AdaDetectGPT: Adaptive Detection of LLM-Generated Text with Statistical Guarantees
Authors: Hongyi Zhou
Jin Zhu
Pingfan Su
Kai Ye
Ying Yang
Shakeel Gavioli-Akilagun
Chengchun Shi
Venue: NeurIPS 2025 poster ()
Keywords: Large language models
DetectGPT
Statistical guarantees
Primary area: deep_learning
TL;DR: AdaDetectGPT is all your need for detecting LLM-generated text.

Abstract: We study the problem of determining whether a piece of text has been authored by a human or by a large language model (LLM). Existing state of the art logits-based detectors make use of statistics derived from the log-probability of the observed text evaluated using the distribution function of a given source LLM. However, relying solely on log probabilities can be sub-optimal. In response, we introduce AdaDetectGPT -- a novel classifier that adaptively learns a witness function from training data to enhance the performance of logits-based detectors. We provide statistical guarantees on its true positive rate, false positive rate, true negative rate and false negative rate. Extensive numerical studies show AdaDetectGPT nearly uniformly improves the state-of-the-art method in various combination of datasets and LLMs, and the improvement can reach up to 37\%. A python implementation of our method is available at https://github.com/Mamba413/AdaDetectGPT.

AdaDetectGPT: Adaptive Detection of LLM-Generated Text with Statistical Guarantees
Hongyi Zhou"
Jin Zhu School of Mathematics University Birmingham Birmingham, UK
Pingfan Su Department of Statistics LSE London, UK
Department of Mathematics Tsinghua University Beijing, China
Kai Ye Department Statistics LSE London, UK
Ying Yang
Department of Statistics and Data Science Tsinghua University Beijing, China
Shakeel O B Gavioli-Akilagun"
Chengehun Shit Department of Statistics LSE London, UK
Department of Decision Analyties and Operations City University Hong Kong Hongkong, China
Abstract
We study the problem of determining whether a piece of text has been authored by a human or by a large language model (LLM). Existing state of the art logits-based detectors make of statistics derived from the log-probability of the observed text evaluated using the distribution function relying solely log probabilities can be sub-optimal. In response, AdaDetectGPT a novel classifier that adaptively learns a witness function from training data to enhance the performance of logits-based detectors. We provide statistical guarantees on its true positive rate, false positive rate, true negative rate and false negative rate. Extensive numerical studies show AdaDetectGPPT nearly uniformly improves the state-of-the-ar method in various combination of datasets and LLMss, and the improvement reach up 37%. A python implementation of our method is available at https: :/c thub. com Matm///aaa11///// AdaDetectGPT.
given source LLM. However, introduce
Introduction
Large language models (LL.M)) such as ChatGPT (OpenAI, 2022), PaLM (Chowdhery et al., 2023). Llama (Grattafiori al., 2024) and DeepSeek (Bi et al., 2024) have revolutionized the field of generative artificial intelligence by enabling large-scale content generation across various fields including journalism, education, and creative writing (Demszky et al., 2023; Milano et al., 2023; Doshi & Hauser, 2024), However, their ability to produce highly human-like text poses serious risks, such as the spread of misinformation, academic dishonesty, and the erosion of trust in written communication (Ahmed et al., 2021; Lee et al., 2023; Christian, 2023). Consequently, accurately distinguishing between human- and -.M-eeeerated text has emerged as a critical area of research.
There is a growing literature on the detection of mechine-generated text; refer to Section 1.1 for review. One popular line of research focuses
uatistics-based detectors, typically rely on log-
"Honyyi Zhou and Jin Zhu contributed equally to this paper and are listed in alphabetical order. t CCoresponding authors: agavioli@cin edu.
edu. hk, shi770ese. ac. uk
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

Fast-DetectGPT
Witness function estimation
x from
Elog a (xylxtz)
xx
E [Elog (Fe (Felx
Sample
Score
AdaDetectGPT
Thechhaling
mag hound (TNR)
ER [log y (x, (x,1xx
(log a (<+1)<)))] x from
Sample
Score
Figure 1: Workflow of AdaDetectGPT. Built upon Fast-DetectGPT (Bao et al., 2024), our method adaptively learn witness function w from training data by maximizing a lower bound on the TNR, while using normal approximation for FNR control.
probability outputs (i.c., logits) from source LLM to construct the statistics for classification (see e.g., Gehrmann et al., 2019; Mitchell al., 2023). These works are motivated by the empirical observation that LLM-generated text tends to exhibit higher log-probabilities or larger differences between the logits of original and perturbed tokens. However, as we demonstrated in Section 3, relying solely on the logits can be sub-optimal for detecting LLM-generated text.
Our contribution. In this paper, we propose AdaDetectGPT (see Figure for visualization), an adaptive LLM detector that leverages external training data to enhance the effectiveness of existing logits-based detectors. Our approach derives lower bound the true negative rate (TNR) of logits-based detectors and adaptively learns a witness function by optimizing this bound, resulting in more powerful detection statistic. The optimization is straightfoward and requires only solving a system of linear equations. Based on this statistic, we further introduce an approach to select the classification threshold that controls AdaDetecIGPT's false negative rate (FNR).
Empirically, we conduct extensive evaluations across multiple datasets and a variety of target language models to demonstrate that AdaDetectGPT consistently outperforms existing boaets-based detectors. In white-box settings where the target LLM to be detected is the same as the source LLM used to compute the logits- AdaDetectGPT achieves improvements
the best alternative in under the curve (AUC) ranging from 12.5% to 37%. In black-box settings, where the source and target LLMs differ, it similarly offer gains of up to 20%.
Theoretically, we provide statistical performance guarantees for AdaDetecIGPT, deriving finite- sample error bounds for its TNR, FNR, true positive rate (TPR) and false positive rate (FPR). Existing literature on logits-based detectors generally lacks systematic statistical analysis. Our work aims to fill in this gap and contribute toward deeper understanding of these methods in this emerging field, by offering a comprehensive analysis based on the aforementioned standard classification metrics.
1.1 Related works
Existing methods for detecting machine- -eetriee-eeerated text generally fall into three categories: machine learning (ML)-based, cirisstcs-bbsedd, and watermarking- (2025) for recent comprehensive surveys. Our method is most closely related to the first two categories and, unlike the third, does not rely on knowledge of the specific hash function or random number generator used during token generation, which are often model-specific and not publicly available. In what follows, review the first two categories and defer the discussion of watermarking-baat based approaches to Appendix A.
see Yang et al. (2024c); Wu et al.
ML-based detection. ML-based methods train classification models on external human- and machine- authored text for detection. Many methods can be further categorized into two types. The first type extracts certain features from text and apply classical ML models to train classifiers based on these features. Various features have been proposed the literature, ranging from classical term frequency- inverse document frequency (TF-IDF), unigram, and bigram features (Solaiman et al., 2019). to more complex features engineered specifically for this task, such as the cross-entropy loss computed between the source text and surrogate LLM (Guo et al., 2024a) and the rewriting-bait based measure

---

that quantifies the difference between original texts and their LLM-rewritten versions (Mao et al., 2024).
The second type of methods fine-tune L.Ms directly for classification. This approach is intuitive, as LLMs inherently designed for processing text data; only need to modify the model's output to predict a binary label rather than token probabilities. Various LLMs have been employed for fine-tuning, including RoBERTa (Solaiman et al., 2019; Guo al., 2023), BERT (Ippolito al., 2020) and DistilBERT (Mitrović et al., 2023).
In addition to these two types of methods, Abburi al. (2023) propose hybrid approach that uses the outputs of fine-tuned LLMs as input features for classical blsdd classification. Further efforts have focused handling adversarial attacks (Crothers et al., 2022; Krishma et al., 2023; Koike et al., 2024; Sadasivan et al., 2025), short texts (Tian et al., 2024), out-of-distribution texts (Guo et al., 2024b), unobserved prompts (Zhou al., 2026a), biases against non-native English writers (Liang et al., 2023), accommodating statistical inference (Zhou et al., 2026b), as well as the downstream applications of these methods in domains such as education, social media and medicine (Herbold et al., 2023; Kumarage et al., 2023; Liao et al., 2023).
Statistics based detection. Statistics-based methods leverage differences in token-level metrics such as prepobbbabiiites to distinguish between human- and machine-authored text. Unlike ML-based approaches, many of these methods do not rely on external training data; instead, they directly use predefined statistical measures as classifiers. In particular, a seminal work by Gehrmann et al. (2019) propose several such measures, including the average log- bog-probability and the distribution of absolute ranks of probabilities of tokens across a text. These measures exhibit substantial differences between human- and machine-authored text, and they have been widely employed and extended in the literature (see e.g., Mitchell et al., 2023; Su et al., 2023; Bao et al., 2024; Hans et al., 2024).
Other statistical measures employed are calculated based on the N-gram distributions (Solaiman et al., 2019; Yang et al., 2024b), the intrinsic dimensionality of text (Tulchinskii et al., 2023), the reward model used in LLMs (Lee et al., 2024) and the maximum mean discrepancy (Zhang et al., 2024; Song et al., 2025). Recent works have extended these methods to more challenging scenarios, such to handle adversarial attacks (Hu et al., 2023), machine-revised text (Chen et al., 2025a) and black-box settings (Yu et al., 2024; Zeng et al., 2024). Theoretically, Chakraborty et al. (2024) establish sample complexity bound for detecting machine-generater text.
To conclude this section, we remark that our proposal lies at the intersection between statistics- and ML-based methods. Similar to many statistics-based approaches, our classifier is constructed based on the oog-robbabilities. However, we adaptively learn a witness function via ML to improve its effectiveness. In this way, our method leverages the strengths of both approaches, leading to superior detection performance.
2 Preliminaries
We first define the white-box and black-box settings as well as our objective. We next review two baseline methods, DetectGPT (Mitchell al., 2023) and Fast-DetectGPT (Bao et al., 2024), as they are closely related to our proposal. Finally, we introduce the martingale central limit theorem (see e.g., Hall & Heyde, 2014), which serves the theoretical basis for threshold selection.
Task and settings. We study the problem of determining whether a given passage X, represented as sequence of tokens (X1, X2...., Xz), was authored by human or generated by a target L.M.. Specifically, let p and q denote the distributions over human-written written and LLM--enerated tokens, respectively. Each distribution can be represented as product of conditional probability functions, II. Pt for humans and II. qe for the target LLM, where each pr (z, (x<c) (and similarly q:) denotes the conditional probability mass function of the next token He given the preceding tokens, where I<t == (21, T2...... Dz 1)-1) when > 1 and Feg := 0 otherwise. Our goal is to develop a classifier to discriminate between X p (human) and X q (LLM).
We assume access to a source LLM's probability distribution function d' = II. de When y' = q. corresponds to the white-box setting where the source model we have is the same as the target model we wish to detect. This is the primary setting considered in this paper. For closed-source LLMS such as GPT-3.5 and GPT-4, their probability functions are not publicly available. In such cases, we utilize
3

---

an open-souree model with distribution q' as an approximation of q, resulting in the black-box setting. which our method also extended to handle.
We also assume access to a corpus of n human-authored passages H. = [ p. This assumption is reasonable, as large corpora of human-written text are readily available online (e.g.. Wikipedia). Without loss of generality, we assume that all passages have the same number of tokens L, achieved by zero-padding shorter sequences match the maximum token length. Throughout this paper, we use boldface letters (c.g., X) to denote passages, and non-boldface letters (e.g., X) to denote individual tokens.
Baseline methods. Both DetectGPT and Fast-Detect are statistics based and rely on the log- probability of passage, log q' (X), as the basis for classification. Specifically, DetectGPT considers the following statistic:
log o' (X) - -Bx ( x Dog o' (x)
(I)
(= (log g' (X))
where both the expectation in the numerator and the variance in the denominator are evaluated under perturbation function p'. which produces X that is slightly modified version of X with similar text tends to yield
meaning. The rationale behind this statistic is that, empirically, higher values than human-written text when evaluated using (1) (Mitchell et al., 2023, Figure 2). As if this statistic is larger than a certain threshold.
a result, a passage is classified as machine-generann
A potential limitation of DetectGPT is that sampling from the perturbation distribution p' requires multiple calls to the source LLM to generate rewritten versions of the input passage, making the addresses this issue by proposing
calculation of (1) computationally expensive. modified version of (1), given by
E, log (i (Xt)Xet) - E, E Ex X log (f (x))
(2)
VZ. Var (ex (log of (X,
Specifically, notice that log g' (X) can be decomposed as a token-wise sum E, log g. Xxt). Thus, the first term in the numerator of (1) is the same as that in (2). However, Fast-DetectGPT replaces the centering term in (1) with Σ, (=/xx() log (xx) Here, II, S denotes a sampling distribution function which may equal q or be derived from another LLM. By replacing the perturbation function with s, the centering term can be efficiently computed directly from the LLM's conditional probabilities. Additionally, due to the conditioning on X in the centering term,
the variance term is equal to the sum of the conditional variances of log q. ( xx)). Finally, classifies passage as machine-generated if this modified statistic is larger than a certain threshold.
Martingale central limit theorem. The martingale central limit theorem (MCLT) is a fundamental result in probability theory that enables rigorous statistical inference for time-dependent data. It is well-suited for analyzing text data where tokens are generated sequentially given their predecessors. Consider time series {Zr ht where each Z, represents real-valued random variable. Suppose there exists a sequence of monotonically increasing sets of random variables Fi S F2 S so that Z, E Fe for any t. Under certain regularity conditions, MCLT states that the normalized partial sum
El - B(Z,)--1)l
(3)
V Var (2)FFF)))))
converges in distribution to standard normal random variable as L approaches infinity (Brown, 1971). Notice that the statistic in (3) shares similar structures with that employed in Fast-DetectGPT (see (2)). In the next section, we will leverage this connection for FNR control through normal approximation.
3 AdaDetectGPT
We present AdaDetectGPP in this section. We begin by discussing the white-box setting in Parts (a)- (c): Part (a) introduces the proposed statistical measure; Part (b) discusses our choice of the classi- fication threshold for FNR control; Part (c) derives a lower bound the TNR to learn the witness

---

Dataset: SQuAD
Dataset: Writing
FaStDetectGPT
AdiDetaccCPT
AdaDetectorT
Differences in statistical measures
Differences statistical measures
Figure 2: Boxplots visualizing the differences in the statistical measures between human- and LLM- authored passages, comparing AdaDetectGPT (with a learned witness function) and Fast-DetectGPT (without it). A larger positive difference from zero indicates better detection power. As observed, the difference computed by AdaDetectGPT consistently larger than that of Fast-DetectGPT across the first quartile, median, and third quartile. The left panel shows statistics evaluated on the SQuAD dataset, while the right panel displays results for the WritingPrompts dataset.
function. Next, in Part (d), we extend our proposal to the black-box setting. Finally, in Part (c), establish the statistical properties of AdaDetectGPT.
(a) Statistical measure. Notice that q' q under the white-box setting. Given passage X, the proposed classifier is built upon the following statistic:
(X) El(w(log qe (x, xx))) E (Xxx))) w(og ( (Xx()x=())
VE, Var (=/xx(( ( (wolog @i (X, (X))X=:)))
where w : IR R denotes a -ieedimenioona witness function defined over the space of log- probabilities.
By definition, (X) is very similar to Fast- Dest-DetectGPT's statistic in (2), with two modifications: (i) First, rather than using the raw log conditional probability 4t. we apply a witness function w to these log de enhance the detection power of the resulting classifier. Our numerical experiments demonstrate that this transformation better distinguishes between human- and machine- text (see Figure 2). Below, we further provide simple analytical example illustrate this power enhancement. (ii) Second, we set the the sampling function s in (2) to the source LLM's g. This allows the numerator to match the form of the partial sum in (3), which enables the application of MCLT for FNR control.
An analytical example. Consider hypothetical "Kingdom of Bit" where all communication uses just two tokens: (yes) and (no). Let {pr} denote the true token distribution of this language. Suppose malicious wizard creates synthetic citizens who appear similar ordinary people, but their language follows simpler distribution qe (x)((t))) = q(xx) for some fixed function g, being independent of the prior context T<t- As we will show later, the detection power of statistic crucially depends on the following quantity:
1.
Σ
E 1x wlog ((x)) (xxxxx((logq(X)
The greater the deviation of the expression (5) from zero, the higher the power to detect synthetic humans. When setting the identity function, this expression reduces
((L) ((0)
1 Σ Pi(1) -
log
x
4(1)
where (1( Exex is determined by the true language distribution p. In this case, (5) converges to zero (11 1/2, regardless of the difference between q(1) and the average of (c)).. As such, there are simple settings in which existing logits-baser detectors with an identity witness function will struggle distinguish between human and machine authored text, independent of the actual distance between and q. However, for any q(1) * 1/2, there exists a function w that makes (5) equal to q(1) L-1 DL 1 (1)), independent of the log ratio (see Appendix B for a formal proof). Thus, whenever ()) differs from the average Ps (1), an appropriate transformation w can reliably detect synthetic humans.
5

---

SQUAD
Writing
XSum
0.3
0.30
gpt-neo-2.78
0.25
gpt2-xl
FNR
0.20
0.15
0.10
0.10
0.05
0:10
0.15
0.20
0.25
0,05
0.10
0.15
0.25
0.30
0,05
0.10
0.15
0.20
0.25
0.30
alpha
alpha
alpha
0.4
0.4
0.4
0.3
0.3
density
density
density
0.2
0.2
6.1
-3
-2
3
2
11
statistics
statistics
sta testiiiics
Figure 3: Top panel: FNR of the classifier plotted against the significance level a. Bottom panel: Distribution of statistics evaluated on LLM-generated text. The dashed red line is the density function of standard normal random variable. Results shown across three datasets (from left right) and two language models (indicated by different colors).
We will discuss how to properly learn the witness function below. Since this is inherently classifica- tion problem, it is natural to learn a witness function that maximizes the AUC of the resulting detector. Equivalently, this amounts to finding witness function that maximizes the TNR for each fixed FNR. In (b), we discuss how to select the classification threshold to control the FNR at a specified level. Given this threshold, we then derive lower bound the TNR in (c) to be maximized for learning the witness function.
(b) Classification threshold. Given a witness function we aim to determine threshold so that the FNR of the classifier (X) > e below a specified level a > A key observation is that, when the passage X is generated from the source LLM, T (X) ) in (4) can be represented by the partial sum in (3) with Z. w/ wloog d (X, xxx)) and F, = X <t. follows from the MCLT that
FNR = P x (T (X) S c) (c).
L 00,
(6)
where ( denotes the cumulative distribution function of a standard normal random variable. Thus, to ensure the desired FNR control, set the threshold the oth quantile of Φ denoted by 2.-
We validate this threshold selection both theoretically and empirically. Specifically, Theorem 2 in (e) establishes finite-sample error bound for our classifier's FNR. Figure 3 illustrates the effectiveness of FNR control and normal approximation across three benchmark datasets and two language models.
(c) Learning the witness function. With the classifier's FNR fixed asymptotically at level a, one can identify the optimal witness function w by maximizing its TNR, defined by
TNR == (Tx S za),
where the probability is evaluated under the human human-generatee generated text distribution p. Toward that end, we employ MCLT again to derive closed-form expression of (7).
By definition, represent Tu, (X) by the difference T (X) T((2 (X) where
Σt [log w Xxr) - E Ex,xp log w (X,(Xer)]
(x)
E. Var x,mm (log u: (X
E. X wlog ge (X, E Ex,opy w(log ge (Xe(xxx))))
(x)
E. Var Var x (w(log qr (X,(xe)))))

