, Sirui Wang, Fuzheng Zhang, Wei Wu, and Weiran Xu. Consert:
A contrastive framework for self-supervised sentence representation transfer. In Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing (Volume 1: Long Papers). Association for Computational Linguistics, 2021.
[37] Xiaoqi Qiu, Yongjie Wang, Xu Guo, Zhiwei Zeng, Yu Yue, Yuhong Feng, and Chunyan Miao. Pairefr: Enhancing model training on paired counterfactually augmented data through contrastive learning. In Proceedings of the 62nd Annual Meeting of the Association for Compu- tational Linguistics (Volume 1: Long Papers), pages 11955-11971, 2024.
[38] Xun Guo, Yongxin He, Shan Zhang, Ting Zhang, Wanquan Feng, Haibin Huang, and Chongyang Ma. Detective: Detecting ai- ri-generraed text via multi-level contrastive learning. Advances in Neural Information Processing Systems, 37:88320 88347, 2024.
[39] Yau-Shian Wang, Ta-Chung Chi, Ruohong Zhang, and YIMING YANG. Pesco: Prompt- enhanced self contrastive learning for zero-shot text classification. In The 61st Annual Meeting Of The Association For Computational Linguistics, 2023.
[40] Yichen Wang, Shangbin Feng, Abe Hou, Xiao Pu, Chao Shen, Xiaoming Liu, Yulia Tsvetkov, and Tianxing He. Stumbling blocks: Stress testing the robustness of -eeeerrt-eee text detectors under attacks. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages
2024.
[41] Zeyan Liu, Zijun Yao, Fengjun Li, and Bo Luo. On the detectability of chatgpt content: bench- marking, methodology, and evaluation through the lens of academic writing. In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, pages 2236 2286-2250,200 2024.
[42] Aohan Zeng, Xiao Liu, Zhengxiao Du, Zihan Wang, Hanyu Lai, Ming Ding, Zhuoyi Yang, Yifan Xu, Wendi Zheng, Xiao Xia, et al. Glm-130b: An open bilingual pre-trained model. In The Eleventh International Conference on Learning Representations.
13

---

[43] Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, llya Sutskever, et al. Language models are unsupervised multitask learners. OpenAl blog. 1(8)99, 2019.
[44] Yinhan Liu, Myle Ott, Naman Goyal, Jingfei Du, Mandar Joshi, Danqi Chen, Omer Levy, Mike Lewis, Luke Zettlemoyer, and Veselin Stoyanov. Roberta: A robustly optimized bert pretraining approach. arXiv preprint 1612v 2019.
14

---

A Statistical Feature Evaluation
To further verify that the features extracted using MDSP maintain certain level of stability compared to the original text after being subjected to perturbations and paraphrases, we employed kernel density estimation (KDE) plots evaluate each statistical feature.
A.1
Variations in the Syntax Features Extracted by MDSP
Syntec Place
Syete Acdecee
Systo
0.04
Group Type
0.06
Denett
0.62
0.04
0.4
0.01
0.01
0.02
0.2
0
25
50 Moan
75
102
10
20
30
40
-1.0
-0.5
0,0
0.5
1.0
50
100
150
STD
Autocorr
Range
Figure 1: Variations in the Syntax features extracted by MDSP on human texts
Syrte Meen
Cyrtee STD
Symax Acteeee
Syean Pange
Group Type
0.06
Deneity
0.100
1.5
0.04
0.075
0.050
0.025
0.5
0.000
-50
50
100
10
20
30
40
-1.8
-0.5
0,0
0.5
1.0
100
150
Autozorr
Range
Figure 2: Variations the Syntax features extracted by MDSP on machine texts
As revealed by the KDE plots, texts subjected to perturbation attacks (e.g., sentence repetition) exhibit substantial divergence from original human texts in the syntactic statistical features extracted by MDSP. This discrepancy likely stems from how repetitive patterns disrupt syntactic regularity, yet they maintain sufficient similarity for discriminative feature learning. In contrast, paraphrased texts demonstrate minimal syntactic deviation from original human-authored content, which may hinder classification accuracy and thus necessitates more sophisticated classifier learning to capture subtle discriminative patterns.
A.2
Variations in the Lexical Features Extracted by MDSP
Loaiual Moar
Looical 3TD
Libita Adauor
Lovie Range
0.20
0.08
Group Type
0.00
0.00
0.15
0.6
0.04
0.05
0.2
8.02
16
20 Mean
90
40
10
15
20
-1.0
-0.5
0.0 Autocart
0.5
1.0
90
28
30
40
50
STD
Range
Figure 3: Variations in the Lexical features extracted by MDSP on human texts

