Human Texts Are Outliers: Detecting LLM-generated Texts via Out-of-distribution Detection
Authors: Cong Zeng
Shengkun Tang
Yuanzhou Chen
Zhiqiang Shen
Wenchao Yu
Xujiang Zhao
Haifeng Chen
Wei Cheng
zhiqiang xu
Venue: NeurIPS 2025 poster ()
Keywords: LLM Detection
Primary area: social_and_economic_aspects_of_machine_learning

Abstract: The rapid advancement of large language models (LLMs) such as ChatGPT, DeepSeek, and Claude has significantly increased the presence of AI-generated text in digital communication. This trend has heightened the need for reliable detection methods to distinguish between human-authored and machine-generated content. Existing approaches both zero-shot methods and supervised classifiers largely conceptualize this task as a binary classification problem, often leading to poor generalization across domains and models. In this paper, we argue that such a binary formulation fundamentally mischaracterizes the detection task by assuming a coherent representation of human-written texts. In reality, human texts do not constitute a unified distribution, and their diversity cannot be effectively captured through limited sampling. This causes previous classifiers to memorize observed OOD characteristics rather than learn the essence of `non-ID' behavior, limiting generalization to unseen human-authored inputs. Based on this observation, we propose reframing the detection task as an out-of-distribution (OOD) detection problem, treating human-written texts as distributional outliers while machine-generated texts are in-distribution (ID) samples. To this end, we develop a detection framework using one-class learning method including DeepSVDD and HRN, and score-based learning techniques such as energy-based method, enabling robust and generalizable performance. Extensive experiments across multiple datasets validate the effectiveness of our OOD-based approach. Specifically, the OOD-based method achieves 98.3\% AUROC and AUPR with only 8.9\% FPR95 on DeepFake dataset. Moreover, we test our detection framework on multilingual, attacked, and unseen-model and -domain text settings, demonstrating the robustness and generalizability of our framework. Code will be released openly and also available in the supplementary materials.

Human Texts Are Outliers: Detecting LLM-generated Texts via Out-of-distribution Detection
Cong Zeng"
Shengkun Tang" MBZUAI
Yuanzhou Chen UCLA
Zhiqiang Shen MBZUAI
MBZUAI
Wenchao Yu NEC Lab
Xujiang Zhao
Haifeng Chen
Wei Cheng
Zhiqiang X MBZUAI
NEC Lab
NEC Lab
NEC Lab
Abstract
The rapid advancement of large language models (LLMMs) such ChatGPT, DeepSeek, and Claude has significantly increased the presence of Al-generated digital communication. This trend has heightened the need for reliable detection methods to distinguish between buman-authore and machine-generae generated content. Existing approaches both zero-shot methods and supervised classifiers largely conceptualize this task binary classification problem, often leading poor generalization across domains and models. In this paper, we argue that such binary formulation fundamentally mischaracterizes the detection task by assuming coherent representation of human-written texts. reality, human texts do not constitute unified distribution, and their diversity cannot be effectively captured through limited sampling. This causes previous classifiers memorize observed OOD characteristics rather than learn the essence of 'non-ID' behavior, limiting generalization to unseen human-authone vation, propose reframing the detection task detection problem, treating human-writte written texts as distributional outliers while texts are in-distribution (ID) samples. To this end, we develop a detection framework using one-class learning method including DeepSVDD and HRN, and score-based learning techniques such as energy-based method, enabling robust and generalizable performance. Extensive experiments across multiple datasets validate the effectiveness of our OOD-based approach. Specifically, the OOD-based method achieves 98.3% AUROC and AUPR with only 8.9% FPR95 detection framework on multilingual,
inputs. Based on this obser- out-of-distribution (OOD)
DeepFake dataset. Moreover, attacked, and unseen-model and -domain text settings, demonstrating the robust- ness and generalizability our framework. Code, pretrained weights, and demo will be released openly at ftttss//gghnbb..oom/m///zzoooooo -lmeeeetl
Introduction
In recent years, with the continuous iteration and rapid advancement of large language models (LLMs) such as ChatGPT [1, DeepSeek [2] and Claude []] the adoption of LLM M-p-eereedd products in everyday life and professional settings has increased significantly 4 5, 6). While these text- generation models have greatly enhanced productivity and efficiency, they also pose risks misuse
7 The phenomenon of hallucinations, instances where LLMs generate incorrect misleading content can lead to serious consequences if such outputs are inadvertently relied upon [1O]. As LLMs become increasingly powerful, there is critical need for detection techniques that stable, robust, and accurate in distinguishing machine- machine-generated generated text from human written content [2].
Equual contribution. The names are ordered by coin flip. Correspponiing authors.
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

Data Type
Metric
Distance
Intra-distance LLM
0.3014
Clean Data
Intra-distance human
0.4747
Inter-distance
1.6048
Intra- autra-distance LLM
0.1929
Machine (In-distribution)
Attacked Data
dirra-dittacee human
0.8698
Human (True OOD)
Inter-distance 0.7859
Human (Training Subset)
OOD Detection Boundary
Binary Classification Boundary
Figure I: Decision boundaries and model performance comparison. Left: Decision boundaries under distributional asymmetry. The binary classifier separates machine- generrate text from limited monan-written samples but fails to capture the variability in the true human distribution (e.g., true OOD subset). Right Table: Quantitative comparison showing intra- and inter-distance for clean and attacked data, indicating that the distance of human text is larger than the distance among L.I.- generated text.
Existing LLM detection methods can be categorized into three groups: watermarking techniques [13] zero-shot statistical methods [14], and training- bbsed approaches (TS]. Watermarking methods embed identifiable signals into generated content during inference, offering strong detection when the model cooperative, but failing entirely in black-box or adversarial settings. Zero-shot methods, which rely on distributional differences, are model-agnostic and do not require training, making them flexible and efficient. But their performance often unstable across domains and text lengths. In contrast, training-base -baed methods, typically implemented supervised classifiers trained on labeled examples, often achieve higher detection accuracy. Nevertheless, all these methods that require labeled data face the challenge of poor generalization across text detection from different domains unseen models.
Most existing detectors, whether zero-shot or supervised, treat the detection task, aiming to distinguish between the distributions of human-written and LLMs- MrMs-ggnreated content by identifying& threshold or optimal decision boundary between their distributions. However, this binary classification paradigm carries inherent limitations. While prior work [15] has demonstrated that machine- gegerrated text often exhibits consistent statistical patterns suggesting that it can be reasonably modeled as learnable distribution, fundamental challenge lies in can human-wrre written text truly treated as a single, coherent distribution for the purpose of classification? Intuitively, human language is inherently diverse: each author, writing style, domain, genre may follow distinct linguistic patterns, leading to a highly heterogeneous and dispersed distribution the feature space. This diversity poses a critical problem for binary classification models: by treating human-written text as a single distribution, existing approaches risk oversimplifying the underlying variability, Such oversimplification
binary classification
written
result in poor generalization, especially when encountering human texts from unseen domains or stylistic backgrounds.
Left figure illustrates the practical limitations of applying binary classification to this task. The diddiiiibbuiinn (ID) region, representing seebbreeggeeeated text, is compact and well-covered by training data. However, human-written text exhibits variability as out-of-distribution samples, especially in the "true OOD" subset (shown as red triangles), which lies outside the classifier's detection boundary. As result, binary classifier (the red dashed line), trained on limited human samples, tends to overfit and produce a brittle decision boundary with poor generalization. Moreover, shown in the Right Table in Figure [ we compute the average cosine inter- and intra-distance of LLM-generated and human-written texts on the Deepfake dataset (Clean Data) and RAID dataset (Attacked Data). The embedding backbone we use is RoBERTa pretrained with contrastive loss. The results show that the Intra-distance of LLM is smaller than the human while the distands between human and LLM is relatively large, supporting OOD hypothesis that LLM text forms coherent in nn-distribution cluster, while suman-written texts, which span varied styles and domains, act as natural OOD examples.
In this work, we theoretically analyze the representation incompleteness of human text distribution and the corresponding failure reason of binary classifiers. Furthermore, address the issue of

---

inherent asymmetry between human and machine- generratdd text distributions, we propose to recast muachnn--geerrate text detection as an out-of-distribution (OOD) detection task rather than a binary classification problem. OOD detection methods focus on modeling only the in-distribution region and treat any deviation from as unknown samples. Under this new formulation, we treat machine- generated text as the in-distribution (ID) samples, assuming that it originates from a single or limited family of models with shared statistical characteristics. In contrast, human-written text is considered as oul-of-distribution samples, reflecting its open-ended, diverse, and difficult-to-oode nature. OOD detection approach yields a more principled and robust decision boundary that fits the open-ended diversity of numan-authorede texts (the blue dashed line in Figure Left).
To validate our core hypothesis, that machine- gennrrtee texts form a learnable distributional core while human- written texts are distributional outliers, we systematically evaluate a range of established OOD detection methods. We implement this OOD detection framework by training a one-class or score-based classifier that models the distribution of machine-genere genirrreee texts. We incorporate and validate different OOD detection methods including DeepSVDD [6] HRN [77 and Energy-ban
method T8. At inference time, any input that significantly deviates from this learned distribution is flagged as OOD samples and considered to be human-written. Empirically, we compare our method against traditional supervised binary classifiers and recent zero-shot detectors. Remarkably, all OOD-based methods obtain superior detection performance. Specifically, the OOD-based method achieves 98.3% AUROC and AUPR with only 8.9% FPR95 on DeepFake dataset. Moreover, test our method on multilingual and attacked text setting on M4 and RAID datasets, where our method achieves SoTA performance. Finally, we validate the generalizability of our method unseen models and domain scenarios, highlighting the capacity to generalize beyond specific domains or stylistic boundaries. In summary, our contributions are as follows:
We identify the fundamental topological and statistical distinctions between human- -witten and LLM-generated texts in the representation space and theoretically prove the representa- tion incompleteness of auman-writenn text distribution and the corresponding failure reason of binary classifiers.
Based on the theoretical analysis, we propose reframing seeiinneeeeetteddd text detection an out-of-distribution (OOD) detection problem instead of a binary classification task. We solve this problem by designing a detection framework grounded in one-class and score-based learning that leverages the distributional convergence of LLM outputs.
Empirically, we incorporate various OOD detection methods including DeepSVDD, HRN and Energy-based method. Extensive experiments on multiple benchmarks indicate that OOD-base methods achieve superior performance compared with baselines. Moreover, the strong detection performance on multilingual, attacked and unseen-model and -domain texts demonstrates the robustness and generalizability of our framework.
2 Related Works
LLMs-generated Text Detection. Existing approaches for detecting
text can be
broadly categorized into three main categories [99] watermarking (20 21
22
13
23 zero-shot
methods [24 25
26 27 28 29 30 B1, and supervised training- based classifiers
32
33
34
B5
39 Watermarking methods operate under a different paradigm compared to the other two by embedding identifiable patterns signals into the text during model training, but is only feasible for model providers. In contrast, zero-shot and supervised training-based approaches are typical post hoc methods and both frame the detection task as binary classification problem: given a candidate text, determine whether it was generated by an L.M (positive sample) or written by a human (negative sample). Zero-shot detectors, such as DetectGPT [14] DetectLLM [40), DNA-GPT [41], Fast-DetectGPT (25). Binoculars [42). BiScope [43), Raidar 44]. and DALD [45). typically rely on the statistical analysis of the logits on distribution irregularities between human- and machine- written texts, and distinguish them using threshold -ased decision rules. More recently, detection has also been approached through statistical hypothesis testing methods [46] 477 which reframe detection as a relative test problem. Supervised training- based methods generally achieve higher accuracy by training binary classifier on labeled datasets containing human and machine-generated texts. These approaches often follow pipeline that uses pretrained language models (e.g., RoBERTa, T5 ) as embedding extractors, followed by a classifier layer. Notable training based examples include 48). GhostBuster [9], GPTZero [50]. Building on these backbones, RADAR (34]
36 37
38
3