---

Here, to ease notations, Pt. and in the expectation and variance are implicitly taken with respect to their conditional distributions Pe (x+) and q:( (X<t) given Xee.
Notice that T is very similar to Tw - the only difference lies in the centering term: the conditional expectation taken with respect pt instead of qt. Under an equal variance condition where the variance terms in the denominator evaluated at St and Pt converge to the same quantity asymptotically,
we can invoke the MCLT to prove the asymptotic normality of T (X) p. As a result, TNR can be approximated by
(X) under the human distribution
Px~p (T (X) (X) S 2a (X)) Ex~p T
(8)
Given the external human-written text dataset H. n " (22, + T ())) and optimize this estimator to compute the witness function w. However, the resulting w depends on the choice of a, which limits its flexibility. To eliminate this dependence, we derive a lower bound on the TNR in the following theorem.
estimate the right- seatt-hand-sde of (8) by
Theorem 1 (TNR lower bound). Under the equal variance condition specified in Appendix D, TNR, is asymptotically lower bounded by min + (za)TT
a} where v' is the derivative of Φ and T denotes population version of 1 (2) (X), given by
T Exlexerrp.ee w w(log 9i (X, E Expr (X,
(9)
Ei Ex var Ximge (w(log du Xxt)))
Compared to T (X), both the numerator and denominator of T!??)) are defined by taking expec- tations with respect to Xet for each t. In the analytical example, the numerator simplifies to (5) after appropriate scaling. According to Theorem 1, optimizing the lower bound is equivalent to maximizing T((*), whose solution is independent of a. We also remark that the maximal value max. (2-) is similar to certain integral probability metrics (Müller, 1997) such as the maximum mean discrepancy measure widely studied in machine learning (see e.g., Gretton et al., 2012).
Motivated by Theorem 1, we replace the expectations Excr<p in both the numerator and denominator of T with their empirical average over the dataset H. denote the resulting estimator by ( and compute ã- arg max T(2)) over function class W. Since is a one-dimensional function over the space of real-valued logits, the optimization is relatively simple.
Specifically, we adopt a linear function class W = {w(2)= T =18812 = 1} for some bounded d-dimensional feature mapping 6. this case, T simplifies TTb/ // B Σ3 for some d-dimensional vector e and d x d semi-definite positive matrix Σ (see Appendix C for the detailed derivation). With some calculations, our estimated regression coefficients 3 can be efficiently obtained by solving the linear system Σ3 pb, leading / 3 áb We set to the B-spline basis function (De Boor, 1978) in our implementation and relegate additional details to Appendix C.
(d) Extension to black-box settings. When the target LLM's logits are unavailable, we employ an open-source LLM with a distribution similar to that the target model to construct the statistical measure in (4). The witness function is then learned in the same manner as described in (c). We empirically evaluate this approach in Section 4.
Inference
(e) Statistical guarantees. In the following, we establish simite-sample bounds for the FNR, TNR, FPR and TPR of the proposed classifier in the white-box setting; see Figure 4 for summary of our theories. Recall that L. denotes the number of tokens in a passage, n denotes the number of human-authored passages in the training data and
Ground truth
TNR Theorem
FPR Corollary
is the target FNR level we wish to control. We also define w"
arg max w (2+) as the population limit of our estimated witness function W. Finally, let Vz denote the ratio
FNR
TPR Corollary 4
Theorem
L Var Marx,~g. (log di xx)x))))
Figure 4: A summary of our theories.
L- EL Varx (wol q: XX, Xxt)))
7

---

Theorem 2 (FNR), Assume the denominator of VL is bounded away from zero. Then the expected FNR our our classifier FNR;; upper bounded by (E(NRR)) S aa+ log +) where the expectation on the left-hand-side is taken with respect to T.
Theorem 3 (TNR), Under a minimal eigenvalue assumption Appendix D, with some absolute
constant y > 0 depending only on the eigenvalue decay, the expected TNR of our classifier TNR is lower bounded by (T(NRR Z T. -O(d1 Vn).
Corollary 4 (TPR), Under the condition in Theorem 2. the expected TPR of our classifier is lower
bounded by B(TPR@) = (FFNR)) 2 a (L log L) - (BVV - 111/5).
Corollary 5 (FPR). Under the condition in Theorem 3, the expected FPR of our classifier is upper
bounded by (F = 1 (TNR S TNR + Odd/
We make a few remarks:
Theorem 2 provides an upper bound on the difference between our classifier's expected FNR and the target level a. This excess FNR depends the variance ratio Vz. As L diverges to infinity and Vz, stabilizes to 1, the FNR of our classifier approaches the target level. We remark that assumptions similar to the bounded denominator condition in Theorem 2 are commonly imposed (see e.g., Bolthausen, 1982; Hall & Heyde, 2014).
factors: (i) the number of tokens L,, and (ii)
Theorem establishes an upper bound on the difference between our classifier's s TNR and that of the oracle classifier, which has access to the population-level optimal witness function w' This difference depends on: (i) the training sample size n, and (ii) the dimensionality of the feature mapping d. Since o is defined over the space of one-dimensional log probabilities of tokens, rather than the token space itself, d is independent the vocabulary size, and can be treated as fixed. Consequently, as the training data size grows to infinity, our classifier's TNR converges to that of the oracle classifier. According to Theorem 1, with a sufficiently large max T!?*), the expected weW
TNR can reach up to a-aa
Corollaries 4 and 5 follow directly from Theorems 2 and 3, due to the relationships between TPR and FNR, and between FPR and TNR.
Together, these results suggest that our classifier is expected to achieve high AUC as the significance level varies, which we will verify empirically in the next section.
4 Experiments
We conduct numerical experiments in both white-bo box and black-box settings to illustrate the useful- ness of AdaDetectGPT. To save space, some implementation details are provided in Appendix C.
We consider five widely-used datasets for comparing different detectors, including SQuAD for Wikipedia-style question answering (Rajpurkar et al., 2016), WritingPrompts for story generation (Fan et al., 2018), XSum for news summarization (Narayan et al., 2018), Yelp for crowd-sourced product reviews (Zhang et al., 2015), and Essay for high school and university-level essays (Verma et al., 2024). Following Bao et al. (2024), we randomly sample 500 human -writte paragraphs from each dataset and generate an equal number of machine-authoree paragraphs by prompting an LLM with the first 120 tokens of the suman-written text and requiring it to complete the text with up to 200 tokens. This is a challenging setting where evaluate AdaDetectGPT, we compute the AUC on each of the five datasets, with its witness function trained on two randomly selected datasets that differ from the test dataset.
Datasets.
text is mixed with human writing. To
Benchmark methods. In white-box settings, we compare the proposed AdaDetectGPT against eight th- detectors: Likelihood, Entropy, LogRank (Gehrmann et al., 2019), LogRank Ratio (LRR, Su et al., 2023), DetectGPT (Mitchell et al., 2023) and its variants Normalized Perturbed log Rank (NPR, Su et al., 2023), Dest-DetectGPT (Bao et al., 2024), DNAGPT (Yang et al., 2024b). In blxck-box settings, we further compare against RoBERTaBase and RoBERTaLarge (Solaiman et al., 2019), Binoculars (Hans et al., 2024), RADAR (Hu et al., 2023), and BiScope (Guo al., 2024a), but omit DetectGPT, NPR and DNAGPT due to their high computational cost. This yields ten baseline algorithms. We measure the detection power of each detector using AUC.
White-box results. We first consider the white-box setting where we employ various source models summarized in Table S4 for text generation, with parameter sizes ranging from I to 20 billion. Table 1
8

---

Table 1: AUC scores of various detectors in the white-box setting. The "Relative" rows report the
percentage improvement AdaDetectGPT over Fast-DetectGPT.
Source Model
Dataset
Method
GPT-2
OPT-2.7
GPT-Neo
GPT-J
GPT-NeoX
Avg.
Likelihond
0.7043
0.6872
0.6722
0.6414
0.5948
0.6600
Entropy
0.5513
0.5289
0.5392
0.5385
0,5402
0.5396
LogRank
0.7328
0.7169
0.7047
0.6738
0.6179
0.6892
LRR
0.7703
0,7623
0.7553
0.7286
0,6632
0,5849
NPR
0,8783
0.8342
0.8311
0.7330
0,6454
0.6182
SQuAD
DNAGPT
0,8640
0.8413
0.8106
0.7671
0.6933
0.7953
DetectGPT
0.8565
0.8167
0.8047
0.7124
0.6380
0.6047
Fast- Mest-DetectGPT
0.9042
0,8801
0.8731
0.8417
0.7866
0.8571
AdaDeteetGPT
0.9265
0.9058
0.9088
0.8618
0.8292
0.8864
Relaïie (t)
23.2696
21,914
28.1306
12.6659
19.9996
20,4909
Likelihood
0.7297
0.7119
0.7032
0.6937
0,6811
0.7039
Entropy
0.5154
0,5132
0.5098
0,5126
0.5275
0,5157
LogRank
0.7510
0.7332
0.7253
0.7141
0.7029
0.7253
LRR
0.7801
0.7599
0.7624
0.7489
0.7362
0.6015
NPR
0.8760
0,8329
0.8373
0.8008
0.7854
0,4942
Writing
DNAGPT
0.8962
0.8503
0.8590
0.8450
0.8199
0.8541
DetectGPT
0.8540
0,8060
0.8173
0.7681
0.7514
0,6286
Fast-DetectGPIT
0.8972
0,8891
0,8904
0.8879
0.8782
0.8886
AdaDetectGPT
0.9352
0.9175
0.9290
0.9190
0.9158
0.9233
Relative (t)
36.9089
25.5699
35.2136
27.7142
30.8963
31,1433
Likelihood
0.6410
0.6264
0.6197
0.6086
0.5906
0.6173
Entropy
0.5637
0.5571
0.5864
0.5606
0.5679
0.5671
LogRank
0.6623
0.6493
0.6493
0.6310
0.6109
0.6406
LRR
0.6952
0.6795
0.6967
0.6612
0.6447
0.5361
NPR
0,8211
0.7713
0.8273
0.7676
0.7290
0.6178
XSum
DNAGPT
0.7531
0.7283
0.7160
0.6939
0.6634
0.7109
DetectGPT
0,8073
0.7639
0.8244
0.7599
0.7239
0,6110
PP
0.8253
0.8067
03137
0.7926
0.7622
D.3009
PPT
0.8534
0.8420
0.8532
0.8347
0.8061
0,8379
Relaïve (t)
14.1250
18.2639
21,1936
20.5301
18.4992
T8.5779
reports the AUC scores various detectors across combinations of datasets and five source models. It can be seen that AdaDetectGPT achieves the highest AUC across all combinations of datasets and source models, outperforming Fast-DetectGPT the best baseline method by 12.5%-37% We also evaluate AdaDetectGPT three more advanced open-source LLMs: Qwen2.5 (Bai et al., 2025), Mistral (Jiang et al., 2023), and LLaMA3 (Grattafiori et al., 2024). As shown in Table S7, Fast-DetectGPT and maintains competitive
AdaDetectGPT delivers consistent improvements performance across five datasets, achieving the best results in most cases. These findings highlight the advantage of using adaptively learned witness function for classification.
In Appendix F.3, we analyze the computational cost AdaDetectGPT. Training the witness function typically requires less than one minute across different sample sizes and dimensions, with memory usage below 0.5 GB. In Appendix F.4, we further conduct a sensitivily analysís to investigate sensitivity of AdaDetecsGPPTss AUC score to various factors that may affect the estimation of the witness function. Our results show that AdaDetectGPT is generally robust to the size of training data, the number of B-spline features, and the distributional shift between training and test data, consistently maintaining superior performance over baselines.
Black-box results. We next consider the black-box setting, where the task is to detect text generated by three widely used advanced LLMs: GPT-4o (Hurst et al., 2024), Claude-3.5-Haad 2024), and Gemini-2. Flsalah (Comanici et al., 2025). In this setting, token-level log- pogooabbbilliies are not publicly accessible. To implement Fast-DetectGPT and AdaDetectGPT, we use google/ /ggemaa- 2-9b and google/ Bonggle/gmmaaaae 1ammma-2-9b-aa (Team et al., 2024) as the sampling and scoring models, respec- tively, construct the classification statistics described in Section The results are reported in Tables and S8. Overall,
(Anthropic,
remains the strongest baseline, although it occasionally

---

Table 2: AUC scores of various detectors to detect text generated by GPT-4o and Claude-3.5 across
datasets.
GPT-4o
Claude-3.5
Method
XSum
Writing
Yelp
Essay
Avg.
XSum
Writing
Yelp
Essay
Avg.
RoBERTaBase
0,5141
0.5352
0.6029
0.5739
0.5655
0.5206
0,5386
0.5630
0,5593 0,5566
RoBERTaLarge
0.5074
0.5827
0.5027
0.6575
0.5626
0.5462
0.6149
0.5105
0,6063 0.5695
Likelihood
0.5194
0.7661
0.8425
0.7849
0.7282
0.6780
0.7502
0.7134
0.6160 0.6894
Entropy
0.5397
0.7021
0.7291
0.6951
0.6665
0,5935
0.6594
0.6625
0.5742 0.6142
LogRank
0.5123
0.7478
0.8259
0.7786
0.7161
0.5
0.6653
0.7244
0.7111 0.6529
LRR
0,5116
0.6099
0.6828
0.6930
0.6243
0.5268
0.5560
0.5527
0.6535 0.5723
Binoculars
0.9022
0.9572
0.9840
0.9777
0,9552
0,9012
0.9393
0,9752
0.9603 0,9440
RADAR
0.9580
0.8046
0.8558
0.8394
0.8644
0.9187
0.7264
0.8424
0.9152 0,8507
BiScope
0.8333
0.8733
0,9700
0.9600
0.9092
0.8533
0,8800
0.8800
0.9567 0.8925
Fasi- DTt
T0,9048
0,9588
0.9847
0.,900
0.957
0,9019
0.936
0,9768
0,9608 0,9439
AdT
0.9072
0.9611
0.9832
0,9841
0.9589
0.9176
0.9400
0.9728
0.9610 0.9478
Relative
2.4288
5.6095
20.4444 4.2454
T6.0326
6.0543
0.3405 6.9929
Table 3: Detection of LLM-generated text under two adversarial attacks in black-box settings.
Paraphrasing
Decoherence Writing
DetectGPT
Xsum
Writing
PubMed
Avg.
Xsum
PubMed
Avg.
Fast (GPT-I/GPT-22
0.9178
0.9137
0.7944
0.8753
0.7884
0.9595
0.7870
0.8449
Ada (GPT-J/GPT-2)
0.9225
0.9121
0.8029
0.8792
0.8765
0.9597
0.8284
0.8882
Fast (GPT-J/Nco-2.7)
0.9602
0.9185
0.7310
0.8699
0.8579
0.9701
0.7609
0.8630
Ada (GPT-J/Neo-2.7)
0.9623
0.9181
0.7587
0.8797
0.9230
0.9704
0.8124
0.9019
Fast (GPT-J/GPT-J)
0.9537
0.9458
0.7041
0.8679
0.8836
0.9869
0.7550
0.8752
Ada (GPT-J/GPT-J)
0.9587
0.9449
0.7308
0.8781
0.9336
0.9864
0.8008
0.9070
underperforms Binoculars or RADAR. Nonetheless, AdaDetectGPP consistently improves upon Fast-DetectGPPT across various datasets, with gains on Essay reaching up to 37.8%.
Additionally, we evaluate AdaDetectGPT's robustness to two adversarial attacks, paraphrasing and decoherence, in the black-box setting. As shown in Table 3, AdaDetectGPT demonstrates greater resilience than Fast- DeSt- to adversarially perturbed texts. The improvement reaches up to 10% for paraphrasing and up 85% for decoherence. Finally, we employ the same five LLMs from Table 1 to compare Dest-DetettGPT and AdaDetectGPT in black-box settings. Following Bao et al. (2024), we use GPT-J as the source LLM for detecting each of the remaining four target LLMs. Due to space constraints, the results are presented in Table S11 of Appendix F.5, where AdaDetectGPT uniformly outperforms Past-DetectGPT in all cases, with improvements of up to 29%.
5 Conclusion
We propose AdaDetectGPT, an adaptive LLM detector that learns a witness function w to boost the performance of existing logits-based detectors. A natural approach to learning is to maximize the TNR of the resulting detector for a fixed FNR level a. Our proposal has two novelties. First, by connecting Fast-DetectGPT statistic to martingale theory and applying the MCLT, we obtain closed-form expression for the classification threshold that achieves FNR control at level a. Second, the TNR is a highly complex function of a and w, which makes the learned witness function dependent - that is, it maximizes the TNR at a particular FNR level but does not guarantee optimality other FNR levels. To address this, derive lower bound on the TNR and propose to learn w by maximizing this lower bound. Our lower bound separates the effects of a and w: the witness function affects the lower bound only through 1=(2), which is independent of a. Consequently, the witness function that maximizes this lower bound simultaneously maximizes it across all FNR levels.
In our implementation, we opted to learn the witness function via B-spline basis due to the straightforward nature of the optimization (finding the optimal witness function boils down to solving system of linear equations) and its favorable theoretical properties (the estimation error can attain Stone's optimal convergence rate, Stone, 1982 see Appendix E.6 for more details). The number of basis functions can be selected in data driven way via Lepski's 's method (Lepski & Spokoiny, 1997).
10

---

Acknowledgments
Chengchun Shi's and Jin Zhu's research partially supported by the EPSRC grant 4P/W014971/1. Hongyi Zhou's and Ying Yang's 's research was partially supported by NSFC 12271286 & 11931001. Hongyi Zhou's research was also partially supported by the China Scholarship Council.
The authors thank the anonymous referees and the area chair for their insightful and constructive comments, which have led to significantly improved version of the paper.
References
Aaronson, S. and Kirchner, H. Watermarking of large language models. In Large Language Models and Transformers Workshop at Simons Institute for the Theory of Computing, 2023.
Abburi, H., Roy, K.. Suesserman, M., Pudota, N., Veeramani, B., Bowen, E., and Bhattacharya, S. A simple yet efficient ensemble approach for Al-generated text detection. Gehrmann, S., Wang, A., Sedoc, J., Clark, E., Dhole, K., Chandu, K. R., Santus, E., and Sedghamiz, H. (eds.), Proceedings of the Third Workshop on Natural Language Generation, Evaluation, and Metrics Singapore, December 2023. Association for Computational Linguistics.
(GEM), pp.
Ahmed, A. A. A., Aljabouh, A., Donepudi, K., and Choi, M. S. Detecting fake news using machine learning: A systematic literature review. arXiv preprint ar1::2100..044 2021.
AlMeta. Llama 3 model 2024. URL http:pp///ggttuu...o///ataaaa///
main/MODEL_ CAREEELL_ARRRCE md.
Anthropic. Claude 3: Next-generation ai models. http:://www.athhoppcc.co//////// 2024.
Audibert, J.-Y. and Tsybakov, A. B. Fast learning rates for plug-in classifiers. Annals of Statistics, 35 (2):608-633 633, 2007.
Bai, S., Chen, K., Liu, X., Wang, Ge, W., Song, S., Dang, K., Wang, P., Wang, S., Tang, J., al. Qwen2.5-Ve VL technical report. arXiv preprint arXiv:2502. 1392233,..13923, 2025.
Bao, G., Zhao, Y., Teng, Z., Yang, L.,, and Zhang, Fast-DetectGPP: Efficient zero-shot detection of machine-generated text via conditional probability curvature. In The Twelfth International Conference on Learning Representations, 2024.
Bi, X., Chen, D., Chen, G., Chen, S., Dai, D., Deng, C., Ding, H., Dong, K., Du, Q., Fu, Z.., et al. Deepseek LLM: Scaling open-source language models with longtermism. arXiv preprint arXiv:2401.00 02954, 2024.
Black, S., Leo, G., Wang, P., Leahy, C., and Biderman, S. GPT-Neo: Large Scale Autoregressive Language Modeling with Mesh-Tensee TessorTTns, March 2021. URL httpp://doot org 5281/ zenodo.. 5297715.
Black, S., Biderman, S., Hallahan, E., Anthony, Q., Gao, L., Golding, L., He, H., Leahy, C., McDonell, K., Phang, J., Pieler, M., Prashanth, U. S., Purohit, S., Reynolds, L.. Tow, J., Wang, B., and Weinbach, S. GPT-NeoX- An open-source autoregressive language model, 2022. URL bttpp://arxivv. org/ aws.///000 06745.
Bolthausen, E. Exact Convergence Rates in Some Martingale Central Limit Theorems. Annals of Probability, 10(3):672 - 688, 1982.
Brown, B. M. Martingale central limit theorems. The Annals of Mathematical Statistics, pp. 59 66. 1971.
Cai, Y., Li, L., and Zhang, L.. statistical hypothesis testing framework for data misappropriation detection in large language models. arXiv preprint 0rXiv:2501.02441, 2025.
Chakraborty, S., Bedi, A., Zhu, S., An, B., Manocha, D., and Huang, F. Position: On the possibilities of Al-generated text detection. Salakhutdinov, R., Kolter, Z.. Heller, K., Weller, A., Oliver, N., Scarlett, J., and Berkenkamp. F. (eds.), Proceedings of the 41st International Conference on Machine Learning, volume 235 of Proceedings of Machine Learning Research, pp. 6093-6111 15. PMLR, 21-27 Jul 2024.
11