---

Loaioa
Leabur
2.0
0.125
Group Type
0.3
0.100
1.5
Density
0.075
0.050
0.05
0.025
0.000
Range
Figure 4: Variations in the Lexical features extracted by MDSP machine texts
At the lexical level, the three text categories (original, perturbed, and paraphrased) exhibit the closest similarity in auto-corrected (Autocorr) feature representations, which significantly aids in distinguishing perturbation-attaed attacked texts. In contrast, paraphrased texts show minimal divergence across four lexical complexity metrics (e.g., type-token ratio, entropy), yet this subtle variation retains discriminative relevance for identifying machine- machine-generated paraphrased content.
A.3
Variations in the Semantic Features Extracted by MDSP
125
25
100
20
Demetty
75
15
50
10
20
25
0
0
0.008
6.100
Mean
STD
Autocort
Range
Figure 5: Variations in the Semantic features extracted by MDSP on human texts
125
100
25
Group Type
20
Denelty
40
25
40
-9.01
0.80
0.01
0.00
0.04
-0.04
-0.02
0.00
0.02
-0.05
0.05
Mean
STD
AutocorT
Range
Figure 6: Variations in the Semantic features extracted by MDSP on machine texts
At the semantic level, paraphrased human texts exhibit significant deviations from original human texts across four key metrics (e.g., semantic coherence, entity consistency), which effectively enhances their discriminability.
machine-generatee texts maintain close statistical aligmment with original machine texts in terms of mean values, standard deviations (STD), and value ranges, thereby enabling robust identification of machine-generated paraphrased content.
contrast, paraphrased
B Limitations
Our method achieves generalized detection against various pre-seen attacks in the training set, but struggles to maintain robustness when confronted with unforeseen attacks such as multiple paraphrases, combined attacks, etc. Another limitation is that the sliding window approach for statistical feature analysis imposes requirements on text length (e.g., short single-sentence passages cannot support effective statistical feature extraction).
16

---

C Detailed Construction of Dataset
For the three datasets, we constructed both original and adversarially attacked versions. The detailed composition of our original datasets is presented in Table 4, while the configuration of the attacked datasets (generated via perturbation/paraphraass attacks) is summarized in Table The two-tuple (human, machine) in the table represents the number of human texts and the number of Al texts. Table indicates that nine distinct adversarial perturbation methods (shown in appendix E) were applied to each original sample, resulting in tenfold expansion of the dataset size. To mitigate computational overhead caused by this exponential growth, we selected part each dataset to include 500 human- aathord and 500 machine-generater samples for balanced training and testing.
The symbol
Table 4: Dataset composition during the Evaluation on Original Datasets experiment.
Dataset
Train
Test
Valid
CheckGPT
(2000, 2000)
(1921, 2078)
(2500, 2500)
HC3
(5000, 5000)
(5000, 5000)
(2000, 2000)
DeepFake
(2000, 2000)
(2000, 2000)
(2000, 1000)
Table 5: Perturbation Methods and Their Intensities
Attack Name
Intensity
Explanation
Space Insertion
5-10 spaces
Inserts 5-10 spaces randomly in text
Punctuation Removal
Single char
Removes last punctuation character from text Randomly alter 10% of word initial characters
Initial Character Case
10%
Alteration
Word Merging
20%
Randomly merge 20% of adjacent words
Keyboard Typos
10%
Generates typos in 10% characters using adjacent keys
Character WordCase
20%
Randomly changes
for 20% of words
Spelling Errors
Introduces spelling errors in each sentence
Adverb Append
Appends one adverb each sentence
Sentence Reversal
10%
Reverses text segments using 3-word pivots in 10% sen- tence groups
Sentence Repetition
Selects 3 sentences to repeat
Table 6 shows the detailed composition of the attacked datasets used in the Evaluation Attacked Datasets experiment, where the "x" symbol indicates the multiplication factor applied to the original sample counts due adversarial attacks.
Table 6: Dataset composition during the Evaluation on Attacked Datasets experiment.
Data Split
Attack Type
Train
Test
Valid
Perturbation
(500x 10)
(500x
10,20xx)) (200x2,200x2)
Paraphrase (500x2,500x2)
(500x2,500x2)
D
Training Details
Our implementation uses RoBERTa as the base pretrained model. Identical attack procedures were applied to both training and test For the MDSP, set length = 3. The contrastive learning component employs weight of 0.02 and temperature coefficient of 0.05. Training utilizes the Adam optimizer with learning rate 1 10-5 and adam epsilon of 1 10-8, Our model was trained on an NVIDIA RTX 3090 GPU, requiring approximately 17GB of VRAM with a batch size of 4, making it feasible implement under most laboratory conditions.

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: The contributions and performance of our OSTAR utilizing statistical features to guide classifier-base detection methods and MFCL optimizing strategy, are reflected in the Introduction and Abstract sections.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
is fine to include aspirational goals as motivation as long as is clear that these goals not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification: Yes, this paper discuss the limitations in Appendix B.
Guidelines:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (c.g.. independence assumptions, noiseless settings, model sell-specification. asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low or images are taken in low lighting. Or speech-to-tex system might not be used reliably to provide closed captions for online lectures because it fails handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and faimess.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community, Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
18

---

Answer:
[NA]
Justification: This paper does not include theoretical results, we validate our method by experimental results.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas. and proof' in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification: We fully disclose all the information needed to reproduce the main experimetal results of the paper.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, other means that appropriate to the research performed.
also be provided via detailed
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm.
(b) the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution is a new model (e.g., a large language model), then there should either way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reprodueibility may be tricky in some cases, in which authors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers have some path reproducing or verifying the results.
5. Open access to data and code
19

---

Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Question:
Answer: [Yes)
Justification:
We will provide open access to the code once the paper published.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips.co cc/
publicc/guides/CodeSuuuuu
for more details.
While we encourage the release of code and data, we understand that this might not be possible, "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for a new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https
/ "tipps.c/ppullic/guu gwwp://g/eee//eeeeee www.edddeeeeeeeemmmmmeeee ssionPolicy) for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification:
We specify all the training and test details in Section 4.1 and Appendix C.D.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to a level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, or as supplemental material.
7. Experiment statistical significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [NA]
Justification: [NA]
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
20