---

adopts an adversarial training strategy, while CoCo 33 and DeTeCtive []5] leverage contrastive learning in the feature space distinguish between clusters associated with different LLMs and human-authored text. Despite their effectiveness in specific detection scenarios, all of these methods fundamentally assume that human-writte text, the negative class, can be modeled as unified and coherent distribution. However, this assumption overlooks the inherent diversity and stylistic variability of human language, limiting generalization and robustness when applied to out-of-domain or heterogeneous human text samples.
Cut-of-Distribution Detection. -ustr--ddittiittiin (OOD) detection [51] is a long-standing problem in machine learning, extensively studied in computer vision and anomaly detection 55] [6]. This task focuses on identifying inputs that deviate from the data dis- tribution observed during training. A wide range of OOD detection techniques have been proposed. One-class learning approaches, such as One-Class SVM (57] and Support Vector Data Description (SVDD) (58). attempt to learn tight boundary around ID samples without requiring any OOD data. In the deep learning era, variants such as DeeDSVDD [16] and autoencoder-
[2.
53
16
54
models high-dimensional representation spaces. Score-based methods (59 60 61 62 63 [4], including softmax score [65. and energy score (18), estimate confidence scores during inference to identify inputs with low model certainty. More recent trends include contrastive learning and representation clustering 666, 67]. which aim to separate ID and OOD samples in embedding space without relying on labeled outliers. In the context of natural language processing (NLP), OOD detection presents unique challenges [68]. Pretrained language models such as BERT and RoBERTa have been used extract embeddings, which are then analyzed using one-class or score-based techniques [69]. However, few studies have explored OOD detection in the context of LLM --M-eeerrtted text. Our work is the first to systematically apply OOD techniques to this detection problem, offering improved generalization and robustness across models.
have extended these principles
3 Methods
In this section, we present the details of our proposed approach. Section 3.1 formalizes the problem of Al-generated text detection and motivates our reformulation of the task an out-of-distribution (OOD) detection problem. Section 3.2 outlines the overall detection pipeline. Section 3.3 describes the specific OOD detection methods we Deeep--De HRN, and Energy-based method.
3.1 Problem Reformulation: Why Binary Classification Fails for Human Text Detection?
We aim to detect whether a given text is generated by a large language model (LLM) or authored by a human. Traditionally, this problem has been framed as a binary classification task, where the detector is trained to distinguish between learning. Formally, let X be the text space, and consider dataset D {(x, y) x E X, e {0, 1}} generated with class probabilities qM, , QH and in-class distributions PH,PM:
and machine- machine-generated samples using supervised
Fly = 0) = 9M: Pyy = 1) = 9H = 1 - 9Ms.
P( y 0) (M) P(aly= = PH (x),
where the label y = 0 corresponds to machine-generated text, and 1 corresponds to human- generated text. The following concept characterizes the "correctness" " of such a data distribution.
Assumption 1 (Human-Machine Distinction Hypothesis). We assume for any given text x E X, there exists an objective ground truth probability Par (ar) that x is machine-generated. We say data distribution defined by the tuple (qM, (H, Pas, PH)) is consistent with the ground truth PM (r) if, for E X and label y E (0,
9M PM (x)
(x)
Qи Pn (1)
1 (x)
Note that this is perfectly in line with the Bayes rule: PPy = 0|æ) = IM (x)( [am [aM (x) +
qu q (z)). The goal now is to train classifier f : X {0, 1) that distinguishes between the two distributions:
[ [f(x) if f P Pauman+ (f(z) if r Pamccting
f(x) (0, 1), where
(2)
4

---

In this setting, the classifier is typically trained with a cross entsopy loss, which encourages the model to maximize confidence over both classes. The training objective is:
(ce(f I = --E(s.0)~- logpo ( = 7 x)]
(3)
[log -ggarE-PP.
pa 0 =)] QH [logpoly - xm]
(4)
It can be proven (See Appendix) that the loss reaches minimum B(z.g)>D) (7 (p)r when po 0 .:) = Par (zz), where H. denotes entropy, thus encouraging the model to align itself with the ground truth label distribution. However, we posit that textual distributions generated by different human authors exhibit substantial heterogeneity, characterized by divergent stylistic patterns, domain-specific variations, and individualized linguistic fingerprints. To formalize this intuition, we consider an open-world human text distribution with intrinsic heterogeneity Pr., which is much more diverse than Pn, and state the following theorem.
Theorem 2. Consider training distribution D = (4M, qu, PM, PM,PH) PH) and real-world distribution
D = (qM, Qır, PM, Pıt) both consistent with the ground truth probability Pas (-). If the Pearson x² divergence D ;= (x=(Pr|)PPp is large, then for an arbitrary suboptimality A, there exists a binary
classifier ʃ, such that:
The loss for D is close to optimal: (CE(f(D) < (P +A;
Thhe loss for D high: LCE (FD() E (x..))> H (PMr()))) 0.9qu (D +
Detailed proof of this theorem and an analysis of the magnitude of D can be found in the Appendix. Theorem Theorem@implies implies that the error rate of a binary classifier on the real-world human text distribution can be many times higher than the training error, due to the inherent heterogeneity of -wittew text (e.g.. diverse styles, domains, and author traits). Another way to pinpoint this problem is to consider training dataset almost consistent with pM. while showing high discrepancy at sparser text regions. A binary classifier trained on this dataset will inevitably overfit and fail to generalize to the real-world distribution. We present another theoretical result based on this line of thinking also in Appendix. Either way, this highlights fundamental mismatch: binary classification assumes a closed-worid setting, yet
text behaves as an open- world, high-variance distribution.
To address this, we propose to reframe the maacinne-generan problem, where the machine-generatee distribution Pas Pm is modeled explicitly narrow, well-characterized distribution, and any deviation from is treated as out-of- of-diistibuttion Pn = Pout without attempting model it directly. This Pour may cover texts from unseen domains, stylistic outliers, noisy generations, languages, authors, or other edge cases not represented in the training data. This perspective not only aligns better with the theoretical properties of text generation, but also provides a more robust framework for handling the diversity and unpredictability of human language.
text detection as an OOD detection
3.2 Method Overview: OOD Detection Framework for Machine-Generated Text
To overcome the limitations of binary classification in the context of machine-generated text detection, we adopt an diitt-ddistriuution (OOD) detection framework based on the one-class and score-based learning paradigm. Rather than learning to discriminate between two classes, our method focuses solely on modeling the in-distribution, i.e., machine-generatel text, which is typically compact and consistent due to its origin from specific LLM. Our framework consists of two main components: 1) a Text Encoder (e.g. RoBERTa) that maps each input text E X' into high-dimensional representation z de (a) Rd. 2) an OOD Detector that learns OOD decision boundary score by designed OOD loss. Figure 2 illustrates the overall pipeline by taking DeepS VVDD as a primary example of the second stage. DeepSVDD learns a compact hypersphere around the in-distribution data in the embedding space. Overall, during the training stage, we compute a center point c E Id samples, then optimize the encoder parameters using only the embeddings of machine-generee using the following DeepSVDD loss:
N
1
LDSVDD
Σ [10( - 21.2. N
The objective is to compute and minimize the distance of mnchine-generated samples from the center, which intuitively the radius of the hypersphere, thereby ensuring that embeddings of machine- generated texts lie close to the center. Unlike binary classification, which attempts to model both
5

---

Human Written
Embedding Space
A
Different
Authors
Text Encodler
8
guided training
LLMs Generated
Figure 2: An overview of our proposed OOD detection pipeline under DeepSVDD method. This pipeline shows the process of training a text encoder with a DeepSVDD loss. (Right) Illustration of the learned embedding space: LLM-generated texts are enclosed within hypersphere, while human-written texts fall outside.
classes under low-entropy supervision, our one-class method only learns the compact support of machine text, while allowing high-entropy human texts to remain unconstrained, treating any outlier as likely authored by human.
Besides, to further enhance the model's ability to distinguish between human- and machine-generatee text, we incorporate a contrastive loss term based on SimCLR (70) during training, as shown in Equa- tion 6 q is the current sample. Z+ is the collection of positive samples, while Z- is the collection of negative samples. Ng+ is the size of positive sample collection. refers to the temperature coefficient. S(.) is the similarity computation, which is cosine similarity our experiments.
exp
ExEz
Sla.z) /Nz+
Coontrastive = loog
(6)
exp
EzEzt
S(g.2) /N2+) + EzEZ- exp
S(q.8)
3.3 Alternative OOD Detection Losses: HRN and Energy-Basee Methods
While we describe DeepSVDD as representative OOD detection approach, our framework is model-agnostic and supports a variety of one-class and score-based OOD detection methods. this section, we present two additional techniques HRN [17] and Energe-based OOD detection [18] that instantiate the same pipeline with alternative OOD loss formulations. These methods are designed to improve detection reliability under varying conditions. Each is seamlessly integrated into the same architecture described in Section 3.2 replacing the DeepSVDD loss with their OOD loss function.
HRN is one-class learning method designed to improve robustness and generalization in OOD detection. HRN only has one class/head the output, it uses (f as score or the probability of given text z belonging to the in-class. During training, learning the given class in the distribution with its training data, one-class loss is:
CHRN E Egnin [- log( log (fg(Simmii(((((()))) + A [vaf((
(7)
where f is a one-class classifier, o(x) is the high-dimensional embedding, Sigmoid(.) E (0, 1) is a score mapping the one class head to logit, and n and À are hyper-parameters controlling the strength of the penalty and balancing the regularization respectively. By adding an H-Regularization term with 2-Norm instance-level normalization to the Negative Log Likelihood for one class, this HRN loss improves over prior approaches by penalizing excessive sensitivity to specific input directions, promoting more robust and generalizable decision functions.
Energy-based OOD detection methods assign an energy score F(x:) to each input, indicating its compatibility with the in-distribution. Lower energy implies higher likelihood of being in-