---

Chen, J., Zhu, X.. Liu, T., Chen, Y., Xinhui, C.. Yuan, Y., Leong, C. T., Li, Z., Tang, L., Zhang, L.. al. Imitate before detect: Aligning machine stylistic preference for machine-revised text detection. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 39, pp. 03559923567, 2025a.
Chen, R., Wu, Y., Chen, Y., Liu, C.,, Guo, J., and Huang, H. A watermark for order-agnostic language models. In The Thirteenth International Conference on Learning Representations, 2025b.
Chen, X. and Christensen, T. M. Optimal uniform convergence rates and asymptotic normality for series estimators under weak dependence and weak conditions. Journal of Econometrics, 188(2): 447-465 2015.
Chowdhery. A.. Narang, S., Devlin, J., and et al. PaLM: Scaling language modeling with pathways. Journal of Machine Learning Research, (C(1):220:11244:1111 January 2023.
Christ, M., Gunn, S., and Zamir, O. Undetectable watermarks for language models. In The Thirty Seventh Annual Conference Learning Theory, pp- 1125-1139. PMLR, 2024.
Christian, J. CNET secretly used Al on articles that didn't disclose that fact, staff say. Futurism, January 2023.
Comanici, G., Bieber, E., Schackermann, M., Pasupat, I., Sachdeva, N., Dhillon, I., Blistein, M., Ram, O., Zhang, D., Rosen, E., et al. Gemini 2.5: Pushing the frontier with advanced reasoning, multi- modality, long context, and next generation agentic capabilities. arXiv preprint arXiv:2507.06261 2025.
Crothers, E., Japkowicz, N., Viktor, H., and Branco, P. Adversarial robustness of features in detection of generative transformers. In 2022 international joint conference on neural networks (IJCNN), pp. 1-8. IEEE, 2022.
Dathathri, S., See, A., Ghaisas, S., Huang, P.-S., McAdam, R., Welbl, J., Bachani, V., Kaskasoli, A., Stanforth, R., Matejovicova, T., et al. Scalable watermarking for identifying large language model outputs. Nature, 634(8035):818--83,, 2024.
De Boor, C. A practical guide to splines, volume 27. springer New York, 1978.
Demszky, D., Yang, D., Yeager, D. S., Bryan, C. J., Clapper, M., Chandhok, S., Eichstaedt, J. C., Hecht, C., Jamicson, J., Johnson, M., et al. Using large language models in psychology. Nature Reviews Psychology, 2(1 1):888771,, 2023.
Doshi, A. R. and Hauser, O. Generative AI enhances individual creativity but reduces the collective diversity of novel content. Science Advances, 10(28))cadn5290, 2024.
Fan, A.. Lewis, M., and Dauphin, Y. Hierarchical neural story generation. In Gurevych, I. and Miyao, Y. (eds.), Proceedings of the 56th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pp. 888, Melhourne, Australia, July 2018. Association for Computational Linguistics.
Gehrmann, S., Strobelt, H., and Rush, A. GLTR: Statistical detection and visualization of generated text. In Costa-jussà, M. R. and Alfonseca, E. (eds.), Proceedings of the 57th Anmual Meeting of the Association for Computational Linguistics: System Demonstratioss, pp. 111-116, Florence, Italy, July 2019, Association for Computational Linguistics.
Giboulot, E. and Furon, T. WaterMax: breaking the LLM watermark www.bbiiitty-obuuussssssssose quality trade-off. In The Thirty-eighth Annual Conference on Neural Information Processing Systems, 2024.
Golowich, N. and Moitra, A. Edit distance robust watermarks via indexing pseudorandom codes. In The Tiihty-eigtth Annual Conference on Neural Information Processing Systems, 2024.
Grattafiori, A., Dubey, A., Jauhri, A., Pandey, A., Kadian, A., Al-Dahle, A., Letman, A., Mathur, A.,
Schelten, A., Vaughan, A., et The I.laa 3 herd of models. arXiv preprint 18..22240...1783. 2024.
12

---

Gretton, A., Borgwardt, K. M.. Rasch, M. J., Schölkopf. B.. and Smola, A. A kernel two-sample test. Journal of Machine Learning Research, 13(1):723-773, 2012.
Guo, B., Zhang, X., Wang, Z., Jiang, M., Nie, J., Ding, Y., Yue, J., and Wu, Y. How close is ChatGPT to human experts? comparison corpus, evaluation, and detection. arXiv preprint arXiv:2301.0753 2023.
Guo, H., Cheng, S., Jin, X., Zhang, Z., Zhang, K., Tao, G., Shen, G., and Zhang, X. Biscope: Al-generated text detection by checking memorization of preceding tokens. Advances in Neural Information Processing Systems, 37: 1004065-1040990 2024a.
Guo, X., Zhang, S., He, Y., Zhang, T., Feng, W. Huang. H., and Ma, C. Detective: Detecting Al-generated text via multi-level contrastive learning. In Globerson, A., Mackey, L., Belgrave, D., Fan, A., Paquet, U., Tomezak, J., and Zhang, C. (eds.), Advances in Neural Information Processing Systems, volume 37, pp. 88320- 88347. Curran Associates, Inc., 2024b.
Hall, P. and Heyde, C. C. Martingale limit theory and its application. Academic press, 2014.
Hans, A., Schwarzschild, A., Cherepanova, V., Kazemi, H., Saha, A., Goldblum, M., Geiping, J., and Goldstein, T. Spotting LLMs with binoculars: zero-shot detection of machine- generategeeeeddd text. In Proceedings of the 41st International Conference on Machine Learning, 2024.
Herbold, S., Hautli-Jnnssz, A., Heuer, U., Kikteva, Z., and Trautsch, A. A large-scale comparison of human-writted versus ChaiGPT-ggnnratte essays. Scientific reports, 13(1):1861) 2023.
Hu, X., Chen, P.-Y., and Ho, T.-Y. Radar: Robust Al-text detection via adversarial learning. Advances in neural information processing systems, 36: 1577--5095, 2023.
Hu, Z., Chen, L., Wu, X., Wu, Y., Zhang, H., and Huang. H. Unbiased watermark for large language models. In The Twelfth International Conference on Learning Representationss 2024.
Huo, M., Somayajula, S. A., Liang, Y., Zhang, R., Koushanfar, F., and Xie, P. Token-specific watermarking with enhanced detectability and semantic coherence for large language models. In Forty-first International Conference on Machine Learning, 2024.
Hurst, A., Lerer, A., Goucher, A. P., Perelman, A., Ramesh, A., Clark, A., Ostrow, A., Welihinda, A., Hayes, A., Radford, A., et al. GPT-4o system card. arXiv preprint arXiv:2410.21276 2024.
Ippolito, D., Duckworth, D., Callison-
C., and Eck, D. Automatic detection of generated text is casiest when humans are fooled. In Jurafsky, D.. Chai, J., Schluter, N., and Tetreault, J. (eds.), Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, pp. 1808-1822, Online, July 2020. Association for Computational Linguistics.
Ji, W., Yuan, W., Getzen, E.. Cho, K., Jordan, M. I., Mei, S., Weston, J. E., Su. W. Xu, J., and Zhang, I.. An overview of large language models for statisticians. arXiv preprint arXiv:2502.1780 2025.
Jiang, A. Q., Sablayrolles, A., Mensch, A., Bamford, C., Chaplot, S., las Casas, D., Bressand, F, Lengyel, G., Lample, G., Saulnier, I.., Lavaud, L. R., Lachaux, M.-A., Stock, P., Scao, T. I.,, Lavril, T., Wang, T., Lacroix, T., and Sayed, W. E. Mistral 7b. arXiv preprint arXiv:2310.06825, 2023.
Kirchenbauer, J., Geiping, J., Wen, Y., Katz, Miers, and Goldstein. T. watermark for large language models. In International Conference on Machine Learning, pp. 17061-17082 PMLR, 2023.
Koike, R., Kaneko, M., and Okazaki, N. Outfox: Alm-ggenrrted essay detection through in-context learning with adversarially generated examples. In Proceedings of the AAAI Conference Artificial Intelligence, volume 38, pp. 21258 2158-21266.. 2024.
Krishna, K., Song. Y., Karpinska, M., Wieting, J., and lyyer, M. Paraphrasing evades detectors of Al Al-generated text, but retrieval is an effective defense. Advances in Neural Information Processing Systems, 01227469-27500 2023.
13

---

Kuditipudi, R., Thickstun, J., Hashimoto, T., and Liang, P. Robust distortion-fiee free watermarks for language models. Transactions on Machine Learning Research, 2024. ISSN 2835-8856.
Kumarage, T., Garland, J., Bhattacharjee, A., Trapeznikov, K., Ruston, S., and Liu, H. Stylometric detection of Al-generated text twitter timelines. arXiv preprint arXiv:2303.0388 03330.30067, 2023.
Lee, H., Tack, J., and Shin, J. Remodetect: Reward models recognize aligned LLM's generations. In The Thirty-eighth Annual Conference on Neural Information Processing Systems, 2024.
Lee, J., Le, T., Chen, J., and Lee, D. Do language models plagiarize? In Proceedings of the ACM Web Conference 2023, pp. 3637-3647, 2023.
Lepski, O. V. and Spokoiny, G. Optimal pointwise adaptive methods nonparametric estimation. Annals of Statistics, 25(6):2512 254-2556,2 1997.
Li, X., Ruan, F, Wang. H., Long, Q. and Su, W. J. Robust detection of watermarks for large language models under human edits. Journal of the Royal Statistical Society Series B: Statistical Methodology, 2025a. ISSN 1369-7412.
Li, X., Ruan, F., Wang. H., Long, Q., and Su, W. J. A statistical framework of watermarks for large language models: Pivot, detection efficiency and optimal rules. Annals of Statistics, 53(1):322-351, 2025b.
Liang, W., Yuksekgonul, M., Mao, Y., Wu, E., and Zou, GPT detectors are biased against non-native english writers. Patterns, 4(7), 2023.
Liao, W., Liu, Z., Dai, H., Xu, S., Wu, Z., Zhang, Y., Huang, X., Zhu, D., Cai, H., Li, Q. al. Differentiating -aeGGPT-genertted and human-writte medical texts: quantitative study. JMIR Medical Education, 41844444 2023.
Liu, Y. and Bu, Y. Adaptive text watermark for large language models. In Forty-first International Conference on Machine Learning, 2024.
Luedtke, A. R. and Van Der Laan, M. J. Statistical inference for the mean outcome under a possibly non-unique optimal treatment strategy. Annals of statistics, 44(2):713, 2016.
Mao, C., Vondrick, C., Wang, H., and Yang. Raidar: generative Al detection via rewriting. The Twelfth International Conference Learning Representations, 2024.
Milano, S., McGrane, A., and Leonelli, Large language models challenge the future of higher education. Nature Machine Intelligence, ((4):333-334 2023..
Mitchell, E., Lee, Y., Khazatsky, A., Manning, D., and Finn, C. Detectgpt: Zero-shot machine- generated text detection using probability curvature. In International Conference on Machine Learning, pp. 24950-24962. PMLR, 2023.
Mitrović, S., Andreoletti, D., and Ayoub, O. ChatGPT or human? detect and explain. explaining decisions of machine learning model for detecting short ChatGPT-ggnnrran text. arXiv preprint 2rXiv:2301.13852. 2023.
Müller, A. Integral probability metrics and their generating classes of functions. Advances in applied probability, 29(2):429 443, 1997.
Narayan, S., Cohen, S. B., and Lapata, M. Don't give me the details, just the summary! topic-aware convolutional neural networks for extreme summarization. ArXiv, abs/ 1808 08745, 2018.
OpenAI. ChatGPT. ht ///::a//chhcc openai. com, December 2022. Accessed: April 28, 2025.
Qian, M. and Murphy, A. Performance guarantees for individualized treatment rules. Annals of statistics, 39(2): 180, 2011.
Radford, A., Wu, J., Child, R., Luan, D., Amodei, D., Sutskever, I., et Language models are unsupervised multitask learners. OpenAl blog, 1(8):9, 2019.
14

---

Raffel, C., Shazeer, N., Roberts, A., Lee. K. Narang, S., Matena, M.. Zhou, Y., Li, W. and Liu, P. J. Exploring the limits of transfer learning with a unified text-to-text transformer. Journal of Machine Learning Research, 21(14)):1667, 2020.
Rajpurkar, P., Zhang. J., Lopyrev, K., and Liang, P. SQuAD: 100,000+ questions for machine comprehension of text. In Su, J. Duh, K., and Carreras, X. (eds.), Proceedings of the 2016 Conference Empirical Methods in Natural Language Processing, pp. 2383-2392, Austin, Texas, November 2016. Association for Computational Linguistics.
Sadasivan, V. S., Kumar, A., Balasubramanian, S., Wang, W., and Feizi, S. Can Al-generated text be reliably detected? stress testing Al text detectors under various attacks. Transactions on Machine Learning Research, 2025. ISSN 2835-8856.
Shi, C., Lu, W., and Song, R. Breaking the curse of nonregularity with iuffeeing-iiffrencce of the mean outcome under optimal treatment regimes. Journal of Machine Learning Research, 21(176): 1-67, 2020a.
Shi, C., Lu, W., and Song, R. A sparse random projection-based test for overall qualitative treatment effects. Journul of the American Statistical Association, 1 115651)):201-12111 2020b.
Shi, C., Zhang, S., Lu, W., and Song, R. Statistical inference of the value function for reinforcement learning in infinite-horizon settings. Journal of the Royal Statistical Society Series B: Statistical Methodology, 84(3):765-793, 2022.
Solaiman, I., Brundage, M., Clark, J., Askell, A., Herbert-Voss, A., Wu, J., Radford, A., Krueger, G., Kim, J. W., Kreps, S., et al. Release strategies and the social impacts of language models, arXiv preprint arXiv: 190.ii::00.000 0e0..999000033. 09203, 2019.
Song, Y., Yuan, Z., Zhang, S., Fang, Z., Yu, J., and Liu, F. Deep kernel relative test for machine- generated text detection. In The Thirteenth International Conference on Learning Representations, 2025.
Stone, C. J. Optimal global rates of convergence for nonparametric regression. Annals of Statistics, pp. 1040-1053, 1982.
Su, J., Zhuo, T., Wang, D., and Nakov, P. DetectLLM: Leveraging log rank information for zero-shot detection of machine-generated text. In Bouamor, H., Pino, J., and Bali, K. (eds.), Findings of the Association for Computational Linguisties: EMNLP 2023, pp. 12395-12412, Singapore, December 2023. Association for Computational Linguistics.
Team, G., Riviere M., Pathak, S., Sessa, P. G., Hardin, C., Bhupatiraju, S., Hussenot, L.,, Mesnard, T., Shahriari, B.,, Ramé, A., et al. Gemma 2: Improving open language models at practical size. arXiv preprint (xXiv:2408.0/11 18, 2024.
Tian, Y., Chen, H.. Wang, X., Bai. Z., ZHANG, Q., Li, R., Xu, C., and Wang, Y. Multiscale positive-unlabeled detection of Al-generated texts. In The Twelfth International Conference on Learning Representations, 2024.
Tulchinskii, E., Kuznetsov, K., Kushnareva, I.., Cherniavski, D., Nikolenko, S., Burnaev, E., Baran- nikov, S., and Piontkovskaya, I. Intrinsic dimension estimation for robust detection of Al-generated texts. In Advances in Neural Information Processing Systems, volume 36, pp. 39257-39276. 2023.
Verma, V., Fleisig, E., Tomlin, N., and Klein, D. Ghostbuster: Detecting text ghostwritten by large language models. In Duh, K., Gomez, H., and Bethard, S. (eds.), Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguisties: Human Language Technologies (Volume 1: Long Papers), pp. 1702-1717, Mexico City, Mexico, June 2024, Association for Computational Linguistics.
Wainwright, M. J. High-ddimessionee statistics: non-asymptotic viewpoint, volume 48. Cambridge university press, 2019.
Wang, B. and Komatsuzaki, A. GPT-J-6B: Billion Parameter Autoregressive Language Model. https:/ //gtth///ttttt/ge/ wwt.://ooooooooll//mmeeleeeee ora.
transformer- jax, May 2021.
15

---

Wouters, B. Optimizing watermarks for large language models. In Proceedings of the 41 Interna- tional Conference on Machine Learning, ICML'24. 2024.
Wu, J., Yang, S., Zhan, R., Yuan, Y., Chao, L. S., and Wong, D. F. A survey on LLM-generated text detection: Necessity, methods, and future directions. Computational Linguistics, pp. 1-66, 2025.
Wu, Y., Hu, Z., Guo, J., Zhang, H., and Huang, H. A resilient and accessible iisteriutionppeservinng watermark for large language models. In Proceedings of the 41st International Conference on Machine Learning, ICML'22, 2024.
Yang, A., Yang, B., Zhang, B., Hui, B., Zheng, B., Yu, B., Li, C., Liu, D., Huang. F., Wei, H., Lin, H., Yang. J., Tu, J.. Zhang, J., Yang, J., Yang. J., Zhou, J., Lin, J., Dang, K., Lu, K., Bao, K., Yang, K., Yu, L., Li, M., Xue, M., Zhang, P., Zhu, Q., Men, R., Lin, R., Li, T., Tang, T., Xia, T., Ren, X., Ren, X., Fan, Y., Su, Y., Zhang, Y., Wan, Y., Liu, Y., Cui, Z., Zhang, Z., Qiu, Z., and Team, Q.
Qwen2.5 technical report. arXiv preprint 1rX1v:241..55115 12 2024a.
Yang. X., Cheng, W., Wu, Y., Petzold, L. R., Wang. W. Y., and Chen, H. DNA-GPT: Divergent N-gram analysis for training- detection of GPT-generated text. In The Twelfth International Conference on Learning Representations, 2024b.
Yang. X., Pan, L., Zhao, X., Chen, H., Petzold, L. R., Wang. W. Y., and Cheng, W. survey on detection of LLMMs-genrrate content. In Al-Onaizan, Y., Bansal, M., and Chen, Y.-N. (eds.), Findings of the Association for Computational Linguistics: EMNLP 2024, pp. 9786-9805, Miami, Florida, USA, November 2024c. Association for Computational Linguistics.
Yu, X., Qi, Y.. Chen, K., Chen, G., Yang. X., Zhu, P., Shang, X., Zhang, W., and Yu, N. DPIC: Decoupling prompt and intrinsic characteristies for Ilm generated text detection. In Globerson, A., Mackey, L., Belgrave, D., Fan, A., Paquet, U., Tomczak, J., and Zhang, C. (eds.), Advances in Neural Information Processing Systems, volume 37, pp. 16194 162122 Curran Associates, Inc., 2024.
Zeng, C., Tang, S., Yang, X., Chen, Y., Sun, Y., zhiqiang xu, Li, Y., Chen, H., Cheng, W., and Xu, D. DLAD: Improving logits-based detector without logits from black-box LLMs. In The Thirty-eighth Annual Conference on Neural Information Processing Systems, 2024.
Zhang. S., Roller, S., Goyal, N., Artetxe, M., Chen, M., Chen, S., Dewan, C., Diab, M., Li, X., Lin, X. V., Mihaylov, T., Out, M., Shleifer, S., Shuster, K., Simig, D., Koura, S., Sridhar, A., Wang, T., and Zettlemoyer, L. OPT: Open pre-trained transformer language models, 2022.
Zhang, S., Song, Y., Yang, J., Li, Y., Han, B., and Tan, M. Detecting machine- machine-generated texts by multi- poulli-population aware optimization for maximum mean discrepancy. In The Twelfth International Conference on Learning Representations, 2024.
Zhang, X., Zhao, J., and LeCun, Y. Character-level convolutional networks for text classification. In Proceedings of the 29th International Conference on Neural Information Processing Systems- Volume 1, pp. 649-657, Cambridge, MA, USA, 2015. MIT Press.
Zhao, X., Ananth, P. V., Li, L., and Wang, Y.-X. Provable robust watermarking for Al-generated text. In The Twelfth International Conference on Learning Representations, 2024.
Zhou, H., Zhu, J., Xu, E., Ye, K., Yang, Y., and Shi, C. Leam-to-distance: Distance learning for detect- ing llm-generated text. In The Fourteenth International Conference on Learning Representations, 2026a.
Zhou, H., Zhu, J., Yang, Y., and Shi, C. Detecting llm-generated text with performance guarantees. arXiv preprint arXiv:2601.06560 2026b.
16