---

The assumptions made should be given (e.g.. Normally distributed errors).
It should be clear whether the error bar is the standard deviation the standard error of the mean.
is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results are out range (e.g. negative enror rates).
If error bars reported in tables plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification:
We provide sufficient information on the computer resources in Appendix F.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental rums as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported the paper (e.g., preliminary or failed experiments that didn't 't make into the paper).
9. Code of ethics
Question: Does the research conducted the paper conform, in every respect, with the NeurlPS Code of Ethics https: http:///wwrrpppcccc//c/ccccccccc
Answer: [Yes]
Justification: We have read the NeurIPS Code of Ethics and our research was conducted with that in every respect.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., if there is a special consid- eration due to laws or regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification:
The societal impacts of our work are discussed in introduction
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No. they should explain why their work has no societal impact why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considcrations.
21

---

The conference expects that many papers will be foundational research and not tied particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms monitor how system learns from feedback over time, improving the efficiency and accessibility of ML..
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification: [NA]
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Lieenses for existing assets
Are the creators or original owners of assets (e.g., code, data, models), used in the paper. properly credited and are the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
Justification: We properly credited it.
Guidelines:
The answer NA means that the paper does existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (c.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, ppppppaaiittaaee thcode com com/datasets: has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
22

---

If this information is not available online, the authors are encouraged to reach out to the asset's creators.
13. New assets
Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Question:
Answer: [Yes]
Justification:
The code and models will be well documented.
Guidelines:
The answer NA means that the paper does release new assets.
Researchers should communicate the details the dataset/code/mmodll as part their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given participants and screenshots, if applicable, as well as details about compensation (if any)?
Answer: [NA]
Justification: This paper does not involve crowdsourcing experiments and research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then much detail as possible should be included the main paper.
According to the NeurlPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: This paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing research with human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, not include any information that would break anonymity (if applicable), such the institution conducting the review.
23

---

16. Declaration of LLM usage
Question: Does the paper describe the usage of LLMs if it is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, or formatting purposes and does not impact the core methodology. scientific rigorousness, originality of the research, declaration is not required.
Answer: [No]
Justification: The LLM is used only for writing
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs as any important, original, non-standard components.
Please refer to L.LM policy (https: hateap//maarrpppeccc///offrerers for what should or should not be described.
24