---

distribution.
The energy of sample is defined from softmax logits f()) as:
E(x) = - log Σ exp(fi
(8)
where f((.) indicates the model logits for class i. We adopt energy- based learning objective that explicitly encourages an energy gap during training, The learning objective is:
Lenergy E (a [- log (x))
[max (0, L(x) min) + E. Diiis [max(0, Mour - (x)))]]
Desin
where (x(x) is the softmax output of the classifier. Importantly, the softmax classifier is trained only on in-distribution data-i.c.
texts from multiple sources using cross-entropy loss to distinguish between different LLM generators. The second is an energy regularization term, that combines two squared hinge loss terms with separate margin hyperparameters Min and Mout- This loss penalizes in-distribution samples whose energy exceeds a predefined margin Mins and simultaneously penalizes OOD samples with energy lower than another threshold Mout- The resulting model learns contrastively shaped energy surface, creating a clearer margin between ID and OOD samples in energy space.
3.4 Overall Training Objectives
The final training objective thus combines the OOD loss with a supervised contrastive objective:
Toral = a LOOD + B Coontrustive:
LOOD E {CDvVDD: LHRN, Lenergy
(10)
where a and 8 weighting coefficient. This joint training scheme allows the encoder benefit from both unsupervised in-distribution modeling and supervised human-machine discrimination, leading to more robust representation learning.
Inference. For DVDD, we compute an OOD score for a given text using the distance from the center, if the score exceeds threshold, the text is flagged dusto--distributii and thus considered human-written. As for HRN, during inference time, texts with low sigmoid scores are considered as OOD samples, which is human-writee text. Finally, for energy- based method, the energy score E Fx)) computed for a given input using the log-sum-exp of the softmax logits. An input is classified as dut-of-distribution if its negative energy score E(r)) falls below predefined threshold.
4 Experiments
4.1 Experimental Setup
Datasets. We test our method three widely-used and challenging datasets including DeepFake [1], M4 (72), and RAID (7). The Deepfake dataset comprises text generated by 27 large language models (LLMs) alongside human- -writenn content sourced from multiple websites across 10 distinct domains, totaling 332K training and 57K test samples. defines six diverse evaluation scenarios, including cross-domain, unseen domain, and model detection settings. Moreover, the M4 dataset is a comprehensive benchmark spanning multiple domains, models, and languages, comprising data from 8 large language models (LLMs). 6 domains, and languages. We test method and other baselines on multilingual settings, which include 157K training and 42K testing data. The test dataset of M4 also includes the unseen models from the training set. Finally, RAID is large-scale LLM detection benchmark with normal Al-generated texts and different attacked texts including paraphrase, synonym swap. misspelling, and on. We hold out 10% of training data as validation set for evaluation. During training, we filter the attacked samples in the training set.
follow DNA-GPT [1,, FastDetectGPPT 255 and DALD [45] and report the accuracy in the area under the receiver operating characteristic (AUROC) and the area under the precision and recall (AUPR) to evaluate the performance of all methods. Moreover, we follow [8] to measure the false positive rate (FPR95)
Evaluation Metrics. To comprehensively evaluate the detection results,
when true positive rate 95%.
Baselines. We compare our method with both zero-shot and training-based methods. For zero-shot methods, we compare with DetectGPT [4, FastDetectGPT (25). DNA-GPT [4], Binoculars [4].
7

---

Table 1: Detection result comparison of our method and baselines. Our method outperforms all previous zero-shot and training basdd methods and achieves SoTA performance, f: Due to the low detection speed, we randomly select 10K samples from each test set for evaluation.
DeepFake AUPR
M4-multtingal AUPR
RAID AUPR
Method
AUROC 1
FPR95
AUROCI
FPR95
AUROCI
FPR95]
DeteciLLM
40
59.4
62.5
95.0
86.7
83.2
46.0
77.6
80.5
78.6
DetectGPT
14
58.1
59.4
90.2
70.5
67.3
80.4
39.5
77.3
70.5
DNA-GPT
57.9
56.0
96.5
66.2
61.2
74.1
61.3
97.3
95.8
E-
87.7
72.8
77.6
99.2
99.3
Binoculars
42
61.7
52.8
66.7
87.7
76.6
27.8
82.4
7.3
40.4
DALD F5
56.2
55.0
97.4
63.2
66.6
64.6
59.4
67.1
64.6
Glimpse
69.5
91.4
88,2
52.8
79,5
81.2
GPTZero 50
39.3
70.4
92.3
07.5
76.T
89.3
62.7
68.3
92.0
RADAR 34
61.2
55.3
86.3
68.3
76.1
92.1
82.9
69.2
64.1
GhostBuster
52.9
51.1
93.2
62.5
63.2
85.6
66.7
98.1
82.4
BiScope +3
79.2
85.0
83,0
90.8
84.8
78.0
71.1
86.8
DeTeCtive 440
95.6
97.1
16.1
93,1
95.3
52.4
85.1
55.7
74.3
Ours (D-SVDD)
98.3
98.3
8.9
96.4
96.3
18.2
94.7
73.0
38.3
(HRN)
88.1
70.1
57.5
Ours (Energy)
97.6
97.2
12.3
96.2
95.8
10.7
93.6
99.7
28.3
BiScope 43 and Glimpse 77] For training-based methods, include the comparison with RADAR [34, GhostBuster [49], GPT-Zero, and DeTeCtive [3]. We utilize the official implementation of each baseline. More information about the baselines can be found in the supplementary material.
DetectLLM LRR and NPR [40], DALD 455
Implementation Details. We adopt three OOD detection methods including DeepSVDD, HRN and Energy- based methods for our experiments. For DeepSVDD, we use the machine texts from the training set to compute the initial center and compute the corresponding loss with the center. For HRN, follow its original setting by training a one-class classifier model family using its corresponding data as the positive class and averaging their scores at inference time. For energy-based method, we follow [8] to choose nyper-parameters, where min. -27 and Mout -2. DeepSVDD is trained from scratch, and HRN and Energy load the pre-trained weights DeTeCtive. The learning-rate is set 2e-5 and the optimizer is Adam [75] with 31 = 0.9 and 3g 0.98. The loss weights and are set as in our experiments. train model for 20 epochs. All experiments are conducted on A*A100 GPUs.
4.2 Main Results
We conduct a comprehensive evaluation of our methods against a diverse set of baselines on two challenging benchmarks: DeepFake and M4-multilingual, present in Table [ On the DeepFake dataset, our DeepS VVD model achieves the highest AUROC (98.3) and AUPR (98.3), surpassing all other training-based methods including GPT-Zero, RADAR, GhostBuster. Moreover, our method substantially outperforms the strongest training- based baseline, DeTeCtive, which scores 95.6 AU- ROC and 97.1 AUPR. Additionally, DeepSVDD reduces the FPR95 from 16.1% 8.9%. indicating a much lower false positive rate at high sensitivity. Our HRN and Energy-basee variants also perform competitively, with HRN attaining the lowest FPR95 (4.4%) among all methods while maintaining high precision (97.2 AUPR). In the M4 M4-multilingual benchmark, where detectors must generalize across multiple languages and domains, our methods again lead in all metrics. DeepSVDD and HRN both reach an AUROC of 96.4, surpassing DeTeCtive's 93.1. HRN also delivers the best AUPR (96.7), while the Energy- based method achieves a strong balance between recall and reliability, with notably low FPR95 of 10.7, compared to DeTeCtivve' much higher 52.4. These results demonstrate the effectiveness and robustness of our approaches pross-lingual and domain-shifted settings.
We also compare against zero-shot methods including FastDetectGPT and Binoculars, two recent approaches designed to detect L.MM-generatd content without task-specific training. While FastDe- tectGPT offers fast and training-fre free deployment, it suffers from significant performance limitations. On DeepFake, achieves only 78.3 AUROC and 60.8 FPR95 over 20 points worse in AUROC and nearly seven times higher in FPR95 than DeepSVDD. Binoculars, more recent zero-shot method, performs somewhat better with 88.1 AUROC and 41.2 FPR95, still underperforms our models by large margin. On M4-multilingual, FastDetectGPTTs AUROC drops to 66.1 and FPR95 increases to 74.7, while Binoculars shows moderate improvement (79.6 AUROC, 64.9 FPR95), yet both remain significantly below the performance of proposed detectors.

---

Table 2: Detection results in comparison of baseline and our method in unseen domain and model settings. With different OOD heads, our method surpasses the DeTeCtive in all settings, demonstrating the generalizability our method.
Unseen Domain
Unseen Model
Method
AUROC f AUPR
FPR95,
AUROC1
AUPR
FPR95]
DeTeCtive
76.5
87.5
89.2
84.3
88.1
70.8
Ours (D-SVDD)
97.9
97.8
10.2
93.4
92.3
25.8
Ours (HRN)
98.0
97.8
12.0
95.2
96.3
30.9
Ours (Energy)
96.0
93.2
8.3
90.2
91.3
38.1
Table 3: Ablation study. The binary classification head is compared with each of our components.
DeepFake AUPR
M4-multtinual AUPR
RAID AUPR
Method
AUROC ~
FPR95
AUROC
FPR95
AUROC1
FPR95,
Classification Head
89.0
94.0
75.8
84.6
91.2
83.2
84.5
71.9
83.5
D-SVDD Loss
98.3
98.3
8.9
96.4
96.3
18.2
94.7
73.0
38.3
HRN Loss
97.0
97.2
96.4
96.7
24.9
88.1
65.9
70.0
Energy Loss
97.6
97.2
12.3
96.2
95.8
10.7
93.6
99.7
28.3
Overall, our methods consistently outperform both training- based and zero-shot baselines across all metrics and benchmarks. The substantial gains in AUROC and AUPR, along with dramatic reductions in FPR95, demonstrate that our approach offers robust and generalizable solution for detecting LLM-generated text, even in multilingual and domain-shifted environments.
4.3 Experimental Analysis
Attack Robustness. We also provide the results on RAID dataset, as shown in Table D RAID is specifically designed to evaluate the robustness of LLM-generated text detectors under adversarial perturbations including paraphrasing, synonym substitution, sentence reordering, and so on. Our proposed methods exhibit strong robustness to adversarial attacks, significantly outperforming both training-
waining-based based and zero-shot baselines. Notably, the energy- based model achieves the highest AUPR (99.7), indicating exceptional precision-recet performance even under strong perturbations. This suggests that the model remains confident and discriminative even when the surface form of the generated text substantially altered. Additionally, the DeepSVDD variant attains the highest AUROC (94.7) among all methods, demonstrating that it maintains strong overall ranking performance in the presence of adversarial noise. In contrast, the baseline methods show siginificant degradation on RAID. For example, DeTeCtive, while effective on clean data, sees its AUROC drop to 89.3 with a much higher FPR95 (58.9), indicating frequent misclassification of perturbed generated samples as numan-written The zero-shot method FastDetectGPT performs particularly poorly, with only 59.2 AUROC and a very high FPR95 of 75.1, showing that lacks the structural resilience needed for attack scenarios. Even Binocular, which performs better than FastDeteetGPT. achieves only 72.4 AUROC and 64.3 1FP955-wo below those of our proposed models. These results highlight a key strength of our approach: robust generalization to adversarially manipulated text. The combination of representation learning (in DeepSVDD and HRN) and energy-based scoring mechanisms provides a defense against common attack strategies that exploit shallow decision boundaries overfitting.
Generalizability. To show the generalizability of our method, we test our method on DeepFake dataset in Unseen Domains and Unseen Models settings, which is split from [15). The results are shown Table 2 In the unseen domain scenario, all variants of our method significantly outperform DeTeCtive. Specifically, our HRN-based method achieves the highest AUROC (98.0) and near- optimal AUPR (97.8), with a considcrably lower FPR95 (12.0) compared to DeTeCtive's 's 89.2. The DeepSVDD variant also performs competitively, achieving AUROC of 97.9 and the lowest FPR95 of 10.2. Notably, the eeeryy-based approach achieves the best FPR95 (8.3), suggesting that it is especially effective at reducing false positives, even though its AUROC (96.0) is slightly lower than the others. the unseen model setting, similar performance is observed. The strong performance underscores our method's 's robustness in identifying the instances from unseen models and domains with minimal false positives and demonstrates the generalizability our method.
Practical Insights on Method Choice. According to the empirical results above, we can draw conclusion and provide the insights about how to choose OOD detection methods: 1) In scenario which requires attack robustness, energy-based methods yield the best performance; 2) In scenario