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: We confirm the claims in abstract and introduction are accurately reflected by methodology, theory, and experiments in the paper.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
is fine to include aspirational goals as motivation as long as is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations the work performed by the authors?
Answer: [Yes]
Justification:
We discuss the limitation of the work in Appendix G.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g.. independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't 't acknowledged judgment and recognize that individual actions in favor of transparency play impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
the paper. The authors should use their best
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [Yes]
17

---

Justification:
The assumptions are intuitively illustrated in Section 3 and rigorous stated in Appendix D. The proof is attached into Appendix E.
Guidelines:
The answer NA means that the paper does not include theoretical results. All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification: The detailed setting for reproducibility are provided in Section 4 and Ap- pendix C.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution a specific model and empirical evaluation, it may be necessary either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of large language model), releasing of a model checkpoint, or other means that appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how reproduce that algorithm. (b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome deseribe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
18

---

Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Question:
Answer: [Yes]
Justification: The dataset and code in this paper are either publicly available or submitted as new asset.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips. cc/
httpe//gidescccdddeeeeee ceamiiisssooooooooiioioooooooioi ceeiionolloooo olicy) for more details.
While encourage the release of code and data, understand that this might not be possible, so "No" an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurlPS code and data submission guidelines (https: / //nips. cc/ wwc/public/ggutiieeeeeeeeeeeeeee http//uudee//eeeee Ceaees//ooSSubmieec cessinnoolccyy for more details.
The authors should provide instructions data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: The details for experiments shown in Appendix C.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, as supplemental material.
7. Experiment statistical significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [Yes]
Justification: The results are accompanied by the error bars as can be seen from Figure
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi-
dence intervals, statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for
example, train/test split, initialization, random drawing of some parameter, or overall with given experimental conditions).
19

---

The method for calculating the error bars should be explained (closed form formula, call a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
It should be clear whether the error bar is the standard deviation the standard error of the mean.
It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful figures symmetric error bars that would yield results that are out of range (e.g. negative rates).
show in tables or
If error bars are reported in tables or plots, The authors should explain the text how they were calculated and reference the corresponding figures tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification:
We provided the compute resources in Appendix C Hardware details.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary failed experiments that NeurIPS Code of Ethics https: http://///./...eeeeeee http://uurrip.ccppuubp.ee cccpublic/Ettiiicceceececoeee wtwpe///eeehisueeeeeeiieleeeeeee
didn't 't make it into the paper).
9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the
Answer: [Yes]
Justification: The research conducted in the paper conform, in every respect, with the NeurlPS Code of Ethics.
Guidelines:
The answer NA means that the authors have reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., there a special consid- eration due to laws or regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive socictal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: The broader impacts of this work is discussed in Appendix G.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact why the paper does not address societal impact.
20

---

Examples of negative societal impacts include potential malicious unintended uses (e.g., disinformation, generating fake profiles, surveillance), faireess considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification:
This research does not involve data models that have high risk for misuse.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Are the creators or original owners of assets (e.g.. code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
Justification: In Section and Appendix C, we have explicitly cited credited the assets used in the paper and explicitly mentioned the corresponding licenses.
Guidelines:
The answer NA means that the paper does use existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
21

---

If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswi thcode. cow datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided. If this information is available online, the authors encouraged to reach out the asset's s creators.
13. New assets
Question: Are assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification: The new asset is the implementation of the methods introduced in the paper. The documentation for the new asset is provided alongside.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/moodl as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsoureing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification:
This paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then much detail as possible should be included the main paper.
According to the NeurlPS Code of Ethics, workers involved in data collection, curation, other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification:
This paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does involve crowdsourcing nor research with human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
22

---

We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors adhere the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
16. Declaration of LLM usage
Does the paper describe the usage of LLMs if it is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, formatting purposes and does not impact the core methodology, scientific rigorousness, or originality of the research, declaration is not required.
Question:
Answer: [NA]
Justification: The LLM used only for writing and editing, and does not impact the core methodology.
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs as any important, original, non-standard components.
Please refer to our LLM policy (uttps://neur)) for what should or should not be described.
23

---

A Additional related works: Watermarking-based detection
Watermarking embeds subtle signals into LLM-generated text distinguish from numan-writter text (see Ji et al., 2025, Section 4.2, for a recent review of LLM watermarking). Aaronson & Kirchner (2023) propose watermarking technique based on Gumbel sampling. Follow-up works have focused on preserving text quality during watermarking (Christ et al., 2024; Dathathri et al., 2024; Giboulot & Furon, 2024; Liu & Bu, 2024; Wouters, 2024; Wu et al., 2024), enhancing watermark detection (Dathathri et al., 2024; Huo et al., 2024; Cai et al., 2025) and maintaining robustness against adversarial edits (Golowich & Moitra, 2024).
Our work is related to line of research that frames watermark detection as a statistical hypothesis testing problem (see c.g., Kirchenbauer al., 2023; Hu et al., 2024; Kuditipudi et al., 2024; Zhao et al., 2024; Li et al., 2025a,b; Chen et al., 2025b), Under this framework, rejection of the null hypothesis (that no watermark is present) provides statistical evidence that the text was likely generated by an LLM.
B Details on the analytic example in Section 3
In this section, we provide rigorous discussion about the analytic example presented in Section Noted that
E x X c (w(log (Xx)) = (()) ((0) (()).
E Ex (X)]) ((x))} = Pr(1)w(log (()) + P:
follows that
X (w(log ((x))
(w<log (X.)))
=(((1) Pc())) (log ((1) wllog (0))]
If w is an identity function, i.e., wxx))= = then the statistics (5) becomes
1
log
((1)
Σ -o())-)(1)))
T
In this case, (5) converges to zero as q - 1/2 regardless the distribution of However, if we consider adaptive witness function, the statistics in (5) becomes
(wog q(1)) wlog (())
Σ (9(1) pi())).
When ((1) # 1/2 (without generality, we assume ((1) <(0) > 1/2), there always exists
witness function w(2) = I { logo(1)+ such that (5) becomes
L [logg((1) logg(0)) (logg((1 log (1)H) Σ
L
q(1) - 1 f Σ Pc(1),
= I - -
which is independent of the log ratio.
C Experiment details
Details for witness function estimation. In this part, we illustrate how we fetch external text datasets for training witness function in our experiments. As mentioned in the main text, when testing the performance of AdaDetectGPT on one dataset (e.g., XSum), we randomly select two other datasets (e.g., SQuAD and WritingPromph for training the witness function. This ensures the data for testing would not be included for training.
24

---

Recall that the population version of objective function for estimating w is
x woloo (X, - E. Xerr, w wloog di (X.(Xe)))
(10)
E. Ex X, (wolog (Xe]
In the implementation, we made three modifications to this objective function to facilitate the computation, accommodate black-box settings with unavailable logits and handle prompts that are not explicitly included in the text:
1. We replace the expectation Ex in the numerator of (10) with its empirical average over the human-authored passages {x [.) This leads to the following objective function:
Σ E, Ex Kingg [oo ou - E,, o (x. X
(11)
" E. Ex Excro X,rg (wolog 9e (X,
2. Taking the expectation Ex -x,- and the variance Var X.rq, is time-consuming, these operations need to be repeated L times once at every token position To address this, we approximate x the first term of the numerator of (11) by X,(), sampled from the LLM distribution gr-
This, in turn, allows us to approximate the expectation by
Ee (woggo di (X, X(OI - E; E [wolo q (X, (x
m E, Excenp Var X (wolog qe (Xx)))
where (1) denotes the ith passage generated from by prompting the LLM to rewrite X(). As for the variance operator, similarly approximate Exceop in the denominator by Ex
This allows us to upper bound the denominator by "V Σ. Var(w ge xx)))) leading to the following lower bound of the objective function,
Le di X;
- -;
TV Σe Var(w(log (olloogg((Xeeee.e (xxx))
where the variance the denominator can be estimated by the sampling variance estimator
Vaog y (X,lxe)))
1
w(log a (X
wolog a (X(') ( {x
n
To further simplify the objective function, we interchange the order of E, and Var the denomi- nator, leading to
Ex En en (X, (X - E.wooo (8) XXxI
(12)
RV Var wloo qe (Xee(xe)))
Additionally, since the numerator incorporates both human- and LLM-authored text, we refine the denominator of Equation (12) by replacing the sampling variance estimator with a simple average of the estimators computed using human- and LLM-written text
Var
Σ (((log((X,(xeet)
Var Σ
2
This yields our final objective function, in the form of a two-sample 1-test statistic,
E,wloo
(13)
" m/o.5 (.. wolog X, X xx)))) + 0.5 w(log (X, (X,
25

---

Compared to its population- version (10), (13) is more suitable for black-box settings. In such settings, the distribution q unknown, making the expectation and variance over q in (10) infeasible to compute. In contrast, (13) relies on text generated by the L.M.. Therefore, even without access to 9. still prompt the target LLM to produce X. Likewise, for detecting text generated under specific prompts, we can incorporate these prompts into the rewriting process to produce X.
We next discuss the computation of to that maximizes (13). To ease notation, we denoted (h). Similarly, for the log prg-oabbbilities computed from machine- generated
log (x, (x 2it
text, we define them as (1m)s. s. Using these notations, (13) can be represented by
Σ L
m
w
(m)) 2ss
w(
((=()))) (14)
V Var(En w(z + Var(E, ()
L
up to some proportional constant.
Recall that we restrict the witness function to take a linear form of w(=) denotes the B-spline basis function (De Boor, 1978) and B denotes the regression coefficients. Then numerator of (14) then becomes
(z) where ((=)
(m)) Zit
(h) B, (z
whereas the denominator becomes
BT (5))) + E(h) 333, where 5(( = 51())
{(()
L (z(tM) T Tz (b) - pT: (T(
1
(h = (6< (N) ,.... (1 (1i) T.
(h)
(( )T)
P4
t=1
and {(m) can be similarly defined. Consequently, the objective function can be rewritten as:
Σ + (()) - Ei + Et o(= (T) B
(BT( + {8
0l (m))
Σ
Σ
6(2 )
(1)
8 (((()) + ((m)
1
i=1
t=1
6(
(m))
6/2
(
(5()) +((m) -
where a (5)) //3 + 500) whose l2 norm equals 1. It is immediate see that the argmax à has a closed expression,
[ 2
where
ã (E(N) {())
Σ
1
((2((
(m)
Σ
Σ
((2(h))
(15)
1=1
t=l
This leads to
8 3= (5(h) +
26

---

and ((2) 3.
Pre-trained language models. We assess the performance of method using text generated from various pre-trained language models outlined in Table S4. Following the setting in Bao et al. (2024), for the models with over 6B parameters, we employ half-precision (torch. f1oat16), otherwise, use full-precision (torch.float3)),
Table S4: Description the source models that is used to produce machine-generated text. we
present the address of models in http://huggingface.co/
Name
Model
Scale (Billion)
GPT-2 (Radford et al., 2019)
1.5B
GPT-Neo (Black et al., 2021)
EleutherAA//gpt-eee-227
2.7B
OPT-2.7 (Zhang et al., 2022)
facebook/opt-2.77
2.7B
GPT-J (Wang & Komatsuzaki, 2021)
EleutherAAl/gtt--GBB
6B
Qwen2.5 (Yang et al., 2024a)
Qwen/Qwen2.55778
7B
Mistral (Jiang al., 2023)
misttalai/MMistra--BB-V..33
7B
Llama (AIMeta, 2024)
mota-llamaa/Mcaa-Llaa---3-3
8B
GPT-NeoX (Black al., 2022)
EleutherAllgpt-nox--000
20B
Setup the closed-source LLMs. For the gpt-4o, the version is set as Ept-40-2024-088 The generation process by sending the following messages to the service. Message for XSum and Writing is the same as that described in Section C.2 in Bao et al. (2024). We describe that for Yelp and Essay are:
('role': 'system', 'content ' You are a Review writer on Yelp. '), ('role: 'user' ', 'content's 'Please write an article with about 150 4 words starting exactly with: <prefix>'},
and
{ ('role': 'system', 'content'; 'You are student of high school and + university level. And now, you Essay writer. ('role': 'user', 'content 'Please write an essay with about 200 4 words starting exactly with: <prefix>'>,
respectively.
For Claude-3.5-Haiku, the system instruction was set analogously (e.g., Yelp review or essay writer), while the user role contained the corresponding content prompt.
For Gemini, the instruction was fed into the system instruction parameter, with value identical to the concatenation of the system content and the user content used for GPT-4o.
For all closed-source models, the temperature parameter is set 0.8 encourage the generated text to be creatively diverse and less predictable.
Setting on experiments with adversarial attacks. In Table 3, we have conducted experiments to evaluate the robustness of AdaDetectGPT against 2 adversarial attacks: (i) paraphrasing, where an LLM is instructed to rephrase human-written text, and (ii) decoherence, where the coherence L.M--genrrted text is intentionally reduced to avoid detection. These experiments were carried out across 3 datasets and types of sampling and scoring models setup. resulting in total of 18 settings. Both adversarial attacks were implemented following Bao et al. (2024).
Implementations of baselines. For the baselines considered in our experiments, we use the existing implementation provided in https:// // thub. com/ wwt./ooooaaaaaae http://aogagggggg///eeae/ htt.//fttttttttgrrrreeee which distributed in the MIT License. We run DetectGPT and NPR with default 100 perturbations with
27

---

the T5 model (Raffel et al., 2020) and run DNA-GPT with a truncate-ratio of 0.5 and 10 prefix completions per passage.
Evaluation Metric. We measure the detection accuracy by AUC (short for "area under the curve"). AUC ranges from 0.0 to 1.0, an AUC of 1.0 indicates perfect classifier and vice versa. The relative improvement of AdaDetectGPT over FastDetec1GPT is calculated by PabsscccGPP--PPPtetteeerr which 1.0-FaatDeeeeeei1 represents how much improvement has been made relative to the maximum possible improvement for FastDetectGPT.
Hardware details. Most of experiments are run on a Tesla A100 GPU (40GB) with vCPU Intel Xeon Processor and 72GB RAM. For the experiments where the source model is GPT-NeoX, we run on a H20-NVLink (96GB) GPU with 20 vCPU Intel(R) Xeon(R) Platinum and 200GB RAM.
D Technical assumptions
In this section, we list the assumptions required for the theorems presented in Section hold, and discuss when they are expected to hold and how they may be relaxed.
Assumption 1 (Margin). With (e) defined as in (4) and w" (o) defined as the optimizer of (9), for any E (0, there are constants dec Co depending only such that for any x S. da it holds that Px> (X) zal S x) S C.
We also require the following technical conditions hold in order to obtain TNR lower bound and FNR control (Theorem and Theorem 2).
Assumption (Minimum cigenvalue). For each t I,....L introduce the quantities
(1) Exxexppx Exng X olog q: (X, xxx));
Σ, Ex X.imppxxx.mg Neman olog q (X, Xxt)) q (X, xxt)) P4 ( (1
There absolute constant C and 0 such that Amin (E,) 2 Cd for all t. Assumption 3 (Equal variance). For any non-constant witness function w, define
Var mm (u(log((Xx)
Var Varx Ximpi (w(log (u(log((Xe(X<xi)))
P. 22 are lower bounded by some constant o > 0 almost surely. Moreover, 0g.L - 1..L + 0 in probability as L + cc. Assumption 4. For any wilness function define
b L
1
Varx~n (x(log((X.)xxx;))))
1
Σ Varx=p (x,log(((x))Xee)
0 P.L. T,
X ~ q, then 22,//02 + 1 in probability. X ~ then / + 1 in probability.
Conditions similar to Assumption 1 are commonly assumed; see, for instance, Audibert & Tsybakov (2007); Qian & Murphy (2011); Luedtke & Van Der Laan (2016); Shi et al. (2020a,b, 2022). As- sumption 2 is mild, since the constant y is allowed to be arbitrarily large. Assumption 3 basically requires the conditional variance of logits be asymptotically equivalent for human- and machine-generated passages. This assumption not overly restrictive, as the variance discrepancy between the two types of passages is relatively small in our dataset (see Table S5, where the ratio f the variances are very closed to 1). Assumption commonly assumed in martingale central limit theorem literature, see c.g. Bolthausen (1982); Hall & Heyde (2014). Our empirical results
28

---

further support the validity of Assumption 4: the sample mean of the ratio remains nearly constant as function of L. while its variance (in parentheses) approaches zero as -+ oc across all three datasets (see Table S5), suggesting that this condition is practical. Furthermore, two commonly (KS) test and the Shapiro-Wilk (SW) test are conducted to evaluate whether the proposed statistic follows normal distribution. As shown in Table S6, almost all p-values exceed 0.1 (most by a large margin), indicating that our test statistic passes normality tests in most cases. These test results also provide strong empirical support for the validity of MCLT regularity conditions.
employed hypothesis tests the Kolmogorov-Smime
Table S5: Sample mean and variance (in parentheses) of the ratio evaluated on 3 datasets as L increases.
100
150
200
250
300
350
XSum
1.09(0.12) 12)
1.07(0.09)
1.06(0.08)
1.04(0.07)
1.01(0.06)
0.99(0.05)
SQuAD
1.03(0.10)
1.02(0.07)
1.02(0.06)
1.02(0.05)
1.01(0.05)
1.03(0.04) 1.07(0.03)
Writing
1.10(0.06)
1.09(0.05)
1.09(0.04)
1.08(0.03)
1.05(0.03)
Table S6: p-values of KS and SW tests across 3 datasets and 2 source LLMs.
LLM
Test
XSum
SQuAD
Writing
GPT-Neo
KS
0.72
0.54
0.18
GPT-Neo
SW
0.50
0.65
0.89
GPT-2
KS
0.10
0.52
0.28
GPT-2
SW
0.37
0.026
0.14
E Proofs
E.1 Notations
Throughout the proofs we will make use of the following notation. We will denote absolute constants
by K1, R2, .... For sequence of random variables {X, n 2 1} with distribution functions
(Fx, nn 2 1} and some (possibly degenerate) random variable Y with distribution function Fy
we write Xn 3 Y as n + xo lim P([X, Y| > 8)
for all > 0, and Xn 4 Z lim Fx, (x) Fy (z) at every continuity point of Fy (-). For vector ( T Rd n
n=+00
we write ||>||p = (Ei= // with < < < oo for its l, norm.
E.2 Preparatory results
We introduce three auxiliary results in this section. Theorem S6 presents a concentration inequality that is critical to establishing the learning guarantees of AdaDetectGPT in Theorem 3. Theorem S7 formally states the MCLT. Finally, Lemma can be viewed as a conasyymtootic version of Theorem S7 which provides an explicit error bound on the accuracy of the normal approximation in the MCLT.
Theorem S6 (Bounded differences inequality). Let X' be measurable space. A ffuuction f X + R has the bounded difference property for some constants C1...., Cu. ie., for each 1.....n. n.
sup 33 En...e x
I (a) (..,..., Ft-1, F141, s.) (EI, Ni- 2/y 3i4h In)] G.
(16)
Then, if X1,.... Xn is a sequence of identically distributed random variables and (16) holds, putting Z f (X1.... Xa) and _ o, for any > holds that
PZ 1E (Z)
< - (12)
Proof of Theorem 86. See Section 2 in Wainwright (2019).
29