Reviews:
[{"review_id": "QsrQZcpLht", "reviewer": "Reviewer_ryiM", "summary": "The paper introduces OSTAR, a novel framework designed to detect machine-generated text (MGT) with enhanced robustness against adversarial attacks. It introduces Multi-Dimensional Statistical Profiling to capture invariant patterns and Multi-Faceted Contrastive Learning to handle adversarial attacks. The MDSP captures invariant patterns across scenarios, while attack-specific contrastive learning mitigates adversarial effects. Evaluations on three datasets show state-of-the-art performance with enhanced accuracy and robustness.", "questions": "1. Which of the 3 MDSP dimensions (syntax/lexical/semantic) contributes most to robustness? Are all 4-D features (μ, σ, ρ, R) necessary?\n2. How does OSTAR perform against unseen attack combinations (e.g., perturbation + paraphrase) or sophisticated adversarial attacks beyond the 9 pre-defined perturbations?\n3. Is it possible to use LLM for machine-generated text detection and how effective is it?", "limitations": "yes", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths\n1. The paper combines Multi-Dimensional Statistical Profiling (MDSP) with classifier-based methods, improving robustness in detecting machine-generated text under adversarial attacks.\n2. The structure is clear and well-organized, with detailed technical descriptions, pseudocode, that enhance readability and reproducibility.\n3. Extensive experiments on three datasets show strong performance, achieving high accuracy and robustness against various adversarial attacks.\n\nWeaknesses\n1. The paper lacks an experimental analysis of hyperparameters and a detailed representation of implementation details, such as attack impact ratio, regularization coefficient, etc.\n2. The relationship between L_Para and L_Pert needs clearer intuition.\n3. While MFCL's categorization is novel, using contrastive learning for robustness itself builds on prior work.\n\nThe paper has some minor problems. \n- There are many places in the paper where spaces are missing, such as “text(MGT)” and “Learning(MFCL)” in the abstract. \n- There are some grammar problems in the paper, such as “an overview the framework of OSTAR” in line 119.", "was_revised": true, "final_justification": "The author's detailed rebuttal has effectively addressed the key points of concern raised earlier.", "rebuttal": "**Weakness 1**:\nOur method comprises MDSP feature extraction, statistical features, and the MFCL optimization strategy. Key hyperparameters include MDSP's sliding window size (adjusts feature scope; small sizes limit text-variation reflection, large sizes introduce noise) and MFCL's contrastive learning weight (balances robustness against attacks vs. primary task focus). Experiments validating these parameters are tabulated below.\nRegarding the sliding window size, a window size of 3 achieved optimal balance (accuracy ACC: 91.94%, F1-score: 92.36%), enabling sufficient context feature capture while avoiding interference from distant text noise. Excessively small windows lacked contextual awareness, whereas larger windows (size 5) introduced irrelevant signals and imposed stringent text length requirements, performing inadequately on shorter texts. This sensitivity experiment demonstrated that a window size of 3 achieves the most robust feature extraction by optimizing local context modeling.\n\n| Sliding_windows | ACC   | Recall | F1    |\n|----------------|-------|--------|-------|\n| 1 (no windows) | 90.64 | 97.27  | 91.23 |\n| 2              | 91.29 | 96.19  | 91.79 |\n| 3              | 91.94 | 97.38  | 92.36 |\n| 5              | 91.32 | 98.82  | 90.42 |\n\nRegarding the sensitivity of the contrastive learning weight, this parameter exhibits high sensitivity. Performance improves significantly within the 0.05 to 0.02 range, but declines when the weight falls below 0.02. The final selection of 0.02 is based on the simultaneous peaking of both metrics at this value (Pert=81.27, Para=81.46), representing the optimal balance between the effect of contrastive learning and primary task performance. \n\n| Contrastive Learning Weight | Pert  | Para  |\n|-----------------------------|-------|-------|\n| 0.2                         | 77.81 | 78.29 |\n| 0.05                        | 80.11 | 80.04 |\n| 0.02                        | 81.27 | 81.46 |\n| 0.01                        | 80.92 | 80.93 |\n\nRegarding further implementation details, we provide a table of attack impact rates here; if the paper is accepted for publication, we will include it in the main text to enhance the clarity of implementation details.\n\n| Attack Name                     | Intensity       | Explanation                                                                 |\n|---------------------------------|-----------------|-----------------------------------------------------------------------------|\n| Space Insertion                 | 5–10 spaces     | Inserts 5–10 spaces randomly into text                                |\n| Punctuation Removal             | Single character| Removes final punctuation character from text                              |\n| Initial Character Case Alteration| 10%             | Randomly alters casing for 10% of words                                   |\n| Word Merging                    | 20%             | Randomly merges 20% of adjacent words                                     |\n| Keyboard Typos                  | 20%             | Generates typos in 20% characters using adjacent-key substitutions         |\n| Character Word Case             | 20%             | Randomly changes case for 20% of words (e.g., UPPER/lower)                |\n| Spelling Errors                 | 3 per sentence  | Introduces 3 spelling errors in each sentence                              |\n| Adverb Append                   | 1 per sentence  | Appends adverb to the end of each sentence                                |\n| Sentence Reversal               | 10% of groups   | Reverses segments using 3-word pivots in 10% of sentence groups           |\n| Sentence Repetition             | 4 sentences     | Selects and repeats 4 distinct sentences                                 |\n\n**Weakness 2** : \nThank you for pointing out. ​L_Para​ refers to the contrastive learning loss function for paraphrase attacks, while ​L_Pert​ refers to the contrastive learning loss function for perturbation attacks. The calculation of both aligns with the two types of data generated during the \"Adversarial Data Preparation\" stage mentioned earlier. Together with their corresponding coefficients ​λ₁​ and ​λ₂, they constitute the MFCL loss function.\nIn the original text,  we described:\n“MFCL can be divided into Paraphrase Contrastive Learning (Para-contrast) and Perturbation Contrastive Learning (Pert-contrast)”\nand\n“λ₁ and λ₂ denote the weighting coefficients for L_Para (paraphrase loss) and L_Pert (perturbation loss), respectively.”\n​Issue:​​ The original description lacks sufficient correspondence with the \"Adversarial Data Preparation\" section.