---

which requires better generalizability like unseen model and domains, HRN would be a better choice; 3) DeepSVDD balances both scenario.
Ablation Study. We conduct an ablation study of our method on DeepFake, M4, and RAID datasets. The results presented in Table 3 We compare our loss functions including D-SVDD, HRN and Energy against standard binary classification head across three datasets. Across all benchmarks, our methods significantly outperform the classification head, which suffers from high FPR95 values (75.8-8355). Notably, HRN achieves the lowest FPR95 (4.4) on DeepFake, while Energy loss attains the best AUPR (99.7) and lowest FPR95 (28.3) on RAID. All variants also consistently improve AUROC and AUPR, confirming the effectiveness of our loss designs in enhancing LLM detection performance and reducing false positives.
Conclusion
In this paper, we theoretically analyze the failure case and reason for treating LLM detection tasks as binary classification tasks and propose to transform the task to an ou-oof-distribution detection task. Moreover, we propose a novel LLM detection framework based on the OOD detection loss. We validate the effectiivnness of our proposed framework with DeepSVDD, HRN and energy-based method, achieving SoTA performance on multiple benchmarks including multilingual, attacked and unscen-model and -domain scenarios.
References
[1] Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. Gpt-4 technical report. arXiv preprint 2303xx3330007774 2023.
[2] Aixin Liu, Bei Feng, Bing Xue, Bingxuan Wang. Bochao Wu, Chengda Lu, Chenggang Zhao, Chengqi Deng, Chenyu Zhang, Chong Ruan, al. Deepscek-v3 technical report. arXiv preprint arXiv:2412. 19437, 2024.
[3] Anthropic. Introducing the next generation of claude, 2024.
[4] Muneer M. Alshater. Exploring the rolc of artificial intelligence in enhancing academic performance: A case study of chatgpt. Available at SSRN 4312358, 2022.
[5] Catherine A Gao, Frederick M Howard, Nikolay S Markov, Emma C Dyer, Siddhi Ramesh, Yuan Luo, and Alexander T Pearson. Comparing scientific abstracts generated by chatgpt to original abstracts using an artificial intelligence output detector, plagiarism detector, and blinded human reviewers. BioRxiv, pages 2022-12. 2022.
[6] Holly Else. By chatgpt fool scientists. Nature, 613:423, 2023.
[7] David Ifeoluwa Adelani, Haotian Mai, Fuming Fang. Huy H. Nguyen, Junichi Yamagishi, and Isao Echizen. Generating sentiment-preserviine fake online reviews using neural language models and their human-and machine-based detection. In Advanced information nerworking and applications: Proceedings of the 34th international conference on advanced information networking and applications (AINA-2020) pages Springer, 2020.
[8] Alim Al Ayub Ahmed, Ayman Aljabouh, Praveen Kumar Donepudi, and Myung Suh Choi. Detecting fake news using machine lcarning: A systematic litcrature review, arXiv preprint arXiv:2102.00 04458, 2021.
[9] Jooyoung Lee, Thai Le, Jinghui Chen, and Dongwon Lee. Do language models plagiarize? of the ACM Web Conference 2023, pages 3637-3647, 2023.
Proceedings
[10] Vipula Rawte, Swagata Chakraborty, Agnibh Pathak, Anubhav Sarkar, SM Towhidul Islam Tonmoy, Aman Chadha, Amit Sheth, and Amitava Das. The troubling emergence of hallucination in large language models- extensive definition, quantification, and prescriptive remediations. Association for Computational Linguistics, 2023.
[11] Souradip Chakraborty, Amrit Singh Bedi, Sicheng Zhu, Bang An. Dinesh Manocha, and Furong Huang. On the possibilities of ai-generated text detection. arXiv preprint 24X44:2304.04336, 2023.
[12] Vinu Sankar Sadasivan, Aounon Kumar, Stiram Balasubramanian, Wenxiao Wang, and Soheil Feizi. Can ai- ai-generated text be reliably detected? arXiv preprint arXiv:2303.11156 2023.
10

---

[13] Thibaud Gloaguen, Nikola Jovanović. Robin Staab, and Martin Vechev. Black-box detection of language model watermarks. arXiv preprint urXiv:2405.20777. 2024.
[14] Eric Mitchell, Yoonho Lee, Alexander Khazatsky, Christopher D Manning, and Chelsea Finn. Detectgpt: Zero-shot machine-generated text detection using probability curvature. In International Conference on Machine Learning, pages 24950-24962. PMLR, 2023.
[15] Xun Guo, Yongxin He, Shan Zhang, Ting Zhang, Wanquan Feng, Haibin Huang, and Chongyang Ma. Detective: Detecting ai-generated text via multi-level contrastive learning. Advances in Neural Information Processing Systems, 37:88320-8888 883488837777 2024.
[16] Lukas Ruff, Robert Vandermeulen, Nico Goernitz, Lucas Deecke, Shoaib Ahmed Siddiqui, Alexander Binder, Emmanuel Müller, and Marius Kloft. Deep one-class classification. In International conference on machine learning, pages 4393-4402. PMLR, 2018.
[17] Wenpeng Hu, Mengyu Wang, Qi Qin, Jinwen Ma, and Bing Liu. Hrn: A holistic approach to one class learning. Advances in neural information processing systems, 33:19111-19124, 2020.
[18] Weitang Liu, Xiaoyun Wang, John Owens, and Yixuan Li. Energy- out-of-distribution detection. Advances in neural information processing systems, 33:21464-211477 2020.
[19] Xianjun Yang, I Liangming Pan, Xuandong Zhao, Haifeng Chen, Linda Petzold, William Yang Wang, and Wei Cheng. A survey on detection of Ilms-generated content. arXiv preprint arXiv:2310. 15654, 2023.
[20] Sahar Abdelnabi and Mario Fritz. Adversarial watermarking transformer: Towards tracing text provenance with data hiding. In 2021 IEEE Symposium Security and Privacy (SP), pages 121- IEEE, 2021.
[21] John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. A watermark large language models. In International Conference on Machine Learning, pages 17064-17084. PMLR. 2023.
[22] KiYoon Yoo, Wonhyuk Ahn, Jiho Jang, and Nojun Kwak. Robust multi-bit natural language watermarking through invariant features. arXiv preprint arX1v:2305.01904, 2023.
[23] Miranda Christ, Sam Gunn, and Or Zamir. Undetectable watermarks for language models. In The Thirty Seventh Annual Conference on Learning Theory, pages 1125-1139 PMIR, 2024.
[24] Daphne Ippolito, Daniel Duckworth, Chris Callison- Burcch, and Douglas Eck. Automatic detection of generated text is casiest when humans are fooled. arXiv preprint arXiv: 1911000650 2019.
[25] Guangsheng Bao, Yanbin Zhao, Zhiyang Teng, Linyi Yang, and Yue Zhang. Fast-detectgpt: Efficient zero-shot detection of machine-generaaed text via conditional probability curvature. arXiv preprint arXiv:2310.05130. 2023.
[26] Saranya Venkatraman, Adaku Uchendu, and Dongwon Lee. Gpt-who: An information density-based machine-generated text detector. arXiv preprint arXiv:2310.00202. 2023.
[27] Yibo Miao, Hongcheng Gao, Hao Zhang, and Zhijic Deng. Efficient detection of llm- teregeeeertedd texts with bayesian surrogate model. arXiv preprint arXiv:2305. 21l.:2335.6667,, 2023.
[28] Kalpesh Krishna, Yixiao Song. Marzena Karpinska, John Wieting, and Mohit lyyer. Paraphrasing evades detectors of ai-generated text, but retrieval is an effective defense. Advances in Neural Information Processing Systems, 36:27469-27500) 2023.
[29] Niloofar Mireshghallah, Justus Mattern, Sicun Gao, Reza Shokri, and Taylor Keng-Kirkpatrick. Smaller language models are better black-box machine-generated text detectors. arXiv preprint arXiv:2305.09839 2023.
[30] Eduard Tulchinskii, Kristian Kuznetsov, Laida Kushnareva, Daniil Cherniavski,, Sergey Nikolenko, Evgeny Burnaev, Serguei Barannikov, and Irina Piontkovskaya. Intrinsic dimension estimation for robust detection of ai-generated texts. Advances in Neural Information Processing Systems, 36:39257-39276 2023.
[31] Xianjun Yang, Kexun Zhang, Haifeng Chen, Linda Petzold, William Yang Wang, and Wei Cheng, Zcro-shot detection of machine-generaan codes. arXiv preprini 1x.iv:2300.05/00 2023.
[32] Sebastian Gehrmann, Hendrik Strobelt, and Alexander M Rush. Gltr: Statistical detection and visualization of generated text. arXiv preprint arXiv:1906.04000 2019.