---

Theorem S7 (Martingale central limit theorem). Let (Ma. iisis kn n 2 1} be a zero mean
square integrable martingale array with respect the filtrations {Fu,s 1 S kn 1) having increments N Ma, Mn.--1 the following conditions hold
CI: Σ B [ (1xm,1288) [Fns-1] 0as oo all 8
C2: E 1 Fn,i-1 2 0² as +
C3: the o-fields are nested: Frg Fn+1, for 1 sii kn and n 2 1
then Mn,k. 4 z as n 20, where Z ~ ~ (0,
Proof. See Corollary 3.1 in Hall & Heyde (2014) and Theorem 2 in Bolthausen (1982).
Lemma S1 (Convergence rates in MCLT), Let X (XI.... Xn) be sequences of real valued random variables satisfying for all 1 s S
E(X, Xx = 0 almost surely.
Let oē - = bounded by some constant almost surely for all n and sn/ v is bounded away from zero. Then
- of = B $2 = = ot and V2 = Et oi/s2. Suppose pxa is
Ei= X
log ( Vn + +EIV2 197--117 11)1/33
sup
P
Sx - 4(2) =0 -
VE
ZER
where ( is the cumulative distribution fanction of standard normal distribution.
Proof. It follows from Corollary 1 of Bolthausen (1982) and the condition s,/ ///v/i is bounded away from zero that
P Ei= X.
(nllogn
/nlogn
(E - -1)2//3 -0(190
log nn
sup =ER
2z
(22) = =0
E VV
1//2/3
Sn
follows that
X1
sup
P
1=
2z
- (())
zER
X1
Σ 1ー X1
sup
P
(V, - 1) - (()))
トm o7
zER
X,
Σm X,
Σイ X,
(Vn (Vn-11)
< sup E
S
(V/ - 1) - $
z +
=ER
8n
Σ of
v E oo
Σ X, E oz
(Vn -11 - ((2)
+ sup E =ER
++
log n
Σ X₁
<
+
V2
11)
+ (2() x E =ER
(Vn - 1)
(17)
nn
VΣ x oe
By the definition (2), we have that
1
1
sup
b (2))
= sup
exp(-22
S
(18)
selt 2
2m
30

---

Leveraging the facts that sup, [Xe] are upper bounded and sn/ V is lower bounded, we obtain that
Σ X - oz
E
(V - 1)
=
1==
Vn Vn - 1)
8np
X,)
V-3/2 1)
2/3
21=1
(E - 1)87) 1/3
s
E
3/2
An
= 0
[E)V,, - -112)
= o [EVV 113 1/a)
(19)
where the third-to-last line is derived from Hölder inequality, and the second-to-lass equality holds due to the boundedness of Vn. Combining equations (17), (18) and (19), we obtain
sup
P Ei= VE
X
S
((z)
S
log n Vn
+ (EIV2 - 11)1/3)
(20)
zER
oi
which finishes the proof.
Lemma S2. Let ( be the cumulative distribution function of standard normal distribution and ()) be its derivative. Then for any random variable X,
EΦ( + X) Z min(1 a, a. (2a)
where O <a < 1/2, Za is the w-th quantile of standard normal distribution.
Proof of Lemma S2. Since (')x) (V2m) -1 exp (-x²/2). we noted that ('(x) 2 ('(=.) holds if
and only za I x 21-a- Therefore, 0 - X 21-a Za. then by the mean value theorem.
$(za X) ((2a) (() + (z.)
where & lies between & and 21 a. If X < 0, then
(=nn + X) = (zx) + 4 (1) X 2 a + (2.
where 7 lies between X and 2n Moreover, if X 2 21-a
Zu. then Rex + X 2 21 It follows that
(2aa + X)= 2 ((1-a) = a. Therefore,
EØ + X) 2 Emin {a + 2 (2, min {a + & (za \EX, a},
where the last inequality follows from Jensen's inequality. This finishes the proof.
In Lemma S3 below, we provide an upper bound for the parameter estimation error. Before doing so, we define
Q. = (B Σ8} TT
(21)
Q (8) = {3 Emn -
B TT n
(22)
where f0n
--1 E1 (1) (2)
1== P4
14 1 1-1 E -
(1) pi and
(2)
Σ
E Xxngg Φ (loger (Xe x(()
"
Σ
1 (logur (x(() <7)
x(())
i=1
"
11
Excro Bx (log (X, Xxx))
" = Ex E 2 (log (X, Xxx)
31

---

for each t = 1,, I..... L. Similarly, define Σn = ---1 "'E E, and E = --1 E|= Ee where
Σ 1
n
④ (loga (XL x x @ (log qi (XL (x.1x2) (1) )
Pe (ai
x ga
11
for each 1. = I.
Lemma S3. Grant the assumptions in Section D hold. Let 8 be the maximizer of the function (21) over all 3's with Eg norm equal to and let 3 be the maximizer of the empirical counter- part (22). There are absolute constants K1 and 82 depending only on the constants stated in the assumptions such that for any >> holds that |3 30 S with probability at least 1 K1 exp (-x2d (miin 1))²).
Proof. Observing the 3 E arg max Q (3) and f E arg max (3) for any 2 > 0
P P( gr
2) =P
sup
On (3) Qn (3") 0)
(23)
8:10--+111 11,>
1
sup
1Q (B) Q- (8)1
inf
13t) - Q. (31)
8:1 11
2 8:113
12>
+ P 1Qn (8*) Q. (B*)
1
inf
(0t - Qu (81)
2 3:188-
For B such that ||8 - 8 112 > 2, due to Assumption 2 with some absolute X1 we must have that
Q. (33)) Q. (B) 2 KId d 7 1 - 111 2 k1zd
(24)
For any B e IRd with || =1 holds that
1Qx (3) - Q- (B)]
s <B - 1is (pn - 14) + 18
18T Rml ESTE - -88 ESTT -
EB) } 113T (pn--M0 n)
+ 2 { min (BT (333
13 E. Σ
(25a)
$ (Am) 13T (īn (m)= 11)
(25b)
+ 1 2 min (Amin (mn) ) Amin (
{
1B Aml 3 SmB B Σ
(25c)
where in particular (25a) holds due the inequality
1
x
1 yl
(26)
Vu
2 (min x. v))
for x, y > O. For (25b) note that due to the boundedness of (()) for any with || 1 holds that
BT (i - 14) is the average of i.i.d. random variables each bounded in absolute value by constant which does not depend on B. Therefore lower bounding Xmin (E) 2 R2d- for some absolute Ka
using again the boundedness of o( and applying Hoeffding's 's inequality, for any 2 > 0
TP (25b)
((25h)
1 2 11 zd
< TP (13T (Tn n)] > agad " < 2 exp
K4712 d
(27)
for certain absolute K3, K4. The following argument will be valid on the event
Amin (E.) 2 2 Amin
(28)
For (25c) notice first that with ||:3||2 the quantity 1.3T P almost surely bounded from above by some absolute constant independent of B and d. Moreover due to the boundedness of ((+) it is easy
32

---

to see that the statistic 18 E - is a self-bounding function of n random variables with constants (see equation (16)) & & for = 1...., which again do not depend on 3. Therefore, on the event (28) applying Theorem S6 we obtain that
1 P (25c) gRnd I
TT kgzd #) I exp
kgn=z d5T
(29)
for certain absolute Ki; Kg. Finally, note that
Amin (E) min
B E Amin (2)
max p:11
(T,,,
(30)
B: 2
2
and arguing as in (29), the final term (30) is no larger than k2d with probability at least
- 2 exp (-
K 22
Since by Assumption 2 we must have that K2d Σ min (E) the event (28) must hold with the above probability. Since the above arguments hold for any with || 1, plugging (27) and (29) back into (23) and accounting for the event (30) the stated result follows.
E.3 Proof of Theorem
According to the decomposition To (X) = T ( (X) -T! (X) with (X), T!! (X) defined by
Σn [lowg qi qi(xx, (X,))x()) - E Ex ~i w wlog q (X,(x=1))
(x)
En Varx.ng. (w(log do (X, Xxt)))
T ExlEx-ng wlog qe (X))Xet)) E3 X.mm
(31)
Ee Var X (w 2e (x,
we obtain that the TNR can be represented as
Pxpp (Ti (X) < za)
IP Pxxx (X) S Za + T (x)
(32)
is easy to verify that when X ~ p. T(e2) ( p converges to standard normal distribution. Specifically, using Lemma S1, obtain that
Pxap (xx(X) S 20)
Px
( 9th
S (Za + (T(2 (X))
P.LL
P..LL
D( + T (X)) + 1 (zo + T () (x)
JnLL
( + + (x))
pp.I
+0 (og L/VL.) + (1)
2 1(2a + (122) (x))
sup (z) x Eax + T12) (x) (x)
Tg.h
x
zER
PppL
+o (0g L/VD + (1),
where the little-o, term arises due to the asymptotic equivalence between p, and ō o in Assumption
Take expectation on both sides, we have by Assumption 3 that
Px~p (Te X) < zn)) > (0 - (2)) ()) - o(1) + O(log L/VL).
Next, define 22 Ex~po It follows that T (x) EE ( (x) Ja.d
o. Under the equal
variance assumption in Assumption 3, also have og o - in probability. It follows that
33

---

for any e > 0,
(x
(2 + + (x)) (X) o. u
+E T
) 5 >c]
18 2o + T | Jq - T E
M
EΦ
Za 2
(X)
T.
J G + sgn (T
N
EΦ
Za T(2)
(X)
J + (T
TP4
(Za T(2) (X))
J,
1( -ū,,11 o
(g
Ed (z,,
T(22 (X)
Jg
P( P((0,,t-ā,,.1 c)),
sgn (T
G.
where the first inequality is obtained due to & is non-negative and the second inequality holds due to the monotonicity and boundedness tb Together with Lemma $2 and Assumption 3, we obtain
P Px-p (X) S mm)
2 min
1 - a, (1 )B (2)) (X)
T. + sgn(T
(33)
- -P((0g,1
Tg1ee 2 + +0 T./VT.) o(1).
Let L + and using the fact that E T (X) (X)
GoLL
= (2+) (X), obtain that TNR is asymp-
totically lower bounded by min(1 a,, + ) (X))
TT(2+))
tonn By taking -> 0, then
the conclusion of Theorem follows.
Remark 1. In fact, the equal variance condition (Assumption 3) can be relaxed. Specifically, is not necessary for the two variance 02 and oz. to be asymptotically equivalent in probability. Rather, it suffices require their ratio converge some positive constant in probability, i.e.,
Jq.L Ps Ko- Jp.L
Since Ko need not be 1, this proportionality condition is considerably weaker than the equal variance assumption and is more likely to hold in practice. Under this relaxed condition, following nearly identical arguments to those in Theorem 3, we can show that TNR is asymptotically lower bounded by:
min (1 (((Koa) + 6(Kozz)
This lower bound differs from the one in Theorem due to the change in assumptions. However, since &( (oza) depends solely (not on the witness function w), our core conclusion maximizing the lower bound is equivalent to maximizing T(2*) remains valid. Thus, our proposed methodology remains theoretically sound.
E.4 Proof of Theorem 2
(log q: (X,XXe))) Then if X have E (Z, X <t) } = 0) almost surely. Without loss of generality, assume Φ is bounded. Otherwise, can define Φ |/]] to make bounded. Under the lower bound assumption Assumption it is easy to verify that Z, satisfies all conditions of Lemma S1. Therefore, by invoking Lemma S1,
Proof. Denote Z, @ (log qe (X, -Bx (xx
we
34

---

we obtain for any E (0, 1),
FNRg -a
(Tx PT S za) - -2(2a)
Σ1= 2r
= Pxmm
EE B(Zz|Xet S #o - ((2x)
o log
+ +0 - -1)11))
VI
Taking expectation on both sides, we obtain
log
B(FNR,) - a +0
+ O V2 1))//).
VL
This completes the proof.
E.5 Proof of Theorem 3
Proof. Since E(TNRR) 2 TNR -E(TNR - TNR. [), is enough to upper bound the second term in the last expression. Denote by (T.(o) and T- (o) respectively the classifier (4) using witness functions i ) and w² (o) ( 8 (see the definition of B and 8 in Lemma S3). Write AT ( TT (x) 7* (ax) and A. = supx An (x)). For any Za > we have that
TNR TNR
P Exmp (x) S 2a) - Px~u (T (X) S za)
1 (Pa(a)s=.) 1 1r (1)>2a) dp (x)
$ [
112 - - dz(x))
(00000) + (f..,.)>e..rrrsss....d.... (x)
2 f L(IT-()) d2(x))
xx (T zal s Am)
(34)
Due to Assumption 1 on the event
An S {00
(35)
we will have that [TNRg- TNR S Kz An for some absolute Kig- We therefore focus on bounding the quantity A.. For each w E Ω and each j = 1,..., L,, we introduce the quantities:
(((") w (log dj (X, Xzz)),
3 (w) = E Ex,aa w (log9) (X, (x]1
(a) ( = Var Xarj (log (x, Xxs)
With this notation in place we have that for any x
-1/2
-1/2
(x) S
Σ
(8)
L
(10)
L Σ 0 ((rr))
(36a)
VI
-
b
)(0))))
(0)
-x,(01) (u, 1 )(())))
(36b)
L
35

---

where for clarity we have suppressed dependence on above. For ease of notation put Z = log qi (Xt X<x) and Z, log (Xe Xxa) where X2 gt. Write also x(+)
(Bi())..... Ba( T. Recalling that w()) = x( 3 for arbitrary =1,.. -...... L we have
(of (m)) (ofu²))
E
Bi B1g - pr, S/
(IBi, (12)))
l2
Bi, (2z) EE Big [2))
+ Bi, (2))
Big (2/)
d
K4
Brg 31. - 8r, 3/
2
1 1=
Σ
B1g (312 51,
51g 57 - B1,
1=1
d
Σ
B12 818
+
K4
2
2
3/
87,
1=11
1-1
1-1
= Kis Vd 3 8-
KiS
8r 11
S
for absolute K4, Kg. Consequently, using inequality (26) and Assumption 2, on the event (30) we obtain that with absolute Ki:
(36a)= S Kgd
Σ yj
(
3
8r
(37)
VL
Observe that conditional on 33 the term
Σラ=1 (1) 12) - 11 (3) is martingale with increments bounded
from above almost surely by a constant independent on 3; by the Azuma Hoef--ng inequality the normalized sum in (37) has sub-Gau Goo-Gaussian tails. By Lemma S3 the term ||3 1 likewise has sub-Gaussian tails. Therefore on the relevant events we obtain that (37) has sub-exponentia tails, and consequently for any
P (37 2) I K7 exp -Nig min
(38)
+6
d
for certain absolute K7, Kg. Similar arguments show that the normalized sum in (36b) has the same tail behavior as (38). Since the above augments do not depend on obtain that (38) likewise described the tail behavior of A... Consequently, on the relevant events we obtain that
E TNR TNR,.
=
P P[TNRR= TNR >> =)dz da
Kn > 2) dz
(K110 (-xiomin min {2² n
d5v+6 }
n
<
exp
d V
dz
154+6
A K11
(39)
n
for certain absolute Kg, K10, K11- When the events (35) and (26) do not hold from (34) we have the conservative bound TNR TNR,.. < 1. However, the probability of these events not holding smaller than (39) up to constants. Therefore, the stated result follows by the law of total expectation.
36

---

E.6 Smooth witness functions
An important quality of spline estimators, which in part motivated choice of estimator for the witness function, is their ability to learn smooth regression functions at optimal rates. Following the proof of Theorem 2.1 in Chen & Christensen (2015) one can show that when the optimal witness (that is, the function minimizing the functional (21) among all functions with bounded & norm) is H-Hölder smooth, the estimated witness function attains the rate
(V (Vllo((n) Odd n
sup [0(z) =²(2)) = Op
Consequently, choosing the number of spline bases as d = (((n/ log(n)) x the sup norm loss will of the order Op (log((n)/m) _ This rate was shown to be optimal by Stone (1982). One can therefore show that choosing the number of spline bases in this way the expected true negative rate will be lower bounded as
E(TNR#) > TNR - -O((og(m))m))))
In this section we provide sketch of this result.
We argue along the same lines as the proof of Theorem Since (T 2 TNR,.- - -E TNR=-() is enough to upper bound E(TTNR, TNR=- l). Define the quantity An supp (T) T (x)), and introduce the event
A(x1) = A S x ( + (log(n)/on (/inn)///) /n)
(40)
Therefore, with arbitrary for some absolute we have that
E[TNR, TNR... E(TNRR TNR (A(CE))) + E([TNR, TNR (-A(s11)
2F 2F ( - =a S An) x [(((H)))) + +P((A(m1) (41a)
$ <kIE(An A(K1)) +P(-A((11)
(41b)
where (41a) follows from the arguments leading up to (34) and (41b) holds on the event (35).
Using the mean value theorem and Assumption 3 one can show that up constants Ån is smaller than sup_ ((2) w (z)]. therefore by (40) the first term in (41b) will be of the order O(d - (log(n)/n) ボオイт ). Examining the proof of Theorem 2.1 in Chen & Christensen (2015) it can be seen that for any K3 > on may choose Kı that PP(A((n)) < Ra, Therefore, we can choose Ki appropriately that the second term in (41b) will be of the order o(log(n)) क Finally letting (((n/ lonn//oggn)))))) =d'r yields the desired result.
As mentioned in the main text, when the optimal witness function is believed to be smooth but the order of the smoothness is not known the number of spline bases can be chosen in data driven way via Lepski's method (Lepski & Spokoiny, 1997).
37

---

Additional numerical results
F1
Results on additional open-source models
Table S7: Performance on three open-source LLMs (Qwen2.5, Mistral, LLaMA3) across five datasets.
Model
Method
XSum
Writing
Essay
SQuAD
Yelp
Likelihood
0.6175
0.7041
0.6755
0,5183
0.6793
Entropy
0.5403
0,5043
0.5073
0,5232
0.5236
LogRank
0,6325
0.7150
0.6958
0.5166
0.6943
Binoculars
0.6297
0.7578
0.8018
0.6164
0.7199
TextFluoroscopy
0.5778
0.5110
0.5638
0,5383
0.5060
Qwen2.5
RADAR
0.6469
0.6190
0.6061
0.6262
0.6276
ImBD
0,6653
0.6584
0.7874
0.5168
0.7392
BiScope
0.6320
0.6610
0.6625
0.6250
0.7050
Fast-DeteeiGPP
0.7523
0.8313
0.8347
0.50T6
0.8465
AdaDetectGPT
0.7963
0.8965
0.8799
0.6044
0.8915
Relauve
I7.7682
30,3912
27.3167
0.6431
29.3663
Likelihood
0.7409
0.8643
0.8667
0.7068
0.7598
Entropy
0.5290
0,5420
0.6052
0.5070
0,5103
LogRank
0.7270
0.8446
0.8467
0.7041
0.7499
Binoculars
0.7218
0.8440
0.8314
0.7258
0.7502
TextFluoroscopy
0.6210
0.5555
0.5127
0.5772
0,5109
Mistral
RADAR
0.6518
0.6537
0.6292
0.6055
0.6018
ImBD
0.7683
0.8391
0.8631
0.8073
0.7440
BiScope
0.7320
0.8740
0.9000
0.7283
0.7840
Fast-DeteetGPT
0.8922
0.8151
0.9052
0.8812
0.8902
AdaDetectGPT
0.8944
0.8275
0.9069
0.8851
0,9026
Relaäve
2.042.3
6.6718
[8332
3.3051
T1,2763
Likelihood
0,8236
0.8929
0.9115
0.7071
0.8915
Entropy
0,5545
0.5732
0.5626
0.5047
0.5010
LogRank
0.8634
0.9122
0.9351
0.7422
0.9146
Binoculars
0.9546
0.9845
0.9949
0.9469
0.9854
TextFluoroscopy
0.5479
0.5274
0.5478
0.5535
0,5362
LLaMA3
RADAR
0.7154
0.7285
0.7835
0.6619
0.7875
ImBD
0.8643
0.8837
0.8928
0.7596
0.8677
BiScope
0,9450
0.9830
0.9900
0.8783
0.9860
Past-DetecIGPT
7.9934
0.9879
0.9901
0.9488
0.9882
AdaDetectGPT
0.9782
0.9893
0.9924
0,9553
0,9900
Relative
18.0119
11.6202
22.7215
12.6288
15.7610
F.2 Additional results on black-box setting
Table S8: AUC scores various detectors to detect text generated by Gemini-2.5 across datasets.
Method
XSum
Writing
Yelp
Essay
Avg.
RoBERTaBase
0.5311
0.5202
0.5624
0.7279
0.5854
RoBERTaLarge
0.6583
0.5888
0.6029
0.8180
0.6845
Likelihood
0.7127
0.7547
0.6566
0.7565
0.7201
Entropy
0.5754
0.5088
0.6023
0.6038
0.5726
LogRank
0.6084
0.5743
0.6896
0.7504
0.6557
LRR
0.5960
0.5382
0.5580
0.6703
0.5906
Binoculars
0.8500
0.9453
0.9698
0,9908
0,9390
RADAR
0.8184
0.5152
0.6300
0,5891
0.6382
BiScope
0.7633
0.6800
0.7097
0.8167
0.7642
Fast-DeteciGPTT
0.8404
0.9443
0.9695
0.9914
0.9364
AdaDetectGPT
0.8432
0.9484
0.9644
0.9947
0,9377
Relative
1.7544
7.4163
37.8238
7.9916
38