\n​Corrected version​ (to be implemented if accepted for publication):\n“MFCL can be divided into Paraphrase Contrastive Learning and Perturbation Contrastive Learning, which generate two loss functions: L_Para and L_Pert, respectively.”\nand\n“λ₁ and λ₂ denote the weighting coefficients for L_Para and L_Pert, respectively.”\n\n**Weakness 3**:\nThank you for your feedback. While leveraging contrastive learning to enhance model robustness is indeed a mainstream approach, our work introduces a core innovation: for the first time in AI-generated text detection, we propose a novel adversarial attack taxonomy fundamentally based on whether the generative source is altered. This foundational classification led to our pioneering MFCL optimization strategy—a specialized contrastive learning paradigm tailored for complex adversarial scenarios in this field. By differentially addressing distinct attack types, MFCL significantly strengthens detection robustness against intense adversarial perturbations. We contend that this deep integration of domain-specific attack mechanisms into the contrastive learning framework constitutes a substantive innovation for the domain.\n\n**Weakness 4**: \nThank you very much for pointing this out. We have corrected both issues and performed another double-check of the entire manuscript. Should our paper be accepted, these errors will not appear in the printed version.\n\n**Question 1**:\nThank you for your question. Based on the discriminability and stability metrics after adversarial attacks in Appendix A, Syntax Features contribute most significantly. We conducted ablation studies of statistical features on a small-scale dataset (GML130B for deepfake), with results shown below. Although improvement levels vary, all four-dimensional features enhance performance. This method primarily serves as an attempt to integrate statistical and fine-tuning approaches, and we plan to incorporate more statistical features to improve generalizability in future work.\n\n| 4-D features  | ACC   | Recall | F1   |\n|---------------|-------|--------|-------|\n| u             | 89.92 | 98.25  | 89.05 |\n| μ+σ           | 90.06 | 97.71  | 90.93 |\n| μ+σ+ ρ        | 90.43 | 98.69  | 90.70 |\n| σ+ ρ+ R       | 91.51 | 96.40  | 91.90 |\n| μ+σ+ ρ+ R     | 91.94 | 97.38  | 92.36 |\n\n**Question 2**:\nWe sampled 500 HC3 points and tested OSTAR under unseen single and combined attacks. Its robustness varies by adversarial intensity:\nOSTAR's adversarially-trained features transfer well to unseen single attacks. Even against novel BERT-generated attacks (e.g., rewriting 20% sentences), it retains high accuracy. F1-score dips only ~2-3% versus known attacks, achieving 94.03—confirming stable semantic attack comprehension.\nFor unseen combined attacks (perturbation→paraphrase or paraphrase→perturbation with random perturbations), statistically optimized features struggle with complex multi-step sequences. Contrastive learning remains robust, scoring F1 of 92.83 and 89.21 respectively—acceptable degradation versus seen attacks. Enhanced training coverage or advanced learning strategies could further improve performance.\n| Datasets | Original | Para   | Pert   | Bert_attack | ​Pert+Para​ | ​Para+Pert |\n|----------|----------|--------|--------|-------------|---------------|---------------|\n| HC3| 99.20| 95.89  | 97.32  | 94.03 | ​92.83​ | ​89.21 |\n\n**Question 3**:\n​ ​ Thank you for your question. We believe directly employing large language models for machine-generated text detection is unreliable, as these models weren't designed for such tasks. Their vulnerability under attacks is substantial, as evidenced in the table below. We tested two cutting-edge large models on 1,000 DeepFake samples under paraphrasing attacks, yielding unacceptable results. Moreover, classification outcomes lack interpretability, and training such models for enhanced robustness proves challenging.\nThe prompt： \"You are a text classifier. Your task is to determine if the following text was generated by a machine or written by a human. \"\n    \"Respond with ONLY the single word 'machine' if the text is machine-generated, or 'human' if it is human-written. \"\n    \"Do not include any explanations, punctuation, or additional text. \"\n    \"Example responses:\\nmachine\\nhuman\\n\"\n\n### Meta-Llama-3-1-8B-Instruct Classification Report\n|      Metric          | precision | recall | F1 | support |\n|---------------|-----------|--------|----------|---------|\n| machine       | 0.27      | 0.21   | 0.23     | 365     |\n| human         | 0.60      | 0.68   | 0.64     | 635     |\n| macro avg     | 0.43      | 0.44   | 0.44     | 1000    |\n| weighted avg  | 0.48      | 0.51   | 0.49     | 1000    |\n\n### DeepSeek-R1-Distill-Qwen-7B\n| Metric        | precision | recall | F1 | support |\n|-------------|-----------|--------|-------------|---------|\n| ​machine​   | 0.33      | 0.67   | 0.45     | 365     |\n| ​human    | 0.55      | 0.23   | 0.32     | 635     |\n| macro avg     | 0.44    | 0.45   | 0.38   | 1000  |\n| weighted avg  | 0.47    | 0.39  | 0.37     | 1000    |\n\nHowever, utilizing large models for feature extraction remains viable. For instance, we're currently exploring their use to derive statistical features related to text evaluation metrics (commonly applied in other text processing methods) as foundations for model training."}, {"review_id": "7IunPR0Ibf", "reviewer": "Reviewer_rAmU", "summary": "This paper states that the key of machine-generated text detection lies in how to extract intrinsic invariant features and ensure the dynamic adaptability of the classifier. Thus, it proposes OSTAR to solve the problem. The experiment results shows its effectiveness in three datasets.", "questions": "According to the strengths and weaknesses part, I'd like to learn more about how the proposed method solves the intrinsic feature capturing problem.", "limitations": "Yes.", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 2, "originality": 3, "strengths_and_weaknesses": "This paper is well organized, and the proposed method is well detailed. The authors evaluate several novel methods on three representative datasets, which provides a comprehensive view of the methods efficacy.\n\nThe author states that the key of MGT detection lies in how to extract instrinsic invariant features and ensure the dynamic adaptability of the classifier. It also claims that \"classification methods tend to capture superficial correlation patterns rather than the intrinsic differences in training data\". I think \"capturing superficial correlation patterns in training data\" is actually a common property of deep learning methods, and the design of a validation set is exactly to address the problem&mdash;proving that the method are not just overfitting the training data, but also learning some \"intrinsic\" properties so that it can perform well on the test set.