---

[33] Xiaoming Liu, Zhaohan Zhang, Yichen Wang. Hang Pu, Yu Lan, and Chao Shen. Coco: Coherence- enhanced -eaninnegeeeertted text detection under data limitation with contrastive learning. arXiv preprint urXiv:2212. 10341, 2022.
[34] Xiaomeng Hu, Yu Chen, and Tsung-Yi Yi Ho. Radar: Robust ai-text detection via adversarial learning. Advances in neural information processing systems, 36:15077-15095, 2023.
[35] Pengyu Wang, Linyang Li, Ke Ren, Botian Jiang, Dong Zhang, and Xipeng Qiu. Seqxgpt: Sentence-level ai-generated text detection. arXiv preprint arXiv:2310.08903, 2023.
[36] Linyang Li, Pengyu Wang. Ke Ren, Tianxiang Sun, and Xipeng Qiu. Origin tracing and detecting of Ilms. arXiv preprint arXiv:2304. 14072, 2023.
[37] Kangxi Wu, Liang Pang, Huawei Shen, Xueqi Cheng, and Tat-Seng Chua. LImdet: A large language models detection tool. CoRR, 2023.
[38] Zhen Guo and Shangdi Yu. Authentigpt: Detecting machine-generated text via black-hox language models denoising. Xiviv preprint arXiv:23 1.00700, 2023.
[39] Xiao Yu, Yuang Qi. Kejiang Chen, Guogiang Chen, Xi Yang. Pengyuan Zhu, Xiuwei Shang. Weiming Zhang, and Nenghai Yu. Dpic: Decoupling prompt and intrinsic characteristies for Ilm generated text. detection, Advances in Neural Information Processing Systems, 37:16194-16212, 2024.
[40] Jinyan Su, Terry Yuc Zhuo, Di Wang, and Preslav Nakov. Detectllm: Leveraging log rank information for zero-shot detection of machine- generated text. arXiv preprint arXiv:2306. 055400 2023.
-achine-generated
[41] Xianjun Yang, Wei Cheng. Yue Wu, Linda Petzold. William Yang Wang, and Haifeng Chen. Dna-gpt: Di- vergent n-gram analysis for training-free detection of gpt-generated text. arXiv preprint 17X1v: 2023.
[42] Abhimanyu Hans, Avi Schwarzschild. Valeriia Cherepanova, Hamid Kazemi, Aniruddha Saha, Micah Goldblum, Jonas Geiping. and Tom Goldstein. Spotting Ilms with binoculars: Zero-shot detection of muchine-generated text. arXiv preprint urXiv:2401. 12070, 2024.
[43] Hanxi Guo, Siyuan Cheng, Xiaolong Jin, Zhuo Zhang. Kaiyuan Zhang, Guanhong Tao, Guangyu Shen, and Xiangyu Zhang. Biscope: Ai-generated text detection by checking memorization of preceding tokens. Advances in Neural Information Processing Systems,
2024.
[44] Chengzhi Mao, Carl Vondrick, Hao Wang, and Junfeng Yang. Raidar: generative ai detection via rewriting. arXiv preprint arXiv:2401. 12970, 2024.
[45] Cong Zeng, Shengkun Tang, Xianjun Yang, Yuanzhou Chen, Yiyou Sun, Zhiqiang Xu, Yao Li, Haifeng Chen, Wei Cheng, and Dongkuan Xu. Dald: Improving logits-based detector without logits from black- 1lms. In A. Globerson, L. Mackey, D. Belgrave, A. Fan, U. Paquet, Tomezak, and C. Zhang, editors, Advances in Neural Information Processing Systems, volume 37, pages 54947-54973. Curran Associates, Inc., 2024.
[46] Shuhai Zhang, Yiliao Song, Jiahao Yang, Yuanqing Li, Bo Han, and Mingkui Tan. Detecting machine- generated texts by aulti-popplation aware optimization for maximum mean discrepancy. arXiv preprint 1eXiv:2402.1604/ 2024.
[47] Yiliao Song, Zhenqiao Yuan, Shuhai Zhang, Zhen Fang, Jun Yu, and Feng Liu. Deep kernel relative for machine- machine-generated text detection. In The Thirteenth International Conference on Learning Representations, 2025.
[48] Yutian Chen, Hao Kang. Vivian Zhai, Liangze Li, Rita Singh, and Bhiksha Raj. Gpt-sentinel: Distinguishing human and chatgpt generated content. arXiv preprint X3X:22305007966 2023.
[49] Vivek Verma, Eve Fleisig. Nicholas Tomlin, and Dan Klein. Ghostbuster: Detecting text ghostwritten by large language models. arXiv preprint arXiv:2305.I 15047, 2023.
[50] Edward Tian and Alexander Cui. Gptzero: Towards detection of ai-generated text using zero-shot and supervised methods, 2023.
[51] Guansong Pang, Chunhua Shen, Longbing Cao, and Anton Van Den Hengel. Deep learning for anomaly detection: A review. ACM computing surveys (CSUR), 54(2):138,, 2021.
[52] Mohammad Sabokrou, Mohammad Khalooei, Mahmood Fathy, and Ehsan Adeli. Adversarially learned one-class classifier for novelty detection. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 3379-3388, 2018.
12

---

[53] Raghavendra Chalapathy, Aditya Krishna Menon, and Sanjay Chawla. Anomaly detection using one-class neural networks. arXiv preprini arXiv:/802.063600 2018.
[54] Pramuditha Perera, Ramesh Nallapati, and Bing Xiang. Ocgan: One-class novelty detection using gans with constrained latent representations. In Proceedings of the IEEF/CVF conference computer vision and pattern recognition, pages 2898-2906, 2019.
[55] Siqi Wang. Yijie Zeng, Xinwang Liu, En Zhu, Jianping Yin, Chuanfu Xu, and Marius Kloft, Effective end-to-end unsupervised outlier detection via inlier priority discriminative network. Advances in neural information processing systems, 32, 2019.
[56] Lucas Deecke, Robert Vandermeulen, Lukas Ruff, Stephan Mandt, and Marius Kloft. Image anomaly detec- tion with generative adversarial networks. In Machine Learning and Knowledge Discovery in Datohases: European Conference, ECML PKDD 2018, Dublin, Ireland, September 10-14, 2018, Proceedings. Part I 18. pages 3-17. Springer, 2019.
[57] Bernhard Schölkopt. John C Platt, John Shawe-Tayler Alex Smola, and Robert C Williamson. Estimating the support of high-dimensional distribution. Neural computation, 13(7):1443-147) 2001.
[58] David MJ Tax and Robert PW Duin. Support vector data description. Machine learning. 54:45-66, 2004.
[59] Shiyu Liang. Yixuan and Rayadurgam Srikant. Enhancing the reliability of -utto--diistitutionn image detection in neural networks. arXiv preprint #XXiv:1706.02666 2017.
[60] Kimin Lee, Kibok Lee, Honglak Lec, and Jinwoo Shin. A simple unified framework for detecting out- of-distribution samples and adversarial attacks. Advances in neural information processing systems, 31, 2018.
[61] Terrance De and Graham W Taylor. Learning confidence for oittof--dittibution detection in neural networks. arXiv preprint /802v 2018.
[62] Jie Ren, Peter Liu, Emily Fertig, Jasper Snoek, Ryan Poplin, Mark Depristo, Joshua Dillon, and Balaji Lakshminarayanan. Likelihood ratios for out-of-distribution detection. Advances in neural information processing systems, 32, 2019.
[63] Yen-Chang Hsu, Yilin Shen, Hongxia Jin, and 7solt Kira. Generalized odin: Detecting -ui-t--distiibuttinn image without learning from out-of-distribution data. In Proceedings of the IEFF/CVF conference on computer vision and pattern recognition, pages 10951-10960 2020.
[64] Jiefeng Chen, Yixuan Li, Xi Wu, Yingyu Liang, and Somesh Jha. Atom: Robustifying detection using outlier mining. In Machine Learning and Knowledge Discovery in Databases, Research Track: European Conference, ECML PKDD 2021, Bilbao, Spain, September 13-17, 2021, Proceedings, Part III 21, pages 430-445. Springer, 2021.
[65] Dan Hendrycks and Kevin Gimpel. A baseline for detecting misclassified and out-of-distribution examples in neural networks. arXiv preprint arXiv:1610.000
2016.
[66] Yixin Liu, Zhao Li, Shirui Pan, Chen Gong, Chuan Zhou, and George Karypis. Anomaly detection on attributed networks via contrastive sele-super learning. IEEF transactions on neural networks and learning systems, 2378-2233.2 2021.
[67] Zhongxu Hu, Yang Xing, Weihao Gu, Dongpu Cao, and Chen Lv. Driver anomaly quantification for intelligent vehicles: A contrastive learning approach with representation clustering. IEEE Transactions on Intelligent Vehicles, 8(1):37-47, 2022.
[68] Geli Fei and Bing Liu. Breaking the closed world assumption in text classification. In Proceedings of the 2016 conference of the North American chopter of the association for computational linguisties: human language technologies, pages 506-514, 2016.
[69] Hao Lang, Yinhe Zheng, Yixuan Jian Sun, Fei Huang, and Yongbin Li. A survey on out-of-distribuue detection in nlp. arXiv preprint arXiv:2305.0 03236..03..... 2023.
[70] Ting Chen, Simon Komblith, Mohammad Norouzi, and Geoffrey Hinton. A simple framework for contrastive learning of visual representations. In International conference on machine learning, pages 1597-1607. PmLR, 2020.
[71] Yafu Li, Qintong Li, Leyang Cui, Wei Bi, Longyue Wang, Linyi Yang, Shuming Shi, and Yue Zhang Deepfake text detection in the wild. arXiv preprint arXiv:2305.13242. 2023.
13

---

[72] Yuxia Wang. Jonibek Mansurov, Petar Ivanov, Jinyan Su. Artem Shelmanov, Akim Tsvigun, Chenxi Whitehouse, Osama Mohammed Afzal, Tarek Mahmoud, Toru Sasaki, al. M4: Multi-generator. multi- domain, and multi-lingual black-box machine-generaled text detection. arXiv preprint arXiv:2305.14902 2023.
[73] Liam Dugan, Alyssa Hwang, Filip Trhlik. Josh Magnus Ludan, Andrew Zhu, Hainiu Daphne Ippolito. and Chris Callison- Burch. Raid: A shared benchmark for robust evaluation of machine-gennratee text detectors. arXiv preprint arXiv:2405.0799
2024.
[74] Guangsheng Bao, Yanbin Zhao, Juncai He, and Yue Zhang. Glimpse: Enabling white-box methods to use proprictary models for zero-shot Ilm ten-generated text detection, 2025.
[75] Diederik P Kingma and Jimmy Ba. Adam: method for stochastic optimization. arXiv preprint arXiv: arXiv:1412.666 1412.6980 2014.
[76] Mahnaz Koupaee and William Yang Wang. Wikihow: A large scale text summarization dataset. arXiv preprint 1XX::1810000305 2018.
[77] Dongyeop Kang, Waleed Ammar, Bhavana Dalvi, Madeleine Van Zuylen, Sebastian Kohlmeier, Eduard Hovy, and Roy Schwartz. A dataset of peer reviews (peerread): Collection, insights and nlp applications. arXiv preprint 8066055804. 2018.
[78] Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Anee Lachaux, Timothée Lacroix, Baptiste Rozière, Naman Goyal, Eric Hambro, Faisal Azhar, et al. Llama: Open and efficient foundation language models. arXiv preprint arXiv:2302. 2023.
[79] Hyung Won Chung. Le Hou, Shayne Longpre, Barret Zoph. Yi Tay, William Fedus, Yunxuan Li, Xuezhi Wang. Mostafa Dehghani, Siddhartha Brahma, al. Scaling instruction finetuned language models. Journal of Machine Learning Research, 25(70): 1-33, 2024.
[80] Nicolas Küchler, Emanuel Opel, Hidde Lycklama, Alexander Viand, and Anwar Hithnawi. Cohere: Managing differential privacy in large scale systems. In 2024 JEEE Symposiun on Security and Privacy (SP), pages 991-1008. IEEE, 2024.
[81] Yuxia Wang, Jonibek Mansurov, Petar Ivanov, Jinyan Su, Artem Shelmanov, Akim Tsvigun, Osama Mo- hammed Afzal, Tarck Mahmoud, Giovanni Puccetti, Thomas Amold, ct al. Semeval- task 8: Multido- main, multimodel and multilingual machine-generated text detection. arXiv preprint 244143300..4188 2024.
[82] Xiao Yu, Yi Yu, Dongrui Liu, Kejiang Chen, Weiming Zhang, Nenghai Yu, and Jing Shao. EvoBench: Towards real-world -.g-gerrrte text detection henchmarking for evolving large language models. In Wanxiang Che, Joyce Nabende, Ekaterina Shutova, Mohammad Taher Pilehvar, editors, Findings of the Association for Computational Linguistics: ACL 2025, pages 14605-14620, Vienna, Austria, July 2025. Association for Computational Linguistics.
14