---

F.3 Computational analysis
In this part, we study the runtime for learning the witness function. From Table S9, the runtime of AdaDetectGPT is around 44 seconds and changes marginally with respect to d. This is because we can use closed-form expression learn witness function. This time is nearly negligible compared with the time required to compute logits, which involves feeding tokens from multiple passages into LLMs. Furthermore, the training time when n increases shown Table S10, and we can see that the runtime for training is typically no more than one minute.
Table $9: Runtime scale with d.
d
8
12
16
20
Runtime
44.48
44.62
44.73
44.92
45.00
Table S10: Runtime (memory in parenthesis) scale with The runtime is measured in seconds and the memory is measured in GB.
100
150
200
250
300
350
Runtime (Memory) 9.28(0.36) 23.45(0.37) 40.19(0.37) 44.25(0.37) 59.57(0.60) 69.56(0.37)
F,4
Sensitivity analysis
Since AdaDetectGPT requires training a witness function, we examine three factors influencing its performance: (1) the size of the training set; (ii) tuning parameters for generating B B-spline basis and (iii) distribution shift between training and test data.
Robust to training data sizes. We evaluate AdaDetectGPT across varying dataset sizes by setting M1 = n2 (100, 200, 300, 400, 500, 600} for both human- and machine-generated texts. Figure $5 demonstrates that Ada clearly outperforms FastDetectGPT when sample size is large. This is expected because a larger sample size leads to a more accurate estimation of w. Notably, even with limited data 1 n2 100, AdaDetectGPT maintains superior accuracy compared to bascline methods, though the performance gap decreases. These results highlight our method's 's effectiveness on learning the witness function.
Insensitivity to tuning parameters. B-spline relies on two critical tuning parameters: (i) the number of basis functions (a_b) and (ii) the maximum polynomial order. Our experiments fix one parameter while varying the other (with n_ base=16 or order=2 as defaults). As shown Figure S6 in Appendix, AdtDetet achieves the highest AUC scores so long n base 2 4. Besides, enlarging base improves the AUC AdaDetectGPT although the improvement becomes marginal when base > 16. Figure S6 also shows that increasing the polynomial order from linear to quadratic visibly improve the performance; while increasing order from quadratic to cubic/quartic has limited gain. Finally, even when the B-spline basis is set to piecewise linear function, our method still outperform all baselines.
Robust against distribution shift. We create training datasets with different distributions from the test data by varying the number of human prompt tokens machine- -enerrttd text. contrast, for the test data, the number of human prompt tokens are fixed. As shown in Figure S7, AdaDetectGPT demonstrates high robustness to the distributional discrepancy between training and test data. achieves the highest AUC across all experimental setup.
39

---

9pc2-x1
opt-2.7b
gpt-neo-2:78
0.8
Lioebooo
0.7
0.6
RastD
0.6
AdsibatectOP
0.6
0.9
0.8
0.7
0.7
0.6
0.6
0.6
0.9
0.9
0.8
0.7
0.7
0.7
0.6
0.5
0.5
100
200
300
400
500
600
100
200
300
400
500
600
1.00
200
300
400
500
600
sample
sample
sample
Figure S5: Classification accuracy versus the sample size for training w. We omit DetectGPT, NPR, and DNA in this experiments as they are time-consuming.
pt2-xxl
opt-2.7b
gpt-neo-2.78
order
OnGer 2.5
Urder
1.0
2.0
2.5
0.8
27
1.0
2.5
3.0
2.0
0.9
0.6
2'
2.5
0.9
writing
0.7
0.6
0.5
baice Ouga)
11 DLbase Dog
base Blogsl
Likellhood
LogRank
DetectGPT RastDetectGPT
AdaDetectGPPin AcsDeetectGPToonden
Entropy
LRR
DNAGPT
Figure S6: The classification accuracy of AdaDetectGPT and baseline methods. AdaDetect- GPT(n_ base) present the AUC when the number of basis in B-spline increases 8. 16, 32, 64 (bottom π-axis); while AdaDetecIPPToorer shows the AUC when the maximum order of basis in B-spline increases from I to (top r-axis). The AUC of baseline methods presented by dash lines.
40

---

gpt2xx
gpt
0.85
0.85
0.85
Litel hood
0.80
0.75
Entropy
0.75
0.70
0.65
0.60
0.60
0.55
0.9
0.8
0.8
0.7
0.6
0.9
0.9
0.8
0.8
0.7
0.7
0.6
0.6
0.5
110
n-prompts (traliinng data)
p-prompts (training data]
n-prompts Braining
Figure S7: The classification accuracy of AdaDetectGPT when the number of human prompts changes. The AUC of baseline methods presented by dash lines.
F5 Detecting open-source models in black-box setting
Table S11: Zero-shot detection accuracy five source models under the black-box setting, I use two surrogate models for sampling and scoring, where the sampling model is GPT-J while scoring model is GPT-Neo.
Source Model
Dataset
Method
GPT-2
OPT-2.7
GPT-Neo
GPT-NeoX
Avg.
FastDetecttGPT
0.6181
0.6495
0.6230
0.6910
0.6813
AdaDetectGPT
0.6920
0.7195
0.7382
0.7338
0.7460
Relaïve
19,3770
T9,963T
30,5609
13.8495
20.2557
SQuAD
FastDetectGPPT
0.8145
0.8166
0.9220
0.7519
0.8188
GdaDetectGPPi
0.8249
0.8308
0.9273
0.7609
0.8300
Relaïive
3.6301
7.7245
6.7968
33.6TT
6.2106
FaPtDetectGPT
0.7662
0.7918
0.7685
0,8022
0,8028
AdaDetectGPT
0.8306
0.8529
0.8555
0.8587
0.8636
Relative
27.5699
29,3365
37.6112
28.5350
30.8124
Writing
FaPtDetectGPT
0.8565
0.8497
0.9215
0.8182
0,8582
AdaDetectGPT
0.8780
0.8737
0,9386
0.8567
0.8849
Relative
14,9666
15,9741
21.7742
21.1856
18.8023
FastDetecttPPT
0.5919
0.6445
0.5718
0.6389
0.6468
AdaDetectGPP
0.6795
0.7238
0.6879
0.7045
0.7261
Relaïive
21.4569
22,2991
27.1129
18.1380
22,4439
XSum
0.8145
0.8166
0.9220
0.7519
0.8188
GdaDetecttPPt
0.8249
0.8308
0.9273
0.7609
0.8300
Relaïve
5.8060
TO.3637
10.2343
78.1057
TI.1574
41

---

G Broader impact and limitation
AdaDetectGPT a computationally and statistically efficient detector for machine-generaute text, thus safeguarding Al systems against fake news, disinformation, and academic plagiarism.
Despite AdaDetectGPT's strong empirical performance in the black-box setting, its theoretical guarantees are mainly established in the white-box setting. Even when restricting to the white-box setting, LLM text generation often involves sampling parameters (e.g.. temperature and top_k). Using different parameter values can cause the sampling distribution to deviate from that the target model aim detect. This mismatch invalidates MCLT in practice. Fortunately, we observe that the shape of our statistic remains similar, but shifts toward a positive mean (see Figure S8), implying that FNR control under MCLT remains valid, although being more conservative.
squad
writing
XSum
0.5
6.4
6.5
0.3-
6.3
0.2
0.1-
0.0
0.0
-2
statistics
statistics
statistics
Figure S8: Histogram of our statistics three datasets. Each panel visualizes the histogram one dataset. The yellow histogram corresponds the case when the sampled texts exactly follow the conditional probability of the source model, while purple histogram corresponds to text drawn with from distribution with different sampling temperatures.
42