\n\nIf the author claim that the proposed method captures the intrinsic patterns of MGT, I would expect to see an explicit design in the proposed framework, or some experimental analysis to support the claim. I think the three dimension features used in the MDSP component (syntactic, lexical, semantic) or the two types of contrast learning in MFCL (para-contrast, pert-contrast) might not be so explicit in solving the \"intrinsic\" problem, and the existing experiment might not provide a strong provement to support the statement. I think the performance of existing methods is already high enough on the three datasets, so simply improving the metrics further may not bring significant benefits to the community.\n\nBesides, I think Fugure 1 may not by a good teaser figure to introduce the task and the proposed method to the reader. Line 25 claims that \"As shown in Figure 1(a), in real-world scenarios, MGT texts are often attacked to evade detection\". But the Figure 1(a) literally doesn't show that MGTs are often attacked, it just presents an attack flowchart. And Figure 1(b) lists two old types of pipelines, along with the proposed method. However, it doesn't clearly shows the difference, or the key modification, that distinguish the proposed methods from the others.\n\n\nAdditionally, I think the paper need a proofread to correct typos in the script:\n\n* Table 3 highlights the performance of OSTAR, but OSTAR (Feature Extract+Analysis) has a higher performance. \n* Line 25-26 \"MGT texts\" is duplicated.\n* Line 181 The sentence ends with a comma.\n* Line 216 \"e.g.news, reviews...\" is missing a comma.\n* Line 224 \"Evaluation Metric\" -> \"Evaluation Metrics\"\n* Whether there sould be a space before a left parenthesis (in many places) and an em dash (Line 225) should be consistent thoughout the paper.\n\nMoreover, the code is not submitted with the manuscript, instead it will be publicly available upon publication. But the author claims \"Yes\" in the paper checklist that the paper provides open access to the data and the code. I'm not sure if it's proper.", "was_revised": true, "final_justification": "The author answers the question about \"intrinsic properties extraction\" and talks about the other issues. Thus, I raise my rating.", "rebuttal": "**Answer 1**:\nOur \"intrinsic invariant features\" refer to the universal characteristics of machine-generated text—specifically, those properties that maintain relative stability even after text undergoes rewriting or perturbation by another text generator. While validation set design partially addresses the issue of \"capturing superficial correlative patterns in training data\" (since practitioners adjust training methods—such as epochs, learning rates, and regularization—based on validation performance), this remains fundamentally a training strategy. Merely tuning hyperparameters without structurally enhancing the network's capability yields limited improvement. Therefore, we explicitly extracted statistically stable features for identifying AI-generated text and implemented the MFCL contrastive learning strategy to capture the intrinsic relationships between attacked texts and original texts. This approach significantly boosts the model's capacity to recognize and interpret inherent characteristics of AI-generated content.\nMoreover, optimizing training strategies via validation sets and enhancing model performance through architecture improvements represent two distinct pathways for capturing intrinsic task features: one evaluates whether the training process achieves intrinsic feature extraction, while the other expands the model’s feature extraction capability by enriching architecture and feature categories. These methods are mutually non-conflicting and can be applied concurrently. In our training, we indeed leveraged validation sets to optimize model performance.\n\n**Answer 2**: \nIn Figure 3 and Appendix A, we provide the average differences between human and machine features under the MDSP method across three datasets, along with the post-attack distributions of both human and machine texts from these datasets. These results demonstrate that our proposed method captures intrinsic patterns of machine-generated text, effectively distinguishing human text from machine text—even when facing various attacks.\nThough statistical feature ranges shift in both human and machine texts after attacks, their distributions remain analogous; simultaneously, distinctions between the two text types persist. Through further training, these patterns become capturable as intrinsic regularities. Therefore, we assert that our original paper provides experimental evidence confirming our method's extraction of intrinsic patterns. We can supplement additional experimental analyses in the appendix to help readers better understand how our method captures inherent distinctions between AI-generated text and human text.\n\n**Answer 3**:\nIn fact, current methods perform well on the original datasets but exhibit poor performance on attacked datasets, as shown in the Para. and Pert. columns of Table 2. Here, we present results of existing methods on the CheckGPT dataset from Table 2, which demonstrate significant room for improvement in performance. Therefore, we believe that advancing this metric under adversarial conditions holds meaningful significance for the progress of the field.\n| Methods   | Ori.  | Pert. | Para. |\n|-----------|-------|-------|-------|\n| GPT-2     | 80.74 | 70.58 | 72.56 |\n| RoBERTa   | 88.78 | 80.62 | 81.59 |\n| CoCo      | 85.97 | 70.38 | 74.58 |\n| RADAR     | 63.01 | 60.21 | 67.42 |\n| Watermark | 72.26 | 55.16 | 50.07 |\n| Binculars | 87.12 | 52.32 | 54.54 |\n| PECOLA    | 84.51 | 62.64 | 60.71 |\n\n**Answer 4**:\nFigure 1a provides background on the AI-generated text detection task in adversarial settings. We included this figure to give readers a clearer understanding of our task. The current description of Figure 1a in the main text is not precise enough. Originally, we introduced it as follows: \n“As shown in Figure 1(a), in real-world scenarios, MGT texts are often attacked to evade detection, critically challenging the robustness of existing detection methods[6, 7, 8].”\nWe will revise it to: \n“In real-world scenarios, users frequently employ adversarial tactics to evade detection when attempting to bypass machine-generated text detectors. This poses significant challenges to the robustness of existing detection methods [6, 7, 8]. To explain how these adversarial tactics work, which can help clarify our detection task, Figure 1(a) provides an introduction to the process regarding the robust MGT detection task background.”\n\nIn Figure 1b, our method and existing methods based on statistical features and classifiers are already connected to some extent (using color) and show differentiation (with clear procedural differences). However, we can add more explicit annotations in the future to highlight our innovation.