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: Please check the result in Tables 1, 2,
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results be expected to generalize other settings.
is fine include aspirational goals as motivation as long is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification: Limitation & Future Works section.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those not discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification. asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low images are taken in low lighting. Or speech-to-text system might be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach address problems of privacy and faimess.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory assumptions and proofs
Question:
For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [Yes]
15

---

Justification:
Please check the Method in the main text and Theoretical proof in the supple-
mentary appendix.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification: Please check the dataset, evaluation metric and implementation detail in the main text and appendix.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution a specific model and empirical evaluation, it may be necessary either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of large language model), releasing of a model checkpoint, or other means that appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how reproduce that algorithm. (b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome deseribe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
16

---

Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Question:
Answer: [Yes]
Justification:
We will include our code in the supplemental material.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips.co cc/
for more details.
While we encourage the release of code and data, we understand that this might not be possible, "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (c.g., for a new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https
//nips //ipss.cc/pill wttp:ccppppcccceeeeeeeeee..c.ett httpa//gggeeee/eeeeeebiisssssss /Cc////oddiiisssseeeeeee ssiiiiiisiiiiyyyy for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended the paper) is recommended, but including URLs to data and code is permitted.
6. Experimental setting/details
Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary understand the results?
Question:
Answer: [Yes]
Justification: Please check each experimental section and appendix, we have a detailed description of each experiment setting.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, as supplemental material.
7. Experiment statistical significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [No]
Justification:
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for
example, train/test split, initialization, random drawing of some parameter, or overall with given experimental conditions).
17

---

The method for calculating the error bars should be explained (closed form formula, call a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
It should be clear whether the error bar is the standard deviation or the standard error of the mean.
is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that out of range (e.g. negative еттоr rates).
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of exccution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: Please check the implementation section in the main text.
Guidelines:
The answer NA means that the paper does include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental rums as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't It make it into the paper).
9. Code of ethics
Question: Does the research conducted the paper conform, in every respect, with the NeurlPS Code of Ethics https: httt:::///nurriiee ottpft/ttt//////orrr....cc/////t
Answer: [Yes]
Justification:
Guidelines:
The answer NA means that the authors have not reviewed the NeurlPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g.. there special consid- eration due to laws or regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive socictal impacts and negative socictal impacts of the work performed?
Answer: [No]
Justification: This work focuses on proposing a detection scheme for LLM LLM-generated text, the paper does elaborate societal impacts because the detection technology is explicitly designed for public welfare (curbing disinformation), and its design does not involve sensitive dimensions such as privacy or fairness (c.g.. no user data collection, no analysis of specific group differencee). Therefore, it does not involve significant societal risks at this stage.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
18

---

If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification:
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Are the creators or original owners of assets (e.g.. code, data, models), used in the paper, properly credited and the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [NA]
Justification:
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset used and, possible, include URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
19

---

If assets are released, the license, copyright information, and terms of use in the thcode has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
package should be provided. For popular datasets, paperswi
latasets.paperssi
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
If this information not available online, the authors are encouraged to reach out to the asset's s creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification:
We will release the weight in our experiments.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/moodl as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsoureing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [No]
Justification:
Guidelines:
The answer NA means that the paper doess not involve crowdsourcing nor research with human subjects.
Including this information the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based the requirements of your country institution) were obtained?
Answer: [NA]
Justification:
Guidelines:
The answer NA means that the paper does not involve crowdsourcing research with human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
20

---

We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors adhere the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
16. Declaration of LLM usage
Does the paper describe the usage of LLMs if it is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, formatting purposes and does not impact the core methodology, scientific rigorousness, or originality of the research, declaration is not required.
Question:
Answer: [NA]
Justification:
Guidelines:
The answer NA means that the method development in this research does not involve LLMs as any important, original, or non-standard components.
Please refer to our LLM policy (https: /ttpps////eurpss.... /ctp////eeeeeeecc///22/////// for what should or should be described.
21

---

Contents
Introduction
2
Related Works
Methods
3.1
Problem Reformulation: Why Binary Classification Fails for Human Text Detection?
3.2
Method Overview: OOD Detection Framework for Machine-Generated Text
3.3
Alternative OOD Detection Losses: HRN and Energy-Based Methods
3.4
Overall Training Objectives
Experiments
Experimental Setup
Main Results
4.3
Experimental Analysis
Conclusion
10
Proof of Theoretical Results
23
Preliminaries
23
Proof of Theorem
23
A.3 Analysis of the Pearson Divergence
24
A.4
Alternative View: Binary Classifiers Overtit to Slightly Defected Datasets
24
Detail of Experimental Setup
27
B.
Datasets
27
B.2
Baseline Setup
27
B.3
Implementation Detail
28
More Experimental Results
28
Hyper-parannn Sensitivity Analysis
28
More Metrics
29
Different Backbones
29
Results Difterent Domains
29
Results on Newer Models
29
C.6 Results of LLM LLM generated Text as OOD Sample
30
Effects of and
30
Training and Inference Cost
30
imitation and Ethical Statement
30
22

---

A Proof of Theoretical Results
In this section, we provide formal justification for Theorem 2 discuss the magnitude of Pearson x² divergence, and provide an alternative theorem to further characterize the inevitability of overfitting binary classifiers to biased human-writte text distributions.
A.1 Preliminaries
We use integral Jaex - dx to equivalently denote integral or summation over the data space X. For the ground truth classifier Pas (1), we introduce the following auxiliary definitions to assist the writing:
Pa (x) 1 (x)
Ply 1|z) : PH ply 0|2) := (z).
Towards a proof of the theorem, we first analyze the cross-entropy loss LCE:
LCE (fo (o) (D) qas Eer [logpo =)] q# En log = 1 x]]
= -- Jxex
9 (MPM(()) (oP p x)) + qu (a log (=)))ool = 1 dr
ffre J
Pas (ar(x)) log po = x) + (1 - PAs (z)) log loy = 1 x) Po(æ) dr
-
/ ((((-1z),, Po P())) dx,
(11)
JOEx
where the third equality comes from Assumption I Po(x) qu Par(x) + 9H (H denotes the joint probability at of dataset D. and H((--) denotes the cross-entropy between two distributions. From the properties of cross-entropy, this minimized when p = po, i.e. when the model predictions exactly match the ground truth, with minimal value
min Loe (fo D) = EL
(12)
8
We also formally define The Pearson x² divergence below for future reference.
Definition 3. For two distributions Pt, P2 over set X. the Pearson x² divergence between P1 and Pa is defined as
(P((x) - Pp(x))2 dr dr= / Pf(x) dx - (13)
De2 (P
JEEX
P2(x)
JOEX P2(x)
A.2 Proof of Theorem 2
The basic idea behind this proof to find classifier fo that properly accentuates the difference between data distributions D and D, ensuring bounded suboptimality on the training set D while maximizing suboptimality on the real-world set D. This is achieved through relatively enlarging the errors in regions where DD has lower density compared to D and vice versa, hence blowing up the loss measured under D compared to D.
Proof of Theurem From
Let (x) H(F((1z) - (F(-(z)) be the suboptimality of So at x.
(cE(JolD) (2- /
| ((x))o(x)dr, dr,
(14)
/ ((x) (x)
Lce(Je (D - -B2-57
(15)
Since cross-entropy is unbounded for pe(- given any f(-1z), we can choose classifier fo such that ((z) = Ao x (r(x))/D(r) for any E X' given a target suboptimality Ag. With this we have the training suboptimality
((x)
AoPo(x) de = Ao.
ZEX
DEX
23

---

while the loss ground truth dataset D is
/ JEEX A ((x))
dr f
(x(2)
Do
Pb(x) dr
DEX
PM) 9H (x)) ( dr.
= A
(16)
NEN
Now notice that from Assumption
[ the ratios
4M Pas(2) 9M (M))
PMr
9H Pz())
4H (z))
(x)
therefore we can write (66 as
J
PM(a)
+1) (H(#)
(f((1) dæ 911 Pи (x)
A(x) dz = Du
JEE
DEE
P2 (x) (H(
2 Ao
dæ
TEX
qu Do Dx2 (PH PPH) 1/.
thus finishing the proof.
A.3 Analysis of the Pearson x² Divergence
The effectiveness of Theorem depends the magnitude of the Pearson X² divergence Dya Pir| PHr): the larger this divergence, the larger the cross-entropy loss for linear classifier well-fitted to the training set. Here we relate this value to the intuition that the training human-text data distribution is biased and cannot reflect open- distribution.
We model the intuition of "open-world" distribution PH by considering training distribution PH that is a shifted biased distribution of PH. More concretely, this means that there is a subset 2o of X, such that
(x) (H)))) No. C2PH(F), No.
where C1, C2 are constants such that C1p (2)) + C2 1-, 1 [Xnn
and C1 > Cz. and Pra denotes the measure with respect to PH. Such a distribution follows the same probability ratios as Ph within and without Xo respectively, but is very close to 0 outside Xg. hence most of the samples come from the partial region Xo. This is of course only approximation of realistic scenario, but it captures the essence of training data being only a partial observation of the whole picture. With this, the Pearson x2 divergence
Dx² (Pnl(P)) = / PH(()
de -
ZEX Pn(x)
=f
Pn(x)d +
1
1
P
JZEN, Ci
JEEN
C2
PB (No)
1 1 1b (Rt)
C1
C2
which blows up to infinity inverse-linearly as C2 + 0, corresponding to the likely case where the dataset is heavily biased towards a partial region of the text data space.
A.4 Alternative View: Binary Classifiers Overfit to Slightly Defected Datasets
While theoretically reasonable, Assumption D usually does not hold for many data distributions, For example, if a training human-text distribution consists only of one "style" of texts, then the probability