Reviews:
[{"review_id": "VapqUWwLys", "reviewer": "Reviewer_cReh", "summary": "This paper presents AdaDetectGPT, a novel approach for detecting LLM-generated text that enhances existing logits-based detection methods by adaptively learning a witness function from training data. The core idea is to transform raw log probabilities through an optimized witness function rather than using them directly, as done in previous methods like DetectGPT and Fast-DetectGPT. The authors derive a lower bound on the true negative rate (TNR) and learn the witness function by maximizing this bound, which involves solving a simple linear system when using B-spline basis functions. The method provides statistical guarantees for all four key classification metrics (TPR, FPR, TNR, FNR) based on the martingale central limit theorem, and includes a principled threshold selection mechanism for controlling the false negative rate. Extensive experiments across multiple datasets (SQuAD, WritingPrompts, XSum) and language models demonstrate substantial improvements over state-of-the-art baselines, with AUC gains of 12.5%-37% in white-box settings and up to 58% in black-box settings, while the approach is extended to handle black-box scenarios by using multiple source LLMs and taking the maximum statistic across them.", "questions": "- How does AdaDetectGPT's performance scale with increasingly sophisticated LLMs and potential adversarial attacks? Could you evaluate on more recent and diverse models (e.g., Qwen2.5, LLaMA3, Claude, Gemini) and discuss robustness against paraphrasing or other evasion techniques commonly used to fool detection systems?\n\n- While the paper claims computational efficiency, could you provide detailed runtime comparisons and memory usage analysis, especially for the witness function learning phase? How does the training time scale with dataset size n and dimension d?\n\n- Why specifically choose B-spline basis functions for the witness function parametrization? Could you provide theoretical or empirical comparison with other basis functions (e.g., polynomial, Fourier, or neural network-based)? Additionally, what principled guidance can you offer for selecting the dimension d of the feature mapping φ, especially given its impact on the TNR bound in Theorem 3?\n\n - Could you provide more rigorous verification or empirical validation of the equal variance condition and stochastic dominance condition mentioned in Theorem 1? These conditions are crucial for the theoretical guarantees, but their practical satisfaction seems under-explored. Please include experimental analysis showing when these conditions hold in real scenarios and how violations might affect performance.", "limitations": "Yes", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 2, "significance": 3, "originality": 3, "strengths_and_weaknesses": "**Strengths:**\n\n- AdaDetectGPT introduces an innovative approach by adaptively learning a witness function from training data to enhance logits-based detectors, rather than relying solely on raw log probabilities. This represents a significant methodological advancement that bridges statistics-based and ML-based detection methods.\n\n- The method achieves substantial improvements over state-of-the-art baselines, with AUC improvements ranging from 12.5% to 37% in white-box settings and up to 58% in black-box settings. These consistent improvements across multiple datasets and language models demonstrate the effectiveness of the approach.\n\n- Unlike existing logits-based detectors that generally lack systematic statistical analysis, AdaDetectGPT provides finite-sample error bounds for all four key classification metrics (TPR, FPR, TNR, FNR), offering theoretical rigor and reliability guarantees for practical deployment.\n\n\n**Weaknesses:**\n\n- A conclusion section would be a valuable addition to the paper.\n\n- The paper relies on the equal variance condition and stochastic dominance condition, while the application of the Markov central limit theorem requires relatively strong regularity conditions. The verification of these conditions in the paper appears to be somewhat insufficient.\n\n- The TNR lower bound in Theorem 1 depends on the choice of α. While the authors claim to have eliminated this dependency through bound optimization, it seems that the issue has essentially been shifted to the selection of the witness function.\n\n- The choice of B-spline basis functions may benefit from additional theoretical justification, and there appears to be limited guidance regarding the selection of dimension d.\n\n- The evaluation could potentially be strengthened by including a more diverse range of target LLMs, such as recent open-source models like Qwen2.5, LLaMA3, and Mistral, as well as proprietary models like Claude and Gemini. The dataset coverage is also somewhat limited, with only 3 datasets included.", "was_revised": true, "final_justification": "This paper is interesting, and the authors have addressed the vast majority of my concerns during the rebuttal phase. The relaxed proportionality condition (Equation 1) with empirical validation (Table A1) and normality tests (Table A2)  strengthen the theoretical foundation by satisfying MCLT regularity conditions, while experiments across 6 LLMs and robustness against evasion techniques substantially enhance empirical validation. The B-spline theoretical justification with error bounds (Equation 2) and principled dimension selection guidelines provide valuable theoretical rigor, and runtime analysis demonstrates the practical efficiency advantages of this computationally feasible approach. However, since the authors did not include the conclusion in the main text, this represents a fairly significant issue, so I am inclined toward a weak accept.", "rebuttal": "We wholeheartedly appreciate your insightful comments and suggestions, which we will carefully incorporate should the paper be accepted. During the rebuttal, we have conducted extensive theoretical and empirical investigations to address all your concerns.\n\n> **Validation of technical assumptions** (Weakness 2 & Question 4)\n\nExcellent comment! Your comment is concerned with the validity of three conditions: (i) the equal variance condition; (ii) the stochastic dominance condition; (iii) the regularity condition for the MCLT to hold.\n\nWe did not elaborate on these assumptions in the main paper, and we appreciate the opportunity to clarify and discuss them in response to your concerns. In summary:\n1. During the rebuttal, we have conducted both theoretical and empirical investigations and found that the equal variance condition can be relaxed to a much weaker proportionality condition (see Equation (1) below), which is likely to hold empirically (see **Table A1** below).\n2. The stochastic dominance condition was introduced to derive an alternative, tighter lower bound than the one presented in Theorem 1. It is not required for the validity of Theorem 1 itself.\n3. We have conducted several normality tests on our proposed statistic. Results suggest that in almost all cases, our statistic passed these normality tests (see **Table A2**), indicating the regularity conditions required for the MCLT are likely met in practical scenarios.\n\nWe next elaborate on these points.\n\nFirst, the equal variance condition imposed in Theorem 1 can be relaxed. Specifically, our theoretical investigations during the rebuttal reveal that it is not necessary for the two variances $\\sigma_{q,L}^2$ and $\\sigma_{p,L}^2$ to be asymptotically equivalent in probability. Rather, it suffices to require their ratio to converge to some positive constant in probability, i.e.,\n$$\n\\frac{\\sigma_{q,L}}{\\sigma_{p,L}} \\stackrel{P}{\\to} K_0. \\quad (1)\n$$\nSince $K_0$ need not be 1, this proportionality condition is considerably weaker than the equal variance assumption and is more likely to hold in practice. Under this relaxed condition, following nearly identical arguments to those in Theorem 1, we can show that TNR is asymptotically lower bounded by:\n$$\n\\min \\\\{1-\\Phi(K_0 z_\\alpha),\\ \\Phi(K_0 z_\\alpha)+\\phi(K_0 z_\\alpha) K_0 T_w^{(2*)}\\\\}.\n$$\n\nThis lower bound differs from the one in Theorem 1 due to the change in assumptions. However, since $\\phi(K_0 z_\\alpha)$ depends solely on $\\alpha$ (not on the witness function $w$), our main conclusion — maximizing the lower bound is equivalent to maximizing $T_w^{(2*)}$ — remains valid. Thus, the proposed methodology remains theoretically sound.\n\nEmpirical results further support the validity of this assumption: the sample mean of the ratio remains nearly constant as a function of $L$, while its variance (in parentheses) approaches zero as $L\\to \\infty$ across all three datasets (see **Table A1**), suggesting that this condition is practical.\n\nSecond, for the stochastic dominance condition, we clarify that its primary purpose was to apply Lemma S3 in deriving an alternative tighter lower bound (detailed in Remark 1 after the proof of Theorem 1 in the supplementary material). This condition is therefore not essential for the validity of Theorem 1 and can be safely omitted without affecting our main conclusion.\n\nThird, we applied **2 standard hypothesis tests** — the Kolmogorov–Smirnov (KS) test and the Shapiro–Wilk (SW) test — to evaluate whether our proposed statistic follows a normal distribution. These tests were conducted across **3 benchmark datasets** and **2 LLM source distributions**, yielding a total of **12 p-values**. As shown in **Table A2**, almost all p-values exceed 0.1 (most by a large margin), indicating that our test statistic passes normality tests in most cases, providing strong empirical support for the validity of MCLT regularity conditions.\n\n**Table A1: Sample mean and variance (in parentheses) of the ratio evaluated on 3 datasets as $L$ increases**\nL|100|150|200|250|300|350\n-|-|-|-|-|-|-\nXSum|1.09(0.12)|1.07(0.09)|1.06(0.08)|1.04(0.07)|1.01(0.06)|0.99(0.05)\nSQuAD|1.03(0.10)|1.02(0.07)|1.02(0.06)|1.02(0.05)|1.01(0.05)|1.03(0.04)\nWriting|1.10(0.06)|1.09(0.05)|1.09(0.04)|1.08(0.03)|1.07(0.03)|1.05(0.03)\n\n**Table A2: $p$-values of KS and SW tests across 3 datasets and 2 source LLMs**\n| |Test|Xsum|SQuAD|Writing\n|-|-|-|-|-\n|GPT-Neo|KS|0.72|0.54|0.18\n|GPT-Neo|SW|0.50|0.65|0.89\n|GPT-2|KS|0.10|0.52|0.28\n|GPT-2|SW|0.37|0.026|0.14\n\n> **Experiments on more datasets and LLM models** (Weakness 5 & Question 1)\n\nFollowing your suggestion, we have conducted experiments during the rebuttal to compare AdaDetectGPT against existing detectors across **6 recent LLMs** and **5 datasets**. Due to space limit, refer to our **Table D1 & Table D2** in **Response to Reviewer 6vsq** for details.\n\n> **Experiments against evasion techniques** (Question 1)\n\nFollowing your suggestion, we have conducted additional experiments to evaluate the robustness of AdaDetectGPT against **two** evasion techniques:  (i) paraphrasing and  (ii) decoherence across 3 datasets and 3 target LLMs, resulting in a total of **18** settings. Refer to **Table B2** in our **Response to potential concern 6 to Reviewer aTfn** for detailed results.\n\n> **B-spline basis functions** (Weakness 4 & Question 3)\n\nWe opted to learn the witness function via a B-spline basis due to the straightforward nature of the optimization: finding the optimal witness function reduces to solving a system of linear equations.\n\nTheoretically, when the optimal witness function is $\\beta$-smooth (with larger $\\beta$ indicating greater smoothness), we can derive the following supremum error bound for our estimated witness function $\\hat{w}$, following arguments similar to those used in the analysis of B-spline estimators (e.g., Theorem 2.1 of Chen & Christensen, 2015):\n$$\\sup_{z}|\\hat{w}(z)-w^*(z)|=O_p\\left(\\sqrt{\\frac{d\\log n}{n}}\\right)+O(d^{-\\beta}).\\tag{2}\n$$\n\nUsing similar arguments to the proof of our Theorem 3,  we can show that the difference in TNR between the oracle $w^*$ and the estimated $\\hat{w}$ is also of order (2). \nBy setting $d=\\Theta\\Big(\\big(n/\\log n\\big)^{1/(2\\beta+1)}\\Big),$ this yields the optimal rate of convergence: $O_p\\Big(\\big(n/ \\log n\\big)^{-\\beta/(2\\beta+1)}\\Big).$\n\nIn comparison:\n- *Local polynomial partition series* estimators can achieve a similar uniform convergence rate (see Cattaneo & Farrell, 2013), and therefore yield a comparable rate in TNR difference.\n- *Neural networks* can also attain a similar convergence rate, but in terms of the $\\ell_2$ norm rather than the uniform $\\ell_\\infty$ norm. As a result, the proof technique used in Theorem 3 does not directly apply. Instead, under the margin condition (Assumption 1), the TNR difference converges more slowly at a rate of $O_p\\Big(\\big(n/\\log n\\big)^{-\\beta / (3\\beta+1.5)}\\Big)$. In addition, neural networks are known to learn certain non-smooth functions at near-optimal rates (see Schmidt-Hieber, 2020).\n\nRegarding the choice of dimension $d$, in line 292, we note that numerical experiments suggest: \"AdaDetectGPT is generally robust to … the number of B-spline feature mappings.\" However, we agree that $d$ can be chosen in a more principled way:\n- If the smoothness parameter $\\beta$ is known, then one can set  $d=\\Theta\\big(\\left(n/\\log n\\right)^{1/(2\\beta+1)}\\big)$ to achieve the optimal rate in Equation (2), which in turn maximizes the expected TNR of AdaDetectGPT.\n- If $\\beta$ is unknown, $d$ can be chosen in a data-driven way, for instance via Lepski's method (see Lepski & Spokoiny, 1997).\n\n> **Computational efficiency** (Question 2)\n\nFrom **Table A3**, the runtime of AdaDetectGPT is around 44 seconds and changes marginally with respect to $d$. This is because we can use a closed-form expression to learn a witness function. This time is nearly negligible compared with the time required to compute logits, which involves feeding tokens from multiple passages into LLMs. Furthermore, the training time when $n$ increases is shown in **Table A4**. It shows AdaDetectGPT saves more runtime and memory than ImBD.\n\n**Table A3: Runtime scale with $d$**\nd|4|8|12|16|20\n-|-|-|-|-|-\nRuntime|44.48|44.62|44.73|44.92|45.00\n\n**Table A4: Runtime (memory in parenthesis) scale with $n$ comparing with ImBD (SOTA)**\nN|100|150|200|250|300|350|\n-|-|-|-|-|-|-\nImBD|45.65(9.56)|68.20(9.57)|93.00(9.57)|116.08(9.56)|136.53(9.56)|158.15(9.58)|\nAdaDetectGPT|9.28(0.36)|23.45(0.37)|40.19(0.37)|44.25(0.37)|59.57(0.60)|69.56(0.37)|\n\n> **Missing conclusion** (Weakness 1)  \n\nDuring the rebuttal, we have drafted a conclusion that we plan to include using the extra page should our paper be accepted. Refer to **Missing conclusion (Minor)** in **Response to Reviewer UhoV** for details.\n\n> **TNR lower bound** (Weakness 3)  \n\nWe clarify the rationale behind the derivation of our lower bound below. Recall that our goal is to learn a witness function $w$ that maximizes the TNR of the resulting detector for a fixed FNR level $\\alpha$. However, the TNR is a very complicated function of $\\alpha$ and $w$, which makes the learned witness function that maximizes the TNR $\\alpha$-dependent. Specifically, it maximizes the TNR at a particular FNR level but does not guarantee optimality at other FNR levels.\n\nTo address this, we derive a lower bound on the TNR and propose learning $w$ by maximizing this lower bound. As you pointed out, this lower bound also involves $\\alpha$. The key advantage is that the lower bound separates the effects of $\\alpha$ and $w$: the witness function $w$ affects the lower bound only through $T_w^{(2)*}$, which is independent of $\\alpha$. Consequently, the witness function that maximizes this lower bound simultaneously maximizes the bound across all FNR levels.\n\nThus,  the problem reduces to selecting a single witness function that maximizes $\\alpha$-independent $T_w^{(2)*}$.\n\nWe hope this clarifies your confusion."}, {"review_id": "BXkwMx99J2", "reviewer": "Reviewer_aTfn", "summary": "This paper introduces a classifier based on a witness function from training data to enhance the performance of logits-based machine-text detectors. Experiments are conducted both in white-box (access to LLM logit) and black-box settings (different models at train and test time), across several different benchmarks. The approach consistently improves over the strongest baseline included (Fast-DetectGPT).", "questions": "* How robust is the proposed approach expected to be to paraphrasing attacks?\n* Since the approach must be trained, how sensitive it is to potential distribution shifts from training to test time?\n* Please provide a discussion of the limitations of the proposed approach.", "limitations": "There does appear to be any substantive discussion of limitations.", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 2, "originality": 2, "strengths_and_weaknesses": "Strengths\n\n* This paper tackles an important problem (machine-text detection).\n* The proposed approach appears to be quite principled and theoretical results are presented to bolster the empirical claims.\n* The paper considers a challenging setting where human writing is mixed with machine writing (“prompting an LLM with the first 120 tokens of the human-written text and requiring it to complete the text with up to 200 tokens.”).\n\nPotential concerns\n* Learning the witness function requires training data. How is performance impacted by distribution shifts from the training to test conditions (e.g., text from a different genre or language at test time)? \n* While a number of baselines are considered, some notable methods are not, including Binoculars (https://arxiv.org/abs/2401.12070).  \n* There is no conclusion and limited discussion of the results. In particular, there is no discussion of limitations of the proposed approach.\n* The paper focuses first on a “white-box setting where the source model we have is the same as the target model we wish to detect” -- is this a realistic setting? Given the number of LLMs and the potential for adversaries to fine-tune their own LLMs, what realistic applications of machine-text detection does this work address?\n* The experiments in Table 2 address black-box setting, which partially addresses the above concern. However, is it possible that the choice of evaluation data (standard benchmark tasks) impacts the results? Specifically, could data contamination influence the performance of the proposed approach?\n* The paper does not address robustness to adversarial attacks, such as paraphrasing attacks.\n* While three different datasets are considered in the experiments, I would have liked to see more diversity to help bolster the empirical claims. For example, although it is good to focus on challenging mixed human-machine text settings, it would be good to confirm the results are consistent in settings of purely machine/human text as well.", "was_revised": true, "final_justification": "The authors provide a strong rebuttal which addresses several of my main concerns (e.g., the need to know which LLM is being detected). As a result, I have increased my score.", "rebuttal": "We wholeheartedly appreciate your insightful comments, which we will carefully incorporate should the paper be accepted. **In summary**, during the rebuttal, we have conducted extensive empirical studies to evaluate the proposed AdaDetectGPT under a wide range of settings to address your concerns, including: \n\n- (i) distributional shifts; \n- (ii) adversarial attacks; \n- (iii) comparisons with additional baseline methods; and \n- (iv) evaluations on more diverse datasets. \n\nResults detailed below demonstrate that AdaDetectGPT consistently delivers the most competitive performance across all settings. \n\n> **Distributional shifts** (Potential concern 1)\n\nAdaDetectGPT is robust to distributional shifts; see Figure S4 in the Appendix. This figure reports the AUC of AdaDetectGPT when the distribution of the test data differs from that of the training data used to learn the witness function. Specifically, during training, we vary the number of human prompt tokens in the LLM-generated text, whereas in the test data, the number of human prompt tokens is fixed. It can be seen that the AUC hardly changes as we vary the number of human prompt tokens in the training data. Additionally, our method achieves the highest AUC in all cases.\n\n> **Additional baselines** (Potential concern 2). \n\nWe have compared against **5** newly added baseline methods, including **Binoculars** you pointed out, as well as four other recent detectors **RADAR**, **ImBD**, **Text Fluoroscopy** and **Biscope**. These methods were evaluated using **3 recent LLMs** (Qwen2.5, LLama3, Mistral) across **5 benchmark datasets** (including our newly added Yelp, Essay and Xsum, SQuAD, WritingPrompts). Refer to **Table D1** in our **Response to Reviewer 6vsq** for the detailed results. In particular, our AdaDetectGPT consistently outperforms **Binoculars** in most scenarios and the improvement can reach up to 60% (see the table below where we average the AUC across the LLMs).\n\n**Table B1. AUC scores of Binoculars and AdaDetectGPT and the relative improvement. \"Relative\" reports the percentage improvement of AdaDetectGPT over Binoculars.**\n| Data | XSum | SQuAD | Writing | Yelp | Essay |\n| - | - | - | - | - |  - |\n| Binoculars | 0.7687 | 0.7631 | 0.8621 | 0.8185 | 0.8760 |\n| AdaDetectGPT | 0.8896 | 0.8149 | 0.9044 | 0.9281 | 0.9264 |\n| Relative | 52.28% | 21.90% | 30.67% | 60.37% | 40.61% |\n\n> **Adversarial attacks** (Potential concern 6)\n\nWe have conducted additional experiments to evaluate the robustness of our proposed AdaDetectGPT against **2** adversarial attacks: (i) paraphrasing, where an LLM is instructed to rephrase human-written text, and (ii) decoherence, where the coherence LLM-generated text is intentionally reduced to avoid detection. These experiments were carried out across **3** datasets and **3** target LLMs, resulting in a total of **18** settings. Both adversarial attacks were implemented following Bao, et al., ICLR2024. \n\n**Table B2. Detection of LLM texts under attack.**\n| | | paraphrasing | | | |decoherence | | |\n| - | - | - | - | - | - | - | - | - |\n| | Xsum | Writing | PubMed | Avg. | Xsum | Writing | PubMed | Avg. |\n| FastDetectGPT(GPT-J/GPT-2) | 0.9178 | **0.9137** | 0.7944 | 0.8753 | 0.7884 | 0.9595 | 0.7870 | 0.8449 |\n| AdaDetectGPT(GPT-J/GPT-2) | **0.9225** | 0.9121 | **0.8029** | **0.8792** | **0.8765** | **0.9597** | **0.8284** | **0.8882** |\n| FastDetectGPT(GPT-J/Neo-2.7) | 0.9602 | **0.9185** | 0.7310 | 0.8699 | 0.8579 | 0.9701 | 0.7609 | 0.8630 |\n| AdaDetectGPT(GPT-J/Neo-2.7) | **0.9623** | 0.9181 | **0.7587** | **0.8797** | **0.9230** | **0.9704** | **0.8124** | **0.9019** |\n| FastDetectGPT(GPT-J/GPT-J) | 0.9537 | **0.9458** | 0.7041 | 0.8679 | 0.8836 | **0.9869** | 0.7550 | 0.8752 |\n| AdaDetectGPT(GPT-J/GPT-J) | **0.9587** | 0.9449 | **0.7308** | **0.8781** | **0.9336** | 0.9864 | **0.8008** | **0.9070** |\n\nResults are reported in the table above. It can be seen that As shown, AdaDetectGPT consistently achieves higher AUCs than Fast-DetectGPT in most of the 18 scenarios. And the improvement reaches up to 10\\% for paraphrasing and up to 85\\% for decoherence. These results suggest that AdaDetectGPT attains more robust performance against adversarial attacks.\n\n> **More diverse datasets** (Potential concern 7)\n\nWe have conducted two analyses to address your comment. First, we have included two additional datasets -- **Yelp** and **Essay** -- in addition to XSum, SQuAD, WritingPrompts and found AdaDetectGPT remains the most competitive detector on both datasets. Refer to **Table D1 and Table D2** in our **Response to Reviewer 6vsq** for the detailed results. These two datasets have been employed in prior works as well (Mao, et al., ICLR2024; Verma, et al., NAACL2024). \n\nSecond, our black-box settings use purely human/machine text, where the machine-generated text consists solely of outputs produced by LLMs. As can be seen from **Table D2**  in our **Response to Reviewer 6vsq**, AdaDetectGPT achieves the most competitive performance among state-of-the-art detectors. \n\n> **Missing conclusion** (Potential concern 3). \n\nDue to the page limit, we did not include a conclusion section in the main paper. During the rebuttal, we have drafted a conclusion that we plan to include using the extra page should our paper be accepted. The conclusion summarizes our proposed procedure and discusses the data contamination issue you highlighted (see our next response). Refer to **Missing conclusion (Minor)** in our **Response to Reviewer UhoV** for details.\n\n> **Realistic applications & data contamination** (Potential concerns 4 & 5). \n\nYour comment raises three important questions: (i) the realism of white-box settings; (ii) the potential issue of data contamination; (iii) the target application considered in this work. We address each of these points in detail below.\n\n- *Realism of white-box settings*.\n\nFirst, white-box settings are particularly relevant in scenarios where the goal is to detect outputs from open-source LLMs such as Qwen, LLaMA3, and Mistral. Note that we have conducted experiments on these models and found AdaDetectGPT continues to perform well; see **Table D1** in our **Response to Reviewer 6vsq** for detailed results.  \n\nSecond, we clarify that while the white-box setting is used to motivate and develop our methodology, AdaDetectGPT is also applicable in black-box settings. As you pointed out, our main paper already includes some black-box experiments, which we are glad to hear have partially addressed your concern. To further demonstrate AdaDetectGPT's usefulness, we have conducted additional black-box experiments during the rebuttal on other widely-used closed-source LLMs Claude and Gemini. AdaDetectGPT again attains the most competitive performance -- see our **Table D2** in **Response to Reviewer 6vsq**.