\n\n**Answer 5**:\nThank you for your correction. Experimentally, OSTAR indeed performs best on para and pert datasets. However, its slight degradation in performance on the original data—caused by the necessary incorporation of contrastive and adversarial learning—explains the differences shown in the table. We will further revise the manuscript and double-check the content to eliminate any oversights or basic errors.\n\n**Answer 6**:\nWe apologize for not providing the code link. Since including any external links is prohibited during the review process, it was not included in the manuscript. The code and relevant links will be made accessible online in the camera-ready version upon acceptance."}, {"review_id": "N1nsCh2viU", "reviewer": "Reviewer_6FiE", "summary": "This paper proposes the OSTAR framework to enhance robustness in MGT detection within adversarial environments.  By designing statistically enhanced classifier with Multi-Faceted Contrastive Learning , addressing limitations of existing methods. Experiments demonstrate OSTAR's performance and robustness.", "questions": "1. Are there any possible solutions or ideas for addressing the issues of multiple attacks and the short text problem mentioned in the limitation section?\n2. Can you provide more tables to present the concrete metrics of each attack's intensity and impact, making the attacks more explicit?\n3. Can you provide a comparison of the increased training time when using contrastive learning strategies?\n4. During training, the authors balanced the quantity of human-generated text and machine-generated text. If the ratio between these two becomes imbalanced, how would that impact the model’s performance?", "limitations": "yes", "rating": 6, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 4, "significance": 3, "originality": 4, "strengths_and_weaknesses": "Strengths\n1. The motivation of this work is clear: addressing the vulnerability of existing MGT detection methods in adversarial environments.\n2. Theoretical innovation: categorizing attacks based on whether they affect their originating sources, thereby effectively enhancing the response capability of contrastive learning against attacks.\n3. Novel Framework: OSTAR innovatively designs a statistically enhanced classifier and Multi-Faceted Contrastive Learning, resolving limitations of rigid decision boundaries in statistical methods and overfitting in classifier-based approaches under adversarial environments.\n4. Comprehensive Experiments: This paper evaluate the performance of OSTAR on three public datasets with seven baselines under nine attack scenarios. Special experiments are used to verify the statistical feature distinguishability and the attack impact of statistical feature.\n5. Clear structure: The structure is well organized with well-defined figures and tables, making it easy for readers to follow.\n\nWeaknesses:\n1. The limitations section notes the model’s non-robustness against multi-attack scenarios and compromised MDSP extraction capability with short texts, without proposing potential solutions.\n2. The text only provides the types of attacks, but the intensity of the attacks is not given, and the description of the adversarial environment is insufficient.\n3. Although this contrastive learning can enhance model performance, it substantially increases computational consumption. The paper does not provide relevant data or solutions for this issue.", "was_revised": true, "final_justification": "The authors have addressed all my concerns. This paper presents a novel method with a statistically enhanced classifier and Multi-Faceted Contrastive Learning. I am in favor of acceptance of this paper.", "rebuttal": "**Question 1**:\nThank you for your question. Regarding defense against multiple adversarial attacks, a viable solution involves incorporating combinations of various attack methods into the training data during model development to enhance the model's ability to recognize such complex scenarios. As for the short-text detection challenge, we can introduce additional statistical or contextual features independent of text length. These improvements would significantly enhance the model’s performance in complex attack scenarios and short-text situations.\n\n**Question 2**:\n Thank you for your question! We've detailed adversarial attack metrics in Appendix E. Below is the enhanced specification table:\n\n| Attack Name                     | Intensity       | Explanation                                                                 |\n|---------------------------------|-----------------|-----------------------------------------------------------------------------|\n| Space Insertion                 | 5–10 spaces     | Inserts 5–10 spaces randomly into text                                     |\n| Punctuation Removal             | Single character| Removes final punctuation character from text                              |\n| Initial Character Case Alteration| 10%             | Randomly alters casing for 10% of words                                   |\n| Word Merging                    | 20%             | Randomly merges 20% of adjacent words                                     |\n| Keyboard Typos                  | 20%             | Generates typos in 20% characters using adjacent-key substitutions         |\n| Character Word Case             | 20%             | Randomly changes case for 20% of words (e.g., UPPER/lower)                |\n| Spelling Errors                 | 3 per sentence  | Introduces 3 spelling errors in each sentence                              |\n| Adverb Append                   | 1 per sentence  | Appends adverb to the end of each sentence                                |\n| Sentence Reversal               | 10% of groups   | Reverses segments using 3-word pivots in 10% of sentence groups           |\n| Sentence Repetition             | 4 sentences     | Selects and repeats 4 distinct sentences                                 |\n\n**Question 3**:\n\n​ Thank you for your question! The contrastive learning strategy does indeed significantly increase training time and hardware resource requirements. Here we provide a comparison between training without contrastive learning and training with it: specifically, VRAM usage increases by approximately 50%, while training time rises by roughly 1.5 times.\n\n| Training Method   | Batch Size | Train Time       | VRAM Usage |\n|-------------------|------------|------------------|------------|\n| No Contrastive    | 16         | 60.2 min/epoch   | 13.7 GB    |\n| ​Contrastive**  | 16         | ​151 min/epoch| ​19.6 GB|\n\n**Question 4**:\n\nThank you for your question; maintaining balanced proportions between human texts and machine-generated texts during training is crucial as severe data imbalance significantly undermines model performance: excessive machine texts cause the model to overlearn mechanical patterns, generating outputs lacking human linguistic diversity and naturalness while degrading recognition of human text features and lowering human text recall rates; such imbalance distorts learning objectives, creating biases toward dominant data sources and ultimately impairing generalization capabilities and overall performance in text generation, content detection, or hybrid text processing tasks."}, {"review_id": "GPpgQVHZ68", "reviewer": "Reviewer_8bFh", "summary": "The paper introduces a novel method for detecting machine-generated text in adversarial settings. It combines statistical feature extraction with a neural classifier by integrating a multi-dimensional profiling module and a contrastive learning objective tailored to different types of text attacks. The approach is evaluated on several benchmarks and shows improved robustness and overall performance compared to prior methods.", "questions": "The MDSP relies on manually designed features. Could the authors comment on whether other linguistic metrics were considered, or whether data-driven selection could further enhance performance?", "limitations": "yes", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 4, "significance": 4, "originality": 4, "strengths_and_weaknesses": "Strengths:\n1. The proposed framework introduces a well-motivated combination of statistical profiling (MDSP) and task-specific contrastive learning (MFCL). This hybrid approach is original and effectively addresses the limitations of both traditional statistical detectors and purely classifier-based models under adversarial settings.\n2. The experiments are comprehensive. The proposed method achieves state-of-the-art results across multiple datasets.The ablation studies and detailed breakdown of results provide convincing evidence for the effectiveness of each component.\n3. The paper is clearly written and well-structured. The methodology is described in sufficient detail, including algorithmic steps, training procedures, and statistical feature definitions, making it easy to follow and likely straightforward to reproduce.\n\nWeaknesses:\n1. While the paper evaluates both perturbation and paraphrase-based attacks, the set of perturbation techniques is relatively narrow and mainly consists of syntactic or lexical-level changes. More advanced or semantic-preserving adversarial strategies (e.g., many word-level adversarial attacks) are not considered, which may limit the generalizability of the findings.\n2. The statistical features used are manually defined and fixed. It remains unclear whether these choices are optimal or how sensitive the model is to variations or additional feature dimensions.", "was_revised": true, "final_justification": "The authors provide detailed experiments and statistics which answer my questions. I decide to raise my score to 5.", "rebuttal": "**Weakness 1**:\nThank you for your observation; when implementing text rewriting, we perform full-document perturbations and have specified in the appendix that our perturbations include sentence-level attacks such as Sentence Reversal: inverting word order and Sentence Repetition: duplicating clauses/phrases—we maintain our adversarial selections and testing demonstrate certain universality.\n\n**Weakness 2**:\nThank you for your observation; we have adopted multiple word-level attacks here including Word Merging, KeyBoard Typos, Character WordCase, Spelling Errors etc. as shown below, and can additionally incorporate BERT-based adjective replacement attacks if necessary.\n| Attack Name                     | Intensity       | Explanation                                                                 |\n|---------------------------------|-----------------|-----------------------------------------------------------------------------|\n| Space Insertion                 | 5–10 spaces     | Inserts 5–10 spaces randomly into text                                     |\n| Punctuation Removal             | Single character| Removes final punctuation character from text                              |\n| Initial Character Case Alteration| 10%             | Randomly alters casing for 10% of words                                   |\n| Word Merging                    | 20%             | Randomly merges 20% of adjacent words                                     |\n| Keyboard Typos                  | 20%             | Generates typos in 20% characters using adjacent-key substitutions         |\n| Character Word Case             | 20%             | Randomly changes case for 20% of words (e.g., UPPER/lower)                |\n| Spelling Errors                 | 3 per sentence  | Introduces 3 spelling errors in each sentence                              |\n| Adverb Append                   | 1 per sentence  | Appends adverb to the end of each sentence                                |\n| Sentence Reversal               | 10% of groups   | Reverses segments using 3-word pivots in 10% of sentence groups           |\n| Sentence Repetition             | 4 sentences     | Selects and repeats 4 distinct sentences  \n\n**Weakness 3**:\n\nThank you for your feedback! All statistical feature dimensions in our proposed method demonstrate utility, as evidenced by the ablation studies on feature dimensions in the table below. The results reveal that, for these specific features, our designed approach represents the optimal combination identified thus far. Nevertheless, our primary goal is not to establish a definitive framework for constructing statistical features, but rather to propose a unified methodology that integrates statistical feature-based analysis with classifier-based techniques to enhance AI-generated text detection. We hope this work inspires further exploration into more effective statistical modeling approaches, motivating researchers to advance this field by combining statistical and classification-based strategies.\n| 4-D features  | ACC   | Recall | F1   |\n|---------------|-------|--------|-------|\n| u             | 89.92 | 98.25  | 89.05 |\n| μ+σ           | 90.06 | 97.71  | 90.93 |\n| μ+σ+ ρ        | 90.43 | 98.69  | 90.70 |\n| σ+ ρ+ R       | 91.51 | 96.40  | 91.90 |\n| μ+σ+ ρ+ R     | 91.94 | 97.38  | 92.36 |\n\n**Question 1**:\nThank you for your question;！In related studies we have incorporated alternative textual quality assessment methods as statistical features—such as evaluation metrics spanning literary sophistication and textual sentiment domains—and integrating these into our framework constitutes an effective feature selection strategy where valid features should further enhance performance when added to the system."}]

Author rebuttal:

Meta-review: This paper proposes OSTAR, a framework for robust machine-generated text detection that combines statistical profiling with multi-faceted contrastive learning. The motivation is clear, the methodology is technically sound, and experiments on multiple datasets and attack scenarios are comprehensive.

Reviewers raised concerns about clarity of intrinsic feature claims, limited attack diversity, and computational overhead, but the rebuttal addressed these points with additional analyses and implementation details. 

Overall, the paper is well-motivated, clearly written, and demonstrates strong empirical performance. I recommend acceptance.
Decision: Accept (poster)