---

that some human-texy x" of another style is sampled from this distribution would be close to 0, even smaller than the probability that is sampled from the machine process, i.c. Pn < PM (2*)) This leads to violation of Assumption [ in that the Bayes probability that x" is does not match Par( In this scenario, binary classifiers actually can overfit to the training dataset and fail to generalize by a nonzero gap-
To illustrate this, we characterize this dataset defect in the following definition in place of Assump- tion
Definition 4, For a machine-human text data distribution D {4qx,, qu, PM., PH ). define its poste- rior binary classifier be
9M (x) 9M PM + 98 (x:) 9u PH (x:)
PD(y 1|x)
PDly = 0/æ) (MPM(()) + q (x)
We define the kwality of D as
K(D) := En (pt1z))
which measures the expected KL-divergence between pD and 6 over joint text distribution Pb(z)- 9M Pas (z) + qu PH (x), and say dataset 'D is 6-suboptimal if its kwality K(D) < 6.
Remark 5. A few things are worthy of note:
When the posterior distribution pp + P. kwality reaches its minimum value while higher kwality values correspond to deviations in labeling and hence degradation of dataset.
The idea behind this definition is that, realistically we cannot expect the training dataset to perfectly accurate, and kwality more or less measures the deviation of the model from the ground truth classifier.
The expectation in kwality is taken over text distribution P(z). which means mislabeling data in sparser text regions are less detrimental to kwality than denser regions. This aligns with the fact that sparse regions contain less data points within the sampled dataset, where accuracy cannot be guaranteed, but also warrants less attention from the learning model.
Our main result is that fully training models on a near-optimal dataset lead overfitting, and result in large validation loss on open open-world data distribution.
Theorem 6. There exists a d-suboptimal dataset D such that for any binary classifier that achieves optimal cross-entropy loss on D, the generalization loss on open-world dataset which complies with p (Assumption 1b is least x2 (Po) Pp).
Proof. From optimal cross-entropy loss, we get from
11 that
0 = LCF LcF D) E.. (
= =f -xEX
H H(po(1o)) - H(po(11x)) Po(x) de,
which means for any x E X,
H (pp(-1a) pa(-(z)) = H((p((11)) + po(-1x) pD(-
Now consider the generalization loss:
(CE(folD) H
/ (((((1))))P(((2z)) ((x(-12)) Pz dx
DKL. D dr,
DEX
25

---

Since KL-divergence is unbounded, we can choose P(-(ar) for each x DKL [T< = ( which guarantees K (D) = 6, while
X' such that
(
CcE(folD) - - 2
dx = 6D (Pp Pg). xEE Po(c)
8%
26

---

B
Detail of Experimental Setup
B.1 Datasets
In this section, we discuss more details of our dataset in our experiments.
DeepFake. The Deepfake dataset comprises text generated by 27 large language models (LLMs) alongside human- content sourced from multiple websites across 10 distinct domains, totaling 332K training and 57K test samples. It defines six diverse evaluation scenarios, including cross-domain, unseen domain, and model detection setting. In our main experiment, we use the cross-domain and cross-model setting, which includes various domains and models both the training and testing set. For the generalizability validation experiments, utilize the Unseen Domains and Unseen Models of DeepFake, where the former setting means there are unseen-domal texts in the testing set and the latter setting indicates that there are texts generated by unseen LLMs during testing.
M4. The M4 dataset is a comprehensive benchmark spanning multiple domains, models, and languages, comprising data from 8 large language models (LLMs), 6 domains, and 9 languages. It includes human-written content sourced from platforms such as Wikipedia, WikiHow (76), Reddit, arXiv, and PeerRead (7). Leveraging numan-authoree prompts, models including ChatGPT [.. Da DaViniii003, LLaMA 778.. FLAN-TS 77)), Cohere [80] and so generate outputs across nine languages, including English, Chinese, and Russian. As part of the M4 initiative, a competition [8]] is organized to evaluate the detection of Al-generated text at both the paragraph and sentence levels. Two evaluation settings used: monolingual and multilingual. The multilingual setting introduces new languages absent from the training and validation sets, with Al-generated texts also undergoing paraphrasing. We focus on multilingual setting since this is more complicated and hard setting for correct LLM detection. The multilingual settings includes 157K training and 42K testing data. The test dataset of M4 also includes the unseen models from the training set.
RAID. RAID 73 is the largest and most comprehensive dataset available for evaluating Al-generated text detection systems. It comprises over 10 million documents, encompassing 11 large language models (LLMs), 11 content genres, decoding strategies, and 12 types of adversarial attacks. The detailed information of RAID dataset can be found in Table [ We hold out 10% of training data validation set for evaluation, which includes the texts with all kinds of attacks. We utilize the RAID dataset to compare the robustness different methods on the attacked texts. During training, we filter the attacked samples in the training set to train the model.
Category Models
Values
ChatGPT, GPT-4, GPT-3 (text-davinci-003) GPT-2 XL, Llama 2 70B (Chat). Cohere, Cohere (Chat), MPT-30B, MPT-30B (Chat), Mistral 7B,
Mistral 7B (Chat)
Domains
ArXiv Abstracts, Recipes, Reddit Posts, Book Summaries, NYT News
Articles, Poetry, IMDb Movie Reviews, Wikipedia, Czech News, Ger-
man News, Python Code
Decoding Strategies
Greedy (T=0), Sampling (T=1), Greedy Repetition Penalty (T=0, 0=1.2), Sampling + Repetition Penalty (T=1, 0=1.2)
Adversarial Attacks
Article Deletion, Homoglyph, Number Swap, Paraphrase, Synonym Swap, Misspelling, Whitespace Addition, Upper-Lower Swap, Zero-
Width Space, Insert Paragraphs, Alternative Spelling Table 4: RAID dataset composition. The table includes the information about the models, domains, decoding strategies, and adversarial attack kinds.
B.2 Baseline Setup
In this section, we discuss the details of the experiments setup on baseline models including zero- shot and trining-based baselines. For DetectLLM, DetectGPT, DNA-GPT and FastDeteetGPT, we
27

---

Hyper-parameter Sensitivity
HRN Hyper-parameter Sensitivity
Energy Hypar Sensitivity
AUROC
AUROC
AUROC
0.8
0.8
0.8
AUPR
AUPR
AUPR
Value
FPR95%
Value
FPR95%
Value
0.6
FPR95%
0.4
0.4
0.4
0.2
0.2
0.2
Ratio
Ratio
Ratio
(a) DeepSVDD
(b) HRN
(c) Energy
Figure 3: Hyper-paramett sensitivity analysis of our method. The experiments are conducted on DeepFake dataset and show that our method is robust to the choice weight.
utilize the official implementation of FastDectGPP1 which also includes the implementation of other methods. We utilize GPT-Neo-2.7B the scoring model for all methods. T5-Small is used as the sampling model to do perturbation for DetectGPT and DetectLLMM. We do 100 perturbation for each text. Due to the low speed of perturbation, we randomly select 10K samples from each benchmark for evalution for DetectLLM, DetectGPT and DNA-GPT. For DALD, we use the LoRA model trained by GPT-4 texts (which is demonstrated with the best generalizability
the original paper) based on Llama-2-7B as the scoring model. We follow the same experimental setting of Binoculars and apply the Falcon model to compute the final metric. For Glimpse, we utilize the official implementation and call OpenAI davinci-002 API to compute the geometric metric.
For training-basee -baeed method, such as GPT-Zero, we utilize the open-source version for evaluation For RADAR and GhostBuster, we apply their official implementation for testing with the updated OpenAl API model. Moreover, we adopt the official open-source implementation of BiScope and utilize gemma-2b as the scoring model.
B.3 Implementation Detail
We adopt three OOD detection methods including DeepSVDD, HRN and Energy- methods for experiments. For DeepSVDD, we the machine texts from the training to compute the initial center and compute the corresponding loss with the center. We freeze the parameters the center point and disable the optimization the center point. During inference, of the given sample and the center point as the probability of being human- wrrtten text. For HRN, follow its original setting by training one-class classifier per model family using its corresponding data as the positive class and averaging their scores at inference time. We also follow the original perrpaaraeeter settings, where À 0.1 and head is attached following the backbone model. We follow [88 to choose hyper-parameters where min -27 and Mout -5. DeepSVDD is trained from scratch, and HRN and Energy load the pre-trained weights of DeTeCtive. The learning- caate is set as 2e-5 with batch size 32 per device (64 global batch size in our experiments), and the optimizer is Adam (75) with
compute the L2 distance
12. For energy-based method, classification
0.9 and 83 0.98. The loss weights a and / are set as in our experiments. We train all model for 20 epochs. All experiments are conducted on A00 GPUs.
C More Experimental Results
C.1 Hyper-parameter Sensitivity Analysis
For the hyperparameter introduced by the DeepSVDD, HRN and Energy-based -based method, we the default setting from their original paper. In our work, the hyperparameter we introduce is the ratio of contrastive loss and OOD detection loss, namely the OOD loss. We conduct set of experiments with different the loss ratio settings on DeepFake
This ratio balances the contrastive loss and
28

---

Table 5: Performance comparison with the baseline evaluation metrics including accuracy and score.
RAID
Method
Accuracy
FIf
DeTecCtive
96.5
55.2
Ours (DSVDD)
98.6
70.0
Ours (HRN)
98.5
67.7
Ours (Energy)
98.7
99.4
Table 6: Different backbone model.
Backbone Model
AUROC1 + AUPR
FPR95
BERT base
96.9
96.7
13.0
BERT large
93.1
94.1
45.3
RoBERTabbsse
96.1
96.5
16.1
FLAN-T5, bae
95.3
95.6
18.9
FLAN-T5, Jurge
96.9
96.5
9.7
BE-TBERTTa base
96.8
96.9
17.7
SinCSE-RoBERUaaee RoBERTapuse
98.3
98.3
8.9
E5-small
96.7
97.5
11.4
E5- 45--muttlingual
96.6
96.6
12.5
Overall, the results are stable and robust to the choice of weight. Ratio 1: is a great choice which balanced well for all methods and metrics.
dataset and the results are shown Figure 3
C.2 More Metrics
Besides the AUROC, AUPR and FPR at TPR 95%, we also provide other metrics including the accuracy and Fl score for the comparison. We conduct the experiments RAID dataset and report the results in Table 5) All settings of our method achieve better performance than the baseline on both accuracy and Fl. Our energy-based method shows significant improvement, obtaining 98.7 and 99.4 on accuracy and F1, respectively.
C.3 Different Backbones
To show the affection the backbone model for the LLM detection performance, we conduct a further experimental analysis with different training backbones DeepFake dataset, shown in Table 6
We can observe that our method robust to the choice of model backhone. All models generate reasonable results which high AUROC, AUPR and low FRP values.
C.4 Results on Different Domains
We provide the results of model trained within specific domain DeepFake dataset in DeepSVDD setting, as shown in Table 7 These strong per-domain performances indicate that the model effectively distinguishes LLM vs. human text within individual domains, further supporting the validity of our OOD formulation.
C.5 Results on Newer Models
We split the RAID test set isolate newer models such as GPT-4, ChatGPT, LLaMA-OBB and additionally evaluated our method on recent benchmark, EvoBench [82], using the XSum dataset with GPT-4o outputs, as shown Table the model on RAID dataset and evaluate directly on RAID subset and GPT-4o set. These results show that our method maintains strong performance even on outputs from state-of-the-ar models, demonstrating its effectiveness beyond older-generation LLMs.
apply our DeepSVDD setting to train
29