\n\n- *Data contamination*. \n\nWe fully agree that data contamination is a critical issue in evaluating LLM-related tasks. In particular, when evaluation data is contained in the training dataset, it can lead to overly optimistic estimates of the proposed algorithm's performance. We have carefully reviewed our evaluation protocol and did not find any such contamination. \n\nIn our setup, training data is used for learning the witness function. As mentioned in Section B.1 of the Appendix, we employ cross-validation to separate training and testing datasets. For instance, in our main paper, we use three benchmark datasets: XSum, SQuAD, and WritingPrompts. When testing on one dataset (e.g., XSum), the witness function is trained using the other two datasets (e.g., SQuAD and WritingPrompts). Notice that these datasets are semantically and topically different -- XSum provides news summaries, SQuAD involves Wikipedia-based question answering, and WritingPrompts consists of creative human-written stories. This further reduces any risk of data leakage between training and testing.\n\n- *Target application*.\n\nThis work focuses on determining whether a piece of text was generated by a user-specified LLM -- either open-source (white-box) or closed-source (black-box). Your comment highlights two practical challenges.\n\nFirst, given the vast and growing number of LLMs, it is impractical to detect outputs from all possible models. Therefore, we focus on a set of widely-used and popular LLMs. In fact, following the submission of our paper, we have developed a private website hosting our detector. Due to NeurIPS policy, we are unable to release its link at this stage. However, on the website, users can select from a list of supported target LLMs to check whether a given text was generated by any of them (including a “union” option to check if it came from any of the listed models). We plan to regularly update the set of supported models to reflect the evolving popularity of LLMs -- for instance, by removing outdated ones and incorporating new, widely adopted models.\n\nSecond, you raise the important point that adversaries might fine-tune LLMs specifically to fool detectors. We acknowledge this is a challenging and largely open problem. Nonetheless, as we have discussed in our Response 3, our method can still be competitive in certain adversarial scenarios (e.g., paraphrasing and decoherence).\n\n\n---\n\nWe hope our clarifications and newly-added experiments address your concerns. Let us know if you have any follow-up questions."}, {"review_id": "V3ql1UxJBF", "reviewer": "Reviewer_UhoV", "summary": "The paper targets the detection of machine-generated texts. It proposes AdaDetectGPT, where a witness function is adaptively learned from training data to enhance the performance of logits-based detectors. In the theoretical part, statistical guarantees on its true positive rate, false positive rate, true negative rate, and false negative rate are provided. In the empirical part, various source models and datasets are considered, and decent performance improvement is observed.", "questions": "See above", "limitations": "yes", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 2, "originality": 3, "strengths_and_weaknesses": "# Strengths\n- The paper is well written, and the theoretical analyses are thorough.\n- The idea of learning the witness function is reasonable and empirically effective. \n- The empirical studies are satisfactory. \n\n# Weaknesses\n- The theoretical part is a little dense. It may be better to provide a more intuitive discussion to make the paper easier to read. For example, before introducing the witness function, provide an explanation about its motivation and basic concept. \n- Can the authors provide more results on more advanced models like DeepSeek-R1 and GPT-4.1, using more realistic data samples beyond XSum, Writing, and PubMed?\n- Considering that the relative performance improvement is not too significant (e.g, 10-20%), I wonder how the computational efficiency of AdaDetectGPT compares to Fast-DetectGPT. \n- There is a lack of enough ablation studies of the behaviour of the proposed method. \n- Minor: The paper does not contain a conclusion section in the main text.", "was_revised": true, "final_justification": "More intuitive discussion and more results are added during the rebuttal, which address most of my concerns.", "rebuttal": "We sincerely thank you for your thoughtful feedback, which we will thoroughly integrate once the paper is accepted. Below, we provide comprehensive discussions and substantial empirical analyses to address all your comments.\n\n> Intuitive discussion about the witness function (Weakness 1) \n\nWe provide an analytical example, beginning on line 174, which illustrates how classifiers based on token-wise sums of logits may suffer from a loss of power and how this loss of power can be overcome by transforming the logits using a function depending on the distribution of the machine and human generated text. In the paper we have borrowed the term \"witness function\" from the literature on integral probability metrics, where one constructs a distance on the space of distributions defined on some set $\\mathcal{X}$ by choosing a class of functions $\\mathcal{F}$ on $\\mathcal{X}$ and defining the distance as\n\n$$D _{\\mathcal{F}} (\\mathbb{P}, \\mathbb{Q}) = \\sup _{f \\in \\mathcal{F}} |\\mathbb{E} _{X \\sim \\mathbb{P}} f(X) - \\mathbb{E} _{Y \\sim \\mathbb{Q}} f(Y)|. \\tag{1}$$ \n\nFor any two distributions $\\mathbb{P},\\mathbb{Q}$ on $\\mathcal{X}$, the function at which the right hand side of equation (1) attains its maximum is known as the \"witness function\" as it \"bears witness to\" the difference between the two distributions. Returning to AdaDetectGPT, we propose to learn our witness function $w(\\bullet)$ by optimizing a lower bound on the true negative rate of the classifier (see Theorem 1) defined in equation (4) over a particular function class. The numerator of this lower bound has the form  \n\n$$\\sum _t [\\mathbb{E} _{X _{<t}\\sim p, \\widetilde{X} _t \\sim q_t} w(\\log q _t(\\widetilde{X} _t|X _{<t}))-\\mathbb{E} _{X _{<t}\\sim p, \\widetilde{X} _t \\sim p _t} w(\\log q _t(\\widetilde{X} _t|X _{<t}))],$$\n\nwhere each summand can be associated with the term on the right hand side of equation (1) evaluated at a particular $f(\\bullet)$, if the expectations were replaced with conditional expectations. For this reason, we refer to the function appearing in the AdaDetectGPT classifier as a witness function. In the manuscript we briefly mention the connection to integral probability metrics on line 222, however we would be happy to provide a fuller discussion if needed. \n\n> Advanced models and more datasets (Weakness 2)\n\nFollowing your suggestions, we have considered more advanced models and datasets. Specifically, we added **six recent LLMs**, including three open-sourced LLMs (Qwen2.5, LLaMA3, and Mistral) and three closed-source models (GPT-4o, Claude and Gemini), across **five** benchmark datasets (including our newly added Yelp, Essay, XSum, SQuAD, and Writing). This yields a total of **30 new scenarios**. As can be seen from **Table D1** and **Table D2** in our **Response to Reviewer 6vsq**, the proposed AdaDetectGPT generally returns the highest AUC score, confirming the effectiveness of our proposal.\n\n> Improvement and Runtime (Weakness 3)\n\nIn terms of improvement, we would like to clarify that AdaDetectGPT can improve upon FastDetectGPT by 25%-36% in the Writing dataset, as can be from Table 1 in the submitted paper. Additionally, during the rebuttal period, we found that AdaDetectGPT improves upon FastDetectGPT by over 60% -- 80% for detecting text generated by GPT-4o, Gemini-2.5; Claude-3.5 (see **Table D2** in our **Response to Reviewer 6vsq**), which is quite significant. \n\nAdditionally, AdaDetectGPT is computationally efficient, as the average time for AdaDetectGPT to analyze each passage is around half a second—efficient enough to handle most GPT detection cases. Finally, we agree that AdaDetectGPT involves a witness function learning procedure that is not needed for FastDetectGPT. However, since we derived a closed-form for the witness function, the training procedure can be completed in one minute, as can be seen from **Table A3** and **Table A4** in our **Response to Reviewer cReh**.\n\n> Ablation study (Weakness 4)\n\nOur approach consists of two main components: (i) deriving a lower bound on the TNR to serve as the objective for adaptively learning the detector, and (ii) parameterizing the witness function using a linear function approximation, which reduces learning to solving a system of linear equations.\n\nIn response to your concern, we conducted an ablation study to assess the impact of the second component. Specifically, instead of using a linear model, we fine-tuned the scoring model as suggested by Reviewer 6vsq. The resulting variant, referred to as AdaDetectGPT*, is compared with the original AdaDetectGPT in **Table C1** below.\n\nOverall, AdaDetectGPT* demonstrates improved performance over AdaDetectGPT. However, this comes at a significant computational cost: while AdaDetectGPT completes training in under one minute with a 0.6Gb GPU memory requirement (see **Table A3** and **Table A4** in our **Response to Reviewer cReh**), AdaDetectGPT* requires substantially more time and resources. Typically, the training time of AdaDetectGPT* ranges from five to eight minutes, and the required GPU memory ranges from 3–5Gb. Therefore, AdaDetectGPT is much more computationally attractive. Notice that AdaDetectGPT already outperforms all baseline methods in most scenarios. Thus, considering the trade-off between training cost and detection performance, the original AdaDetectGPT might offer a more practical solution. \n\n**Table C1. Ablation studies on the effect of the witness function (FastDetectGPT vs. AdaDetectGPT) and the learning method (AdaDetectGPT vs. AdaDetectGPT\\* )**\n| Data | Method | Qwen2.5 | Mistral | LLaMA3 | Avg. | \n| - | - | - | - | - | - |\n| XSum | FastDetectGPT | 0.7523 | 0.8922 | 0.9734 | 0.8726 |\n| XSum | AdaDetectGPT* | 0.7710 | 0.9722 | 0.9975 | 0.9135 |\n| XSum | AdaDetectGPT | 0.7963 | 0.8944 | 0.9782 | 0.8896 |\n| Writing | FastDetectGPT | 0.8513 | 0.8151 | 0.9879 | 0.8848 |\n| Writing | AdaDetectGPT* | 0.8804 | 0.9786 | 0.9996 | 0.9529 |\n| Writing | AdaDetectGPT | 0.8965 | 0.8275 | 0.9893 | 0.9044 |\n| Essay | FastDetectGPT | 0.8347 | 0.9052 | 0.9901 | 0.9100 |\n| Essay | AdaDetectGPT* | 0.8484 | 0.9964 | 0.9989 | 0.9479 |\n| Essay | AdaDetectGPT | 0.8799 | 0.9069 | 0.9924 | 0.9264 |\n| SQuAD |FastDetectGPT | 0.5016 | 0.8812 | 0.9488 | 0.7772 |\n| SQuAD |AdaDetectGPT* | 0.5191 | 0.9791 | 0.9844 | 0.8275 |\n| SQuAD |AdaDetectGPT | 0.6044 | 0.8851 | 0.9553 | 0.8149 |\n| Yelp | FastDetectGPT | 0.8465 | 0.8902 | 0.9882 | 0.9083 |\n| Yelp | AdaDetectGPT* | 0.8604 | 0.9666 | 0.9999 | 0.9423 |\n| Yelp | AdaDetectGPT | 0.8915 | 0.9026 | 0.9900 | 0.9281 |\n\n> Missing conclusion (Minor)\n\nDue to the page limit, we did not include a conclusion section in the main paper. During the rebuttal, we have drafted a conclusion (see below) that we plan to include using the extra page should our paper be accepted:\n\nWe propose AdaDetectGPT, an adaptive LLM detector that learns a witness function $w$ to boost the performance of existing logits-based detectors. A natural approach to learning $w$ is to maximize the TNR of the resulting detector for a fixed FNR level $\\alpha$. However, the TNR is a highly complicated function of $\\alpha$ and $w$, which makes the learned witness function inherently $\\alpha$-dependent -- that is, it maximizes the TNR at a particular FNR level but does not guarantee optimality at other FNR levels. To address this, we derive a lower bound on the TNR and propose to learn $w$ by maximizing this lower bound. Notice that the lower bound separates the effects of $\\alpha$ and $w$: the witness function $w$ affects the lower bound only through $T_w^{(2)*}$, which is independent of $\\alpha$. Consequently, the witness function that maximizes this lower bound simultaneously maximizes it across all FNR levels. \n\nIn our implementation, we opted to learn the witness function via a B-spline basis  due to the straightforward nature of the optimization (finding the optimal witness function boils down to solving a system of linear equations) and its  favorable theoretical properties (the estimation error can be shown to attain Stone's optimal convergence rate, Stone, 1982). The number of $B$-spline basis functions can be selected in a data driven way for instance via Lepski's method; see Lepski \\& Spokoiny (1997).\n\n----\n\nWe hope our clarifications and newly-added experiments address your concerns. Let us know if you have any follow-up questions."}, {"review_id": "MEfeD0n9UI", "reviewer": "Reviewer_6vsq", "summary": "Most current logits-based detectors use statistics based on the log-probabilities of the observed text, computed using the distribution of a specific source LLM. However, relying only on log-probability signals can be sub-optimal. To address this, the authors propose AdaDetectGPT, a new classifier that adaptively learns a witness function from training data to improve detection performance. The method also provides statistical guarantees on performance metrics such as true positive rate, false positive rate, and others.", "questions": "Essentially, the proposed method aims to learn a witness function so that the scoring model can better capture the differences between AI- and human-written text.\n\nHowever, this raises an important question: what if we directly fine-tune the scoring model using the same training dataset, without learning a separate witness function? This approach is exactly what ImBD (Imitate Before Detect) does—fine-tuning the detection model directly on machine- and human-written samples.\n\nA comparison between AdaDetectGPT and this more straightforward fine-tuning baseline would be helpful, as it could clarify the actual benefits of introducing a learned witness function.\n\nRef: [AAAI 2025 oral] Imitate Before Detect: Aligning Machine Stylistic Preference for Machine-Revised Text Detection", "limitations": "Yes", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "**Strengths**\n\nThe paper is well written and easy to follow.\n\nThe problem addressed is important. Learning a witness function from training data and adaptively selecting thresholds in zero-shot settings is highly relevant for practical applications.\n\nThe introduction and related work sections are clearly organized and provide a good overview of prior work in this area. However, I suggest the authors reduce the discussion on watermarking, since this paper focuses on passive detection, and watermarking belongs to a different category (active detection).\n\n**Weaknesses**\n\n1. According to the Fast-DetectGPT homepage, the best scoring models currently are falcon-7b and falcon-7b-instruct. Therefore, I suggest the authors re-run the comparisons between AdaDetectGPT and Fast-DetectGPT using these updated scoring models.\n2. The main limitation of the paper is that the experimental evaluation is too limited. The models used in the experiments (GPT-2, OPT-2.7B, GPT-Neo) are quite outdated. To show practical usefulness, the authors should include more recent models.\n- For open-source models, consider adding LLaMA-3, Qwen, etc.\n- For black-box settings, the paper only evaluates GPT-3.5-turbo and GPT-4. However, these models are being phased out. The authors should consider adding newer systems like Claude, GPT-4o, or Gemini.\n3. The paper does not evaluate under attack settings, which is important for robustness. This was also emphasized in the original Fast-DetectGPT paper. Including evaluation under adversarial or paraphrased inputs would strengthen the results.\n4. Since AdaDetectGPT requires training, it should be compared primarily with other training-based methods. However, many of the baselines in the paper are zero-shot methods.\nI recommend the authors include stronger and more recent baselines, such as:\n- RADAR (NeurIPS 2023),\n- ImBD (AAAI 2025),\n- Text Fluoroscopy (EMNLP 2024),\n- Biscope (NeurIPS 2024),\n- Optional) GPTZero could also be included if resources allow, but the above four are more important.\n\n5. The paper is missing a conclusion section, which would help summarize the contributions and findings clearly.\n\n---\n\nIf the authors can address the points above—especially by improving the experimental setup—I would be happy to increase my score. Currently, the paper focuses mainly on theory and method design, but the limited evaluation makes it hard to fully assess the effectiveness of the proposed approach in practical scenarios.", "was_revised": true, "final_justification": "I am accepting the paper mainly because of its promising results, the additional fair comparisons, and the experiments with models such as GPT‑4o, as well as the authors’ effort in training a variant of AdaDetectGPT. However, I did not carefully review the formulas and proofs in the paper, so I cannot guarantee their correctness, and therefore my confidence is only 3.", "rebuttal": "We wholeheartedly appreciate your insightful comments, which we will carefully incorporate should the paper be accepted. During the rebuttal, we conducted extensive empirical studies to further evaluate AdaDetectGPT under various settings, including:\n\n1. the use of falcon-7b and falcon-7b-instruct as scoring models;\n2. the detection of more recent LLMs;\n3. adversarial attacks;\n4. comparison against additional baseline methods.\n\nResults detailed below demonstrate that AdaDetectGPT consistently delivers the **most competitive performance** across all settings:\n\n> **Scoring models** (Weakness 1)\n\nFollowing your suggestion, we have employed falcon-7b as scoring models to compare AdaDetectGPT against FastDetectGPT. The corresponding results have been reported in **Table D2**. It can be seen that AdaDetectGPT continues to achieve the largest AUC in most cases. \n\n> **Adversarial attacks** (Weakness 3)\n\nWe have conducted additional experiments to evaluate the robustness of our proposed AdaDetectGPT against **2 adversarial attacks**:\n- *paraphrasing*, where an LLM is instructed to rephrase human-written text, and\n- *decoherence*, where the coherence of LLM-generated text is intentionally reduced to avoid detection.\n\nThese experiments were carried out across **3 datasets** and **3 target LLMs**, resulting in a total of **18** settings. Refer to **Table B2** in our Response to potential concern 6 to Reviewer aTfn for the detailed results.\n\n> **Additional baselines and more recent LLMs** (Weaknesses 2, 4 & Question)\n\nWe have compared against **5** newly added baseline methods, including **RADAR**, **ImBD**, **Text Fluoroscopy**, **Biscope** (as you pointed out), as well as another recent detector **Binoculars**. These methods were evaluated using **3 recent open-sourced LLMs**, including  Qwen2.5, LLaMA3 and Mistral, across **5 benchmark datasets** (including our newly added Yelp, Essay and XSum, SQuAD, WritingPrompts), yielding a total of **15 scenarios**. We remark that Yelp and Essay are two common benchmark datasets employed in prior works as well (Zhang et al, 2015; Verma et al., NAACL 2024). Additionally, we also used another **3 closed-source models** GPT-4o, Claude and Gemini for comparison. \n\nThe results are reported in **Tables D1-D2**. For open-source models (i.e., Qwen2.5, LLaMA3 and Mistral), AdaDetectGPT consistently achieves the highest AUC across nearly all scenarios, outperforming **5** newly added baselines such as **Binoculars**, **RADAR**, **ImBD**, **Text Fluoroscopy**, **Biscope**, as well as Fast-DetectGPT, Likelihood, Entropy, and LogRank considered in our main paper. It can be seen that the improvement over Fast-DetectGPT and Binoculars can reach up to 10% and 30%, respectively.\n\nFor proprietary models (i.e., Claude, Gemini and GPT-4o), AdaDetectGPT again remains the most competitive across almost all scenarios, and the improvement over Fast-DetectGPT can reach up to 60% - 80%.\n  \n**Table D1: Performance on three recent open-source models, i.e., Qwen2.5, LLaMA3, and Mistral. The “Relative” rows report the percentage improvement of AdaDetectGPT over Fast-DetectGPT.**\n|Data||XSum||||Writing||||Essay|||\n|-|-|-|-|-|-|-|-|-|-|-|-|-|\n|Method|Qwen2.5|Mistral|LLaMA3|Avg.|Qwen2.5|Mistral|LLaMA3|Avg.|Qwen2.5|Mistral|LLaMA3|Avg.|\n|Likelihood|0.6175|0.7409|0.8236|0.7273|0.7041|0.8643|0.8929|0.8204|0.6755|0.8667|0.9115|0.8179|\n|Entropy|0.5403|0.5290|0.5545|0.5413|0.5043|0.5420|0.5732|0.5398|0.5073|0.6052|0.5626|0.5584|\n|LogRank|0.6325|0.7270|0.8634|0.7410|0.7150|0.8446|0.9122|0.8239|0.6958|0.8467|0.9351|0.8258|\n|LRR|0.6368|0.6023|0.8946|0.7113|0.7180|0.6654|0.9161|0.7665|0.7248|0.6938|0.0000|0.4729|\n|NPR|0.7515|0.7823|0.7872|0.7737|0.8247|**0.8948**|0.7897|0.8364|0.7165|0.8741|0.0000|0.5302|\n|DetectGPT|0.7524|0.7821|0.6876|0.7407|0.8161|0.8724|0.6530|0.7805|0.7099|0.8672|0.0000|0.5257|\n|Binoculars|0.6297|0.7218|0.9546|0.7687|0.7578|0.8440|0.9845|0.8621|0.8018|0.8314|**0.9949**|0.8760|\n|TextFluoroscopy|0.5778|0.6210|0.5479|0.5822|0.5110|0.5555|0.5274|0.5313|0.5638|0.5127|0.5478|0.5414|\n|RADAR|0.6469|0.6518|0.7154|0.6714|0.6190|0.6537|0.7285|0.6671|0.6061|0.6292|0.7835|0.6729|\n|ImBD|0.6653|0.7683|0.8643|0.7659|0.6584|0.8391|0.8837|0.7938|0.7874|0.8631|0.8928|0.8477|\n|BiScope|0.6320|0.7320|0.9450|0.7697|0.6610|0.8740|0.9830|0.8393|0.6625|0.9000|0.9900|0.8508|\n|FastDetectGPT|0.7523|0.8922|0.9734|0.8726|0.8513|0.8151|0.9879|0.8848|0.8347|0.9052|0.9901|0.9100|\n|AdaDetectGPT|**0.7963**|**0.8944**|**0.9782**|**0.8896**|**0.8965**|0.8275|**0.9893**|**0.9044**|**0.8799**|**0.9069**|0.9924|**0.9264**|\n|Relative|17.7682|2.0423|18.0119|13.3479|30.3912|6.6718|11.6202|17.0494|27.3167|1.8332|22.7215|18.1975|\n\n|Data||SQuAD||||Yelp|||\n|-|-|-|-|-|-|-|-|-|\n|Method|Qwen2.5|Mistral|LLaMA3|Avg.|Qwen2.5|Mistral|LLaMA3|Avg.|\n|Likelihood|0.5183|0.7068|0.7071|0.6440|0.6793|0.7598|0.8915|0.7769|\n|Entropy|0.5232|0.5070|0.5047|0.5116|0.5236|0.5103|0.5010|0.5117|\n|LogRank|0.5166|0.7041|0.7422|0.6543|0.6943|0.7499|0.9146|0.7863|\n|FastDetectGPT|0.5016|0.8812|0.9488|0.7772|0.8465|0.8902|0.9882|0.9083|\n|Binoculars|0.6164|0.7258|0.9469|0.7631|0.7199|0.7502|0.9854|0.8185|\n|TextFluoroscopy|0.5383|0.5772|0.5535|0.5564|0.5060|0.5109|0.5362|0.5177|\n|RADAR|**0.6262**|0.6055|0.6619|0.6312|0.6276|0.6018|0.7875|0.6723|\n|ImBD|0.5168|0.8073|0.7596|0.6946|0.7392|0.7440|0.8677|0.7836|\n|BiScope|0.6250|0.7283|0.8783|0.7439|0.7050|0.7840|0.9860|0.8250|\n|AdaDetectGPT|0.6044|**0.8851**|**0.9553**|**0.8149**|**0.8915**|**0.9026**|**0.9900**|**0.9281**|\n|Relative|20.6431|3.3051|12.6288|16.9470|29.3165|11.2763|15.7610|21.5350|\n\n**Table D2: Performance on three closed-source LLMs, i.e., GPT-4o, Gemini-2.5; Claude-3.5**\n||||GPT-4o|||||Gemini-2.5|||||Claude-3.5|||\n|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|\n||XSum|Writing|Yelp|Essay|Avg.|XSum|Writing|Yelp|Essay|Avg.|XSum|Writing|Yelp|Essay|Avg.|\nRoBERTaBase|0.5141|0.5352|0.6029|0.5739|0.5565|0.5311|0.5202|0.5624|0.7279|0.5854|0.5206|0.5836|0.5630|0.5593|0.5566|\nRoBERTaLarge|0.5074|0.5827|0.5027|0.6575|0.5626|0.6583|0.6588|0.6029|0.8180|0.6845|0.5462|0.6149|0.5105|0.6063|0.5695|\nLikelihood|0.5194|0.7661|0.8425|0.7849|0.7282|0.6067|0.5885|0.7127|0.7547|0.6656|0.5023|0.6780|0.7502|0.7134|0.6610|\nEntropy|0.5397|0.7021|0.7291|0.6951|0.6665|0.5754|0.5028|0.6038|0.6818|0.5910|0.5965|0.6035|0.5944|0.6625|0.6142|\nLogRank|0.5123|0.7478|0.8259|0.7786|0.7161|0.6084|0.5743|0.6896|0.7504|0.6557|0.5109|0.6653|0.7244|0.7111|0.6529|=\nRADAR|**0.9580**|0.8046|0.8558|0.8394|0.8644|0.8184|0.5152|0.6300|0.5891|0.6382|**0.9187**|0.7264|0.8424|0.9152|0.8507|\nBiScope|0.8333|0.8733|0.9700|0.9600|0.9092|0.7633|0.6800|0.7967|0.8167|0.7642|0.8533|0.8800|0.8800|0.9567|0.8925|\nFastDetectGPT|0.6796|0.9165|0.9162|0.9199|0.8580|0.5768|0.7373|0.7419|0.7878|0.7109|0.7207|0.8466|0.9270|0.9579|0.8631|\nAdaDetectGPT|0.9072|**0.9611**|**0.9832**|**0.9841**|**0.9589**|**0.8432**|**0.9484**|**0.9644**|**0.9947**|**0.9377**|0.9176|**0.9400**|**0.9728**|**0.9610**|**0.9478**|\nRelative|71.0264|53.4451|80.0000|80.1332|71.0484|62.9470|80.3570|86.2087|97.4869|78.4355|70.4942|60.8752|62.6561|7.3840|61.9021|\n\n> **Reduce the discussion on watermarking** (Strengths 3)\n\nThank you for pointing this out, we will follow your suggestion to reduce our discussion on watermarking. \n\n> **Missing conclusion** (Weakness 5)\n\nDue to the page limit, we did not include a conclusion section in the main paper. During the rebuttal, we have drafted a conclusion that we plan to include using the extra page should our paper be accepted. Refer to **Missing conclusion (Minor)** in our **Response to Reviewer UhoV**  for details.\n\n---\n\nWe hope our clarifications and newly-added experiments address your concerns. Let us know if you have any follow-up questions."}]

Author rebuttal:

Meta-review: This paper provides a new solution on the line of traing-based and logits-based LLM-generated text detection. Basically, it is a mixture of current training based approach and zero-shot logits-based method.

This paper is interesting and the solution is with depth and good theoretical analysis as well. Extensive experiements are conducted with SOTA approaches such as DNA-GPT, ast-DetectGPT, etc. Moreover, during the rebuttal, the authors provide more results of baselines, including training based ones.

In general, the rebuttal is focusing on more baselines to compare. The authors have provided more results on it.

I think the major misunderstanding in the initial feedback was due to the lack of precision in some of the expression. The authors can refer the survey paper such as A Survey on Detection of LLMs-Generated Content. EMNLP'24 to make the background and the contribution/position more clear.

Overall, it is a good paper.
Decision: Accept (poster)