---

Table 7: Results on different domains.
Domain
AUROCT
AUPRI
FPR95
cmv
97.9
98.3
6.7
cli5
97.1
97.7
12.9
hswag
98.3
97.8
5.0
roct
97.6
96.5
6.0
scigen
98.7
98.3
4.0
squad
99.3
99.2
2.9
tldr
97.7
97.7
8.4
wp
99.5
99.5
0.4
xsum
97.7
98.0
7.0
yelp 97.2
97.0
10.6
Table 8: Results newer models.
Methods
AUROC AUPR
FPR95
DeTeCCtive (RAID subset)
87.2
83.2
79.7
Ours (RAID subset)
93.2
74.7
39.1
DeTeCtive (GPT4o)
74.7
87.3
90.2
Ours (GPT4o)
100.0
100.0
0.0
C.6 Results of LLM-generated Text as OOD Sample
Table 9: Results of LLM-generated Text OOD Sample.
Methods
AUROC1
AUPR
FPR95
LLM OOD
69.6
67.7
79.1
Human as OOD
93.8
94.1
33.7
We provide the result of setting machine-genete generated text as OOD, as shown in Table 9 The results are trained DeepSVDD and Deepfake dataset without contrastive loss. The strong performance of text as OOD indicates that modeling human text as OOD is a valid and effective formulation.
C.7 Effects of a and B
We will provide the results when and 3 are set to 0 in DeepSVDD setting, shown in Table 10 Without OOD loss (3 = 0), the AUROC degraded to 88.6 while with only OOD loss, the AUROC achieves 93.7 and the FPR at 95% obtains 33.7, demonstrating the importance of OOD loss.
C.8 Training and Inference Cost
We provide the training and inference cost comparison of our method and baselines, as shown in Table [T] The time of training and inference evaluated single 4090 GPU. The backbone use is haap--simmce--obera--bbbae
For the training time, the training time per epoch is similar to the DeTeCtive baseline since share the same backbone model and the difference is the loss objective. However, our method leads to faster convergence, which reduces the overall training cost compared with DeTeCtive. For the inference, our method is also the fastest since FastDetectGPT requires LLM inference (such as GPT-Nco-2.7B), which needs 10 x more computation and DeTeCtive needs database construction and KNN for searching, which brings extra inference time.
C.9 Limitation and Ethical Statement
In this paper, we theoretically and empirically analyze why and how to model LLM text detection task as the distr--diittibutionn detection task. However, current detection can only tell whether the given text is AI- Al-generated or human-written which lacks further interpretation about how the text is
30

---

Table 10: Effects of a and [3.
Parameter Setting
AUROC1 t
AUPRI
FPR95
8
88.6
93.5
76.1
93.7
94.1
33.7
a 1,
==
98.3
98.3
8.9
Table 11: Training and inference cost of different methods.
Method
Training Time per Epoch
Overall Training Time Inference time
GaT
N/A
N/A
72 min
DeTeCtive
0.67 h
20 h (30 epoch)
29 min
Ours
0.67 h
3.3 h (5 epoch)
4 min
generated by LLM. Therefore, hope the user uses the detection result reference and doesn't 't make decisions solely based on the detection results, especially in areas such as academia.
31


Reviews:
[{"review_id": "kai0911ZSb", "reviewer": "Reviewer_mbi1", "summary": "Paper propose a methods for detecting LLM generated text. The proposed approach formulates LLM generated text detection as a single class out-of-distribution detection problem, where human-written texts is treated distributional outliers while machine-generated texts are treated as in-distribution data. Existing work often formulate it is a binary classification problem. Author show theoretically limitations in  binary classifier for human-written text distribution particularly ability to generalize. Proposed approach is implemented using three variants of Single class learning methods. All of them showed better accuracy then using a binary classification head and loss on same network. Proposed approach is benchmarked on 3 different datasets and show better performance. Approach also has ability to generalize to unseen domain and text generated from unseen models.", "questions": "1. some theoretical/empirical justification of considering human generated text as OOD v/s machine generated text as OOD will help\n2. benchmarking gain from adding OOD loss to contrastive loss or removing contrastive loss completely can inform better if the gains is from single class modeling or improving contrastive loss with another loss term that constraints intra-class embeddings for machine generated text?", "limitations": "NA", "rating": 4, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Major Strength:\n1. Author provide theoretical and empirical confirmation on why binary loss and classification can be incomplete for training a generalizable  LLM generated text detector. Improvements in Table 3, show significant gain w.r.t binary classification.\n2. Method if fairly novel. It is common to use one-class detector for detecting machine generated audio, image and video (e.g. R1, R2). However, work is limited on LLM generated text on this. Also, typically existing methods fit bonafide/real media and consider machine generated media as OOD data. However, this approach does it other way around. Which make intuitively some sense specifically for text domain where approaches are mostly autoregressive and based on similar training loss and architecture.\n3. Performance is competitive, author compared with enough baselines and ran benchmark generalizability of method.\n\nMajor Weakness:\n1. No empirical or theoretical evidence is provided about a difference in choice from existing work. That is setting human generated text as OOD and not machine generated text as OOD. \n2. While author formulate problem as single class, from equation 6 and equation 10 i.e. L_contrastive loss it seems author use both human and machine generated text during training. Since the loss weights α and β are set as 1 in main experiments, the contrastive loss (binary classification loss) also play equal role in training. Hence, it would be good to understand performance of method with β set to 0 to truly understand if the gains are from single class modeling or augmenting contrastive loss with another loss that constraints intra-class embeddings for machine generated text. In supplement Figure 3, author show metrics remaining same for different ratio of alpha:beta however adding ablation for β =0 and α =0 will help.\n\n\nR1: https://arxiv.org/pdf/2406.16716 (InterSpeech 2024)\nR2: K. Lee, Y. Zhang and Z. Duan, \"A Multi-Stream Fusion Approach with One-Class Learning for Audio-Visual Deepfake Detection,\" 2024 IEEE 26th International Workshop on Multimedia Signal Processing (MMSP), West Lafayette, IN, USA, 2024, pp. 1-6, doi: 10.1109/MMSP61759.2024.10743671", "was_revised": true, "final_justification": "Author have addressed both of my concerns, ablation support authors modeling human text as OOD and impact of OOD loss on improving performance. I am more confident with my recommendation now.", "rebuttal": "Thank you for your detailed review. To address your concern, we would like to provide the response to your reviews:\n\n> W1: No empirical or theoretical evidence is provided about a difference in choice from existing work. That is setting human generated text as OOD and not machine generated text as OOD.\n\nThanks for the suggestion. We provide the result of setting machine-generated text as OOD:\n\n| **Methods**    | **AUC_ROC** | **PR_AUC** | **FPR-95%** |\n|----------------|:-----------:|:----------:|:-----------:|\n| machine as OOD |        69.6 |       67.7 |        79.1 |\n| human as OOD   |        93.8 |       94.1 |        33.7 |\n\nThe results are trained on DeepSVDD and Deepfake dataset without contrastive loss. The strong performance of human generated text as OOD indicates that modeling human text as OOD is a valid and effective formulation.\n\n> W2: While author formulate problem as single class, from equation 6 and equation 10 i.e. L_contrastive loss it seems author use both human and machine generated text during training. Since the loss weights α and β are set as 1 in main experiments, the contrastive loss (binary classification loss) also play equal role in training. Hence, it would be good to understand performance of method with β set to 0 to truly understand if the gains are from single class modeling or augmenting contrastive loss with another loss that constraints intra-class embeddings for machine generated text. In supplement Figure 3, author show metrics remaining same for different ratio of alpha:beta however adding ablation for β =0 and α =0 will help.\n\nWe will provide the results when $\\alpha$ and $\\beta$ is set to 0:\n\n| **Methods**               | **AUC_ROC** | **PR_AUC** | **FPR-95%** |\n|---------------------------|:-----------:|:----------:|:-----------:|\n| $\\beta$ = 0               |        88.6 |       93.5 |        76.1 |\n| $\\alpha$ = 0              |        93.7 |       94.1 |        33.7 |\n| $\\beta$ = 1, $\\alpha$ = 1 |        98.3 |       98.3 |         8.9 |\n\nWithout OOD loss ($\\beta$ = 0), the AUC_ROC is degraded to 88.6 while with only OOD loss, the AUC_ROC achieves 93.7 and the FPR at 95% obtains 33.7, demonstrating the importance of OOD loss.\n\n> Q1: some theoretical/empirical justification of considering human generated text as OOD v/s machine generated text as OOD will help\n\nThank you for your question. We have already provided the results comparison of  human-generated text as OOD and machine-generated text as OOD in W1. Please have a check.\n\n> Q2: benchmarking gain from adding OOD loss to contrastive loss or removing contrastive loss completely can inform better if the gains is from single class modeling or improving contrastive loss with another loss term that constraints intra-class embeddings for machine generated text?\n\nWe have provided the results of different loss choice in W2. Please have a check.\n\nWe hope our responses adequately address all your concerns. If you have any further questions or feedback, we would be glad to continue the discussion during the discussion phase."}, {"review_id": "gOW2wLlX7z", "reviewer": "Reviewer_VQzR", "summary": "This paper reframes the task of distinguishing human-written from machine-generated text as an out-of-distribution (OOD) detection problem rather than a binary classification task. This is motivated by the theory that the human text distribution is not simply a single distribution due to the way that linguistics works. The authors argue that instead, the LLM distribution should be viewed as a single distribution, with human text distributions being \"out-of-distribution\". This leads to a novel framework for LLM text detection based on OOD detection methods, and a supervised method is developed. Experimental results on a suite of benchmark LLM text detection datasets is provided to support the method.", "questions": "See weaknesses.", "limitations": "yes", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 2, "originality": 3, "strengths_and_weaknesses": "Strengths:\n- Reformulating LLM text detection as OOD rather than binary classification is a compelling conceptual shift that aims to provide a more fine-grained assumption on human and LLM text distributions. Prior works may be too simplistic in their assumptions by assuming that there is an all-encompassing human text distribution and corresponding LLM text distribution. \n- the performance is good on the benchmarks provided, which are extensive. These help support that the OOD framework and method are effective and successful in solving the OOD problem.\n\nWeaknesses:\n- While the authors provide experiments supporting their method, some of the intuition provided could benefit from some experiments that demonstrate the validity of the assumptions. For example, the OOD framework and modeling the LLM text distribution as \"in-distribution\" could benefit from some plots demonstrating that this is indeed the case in practice. My understanding is that Figure 1 is not a visualization of text embeddings on real data. If a figure demonstrating, say, the text embeddings of LLM texts and different human texts (say, coming from different domains or writing patterns) was shown, this would help support the OOD hypothesis. This could help clarify whether textual domain shift or human/LLM writing is the primary cause for a distribution shift. Right now it seems the authors argue that all LLM text across various domains can be viewed as in-distribution, whereas human text distributions are more varied.\n- Building on the previous point, I think some experiments regarding domain vs. human/LLM should be provided. My understanding is that the LLM-written parts of the training splits of the datasets are used to train the models. But if further splits across domains could be provided, that would be helpful to understand the method.\n- Is there a zero-shot variant based on the OOD framework that could be developed? The training of such detectors can present obstacles to future times when stronger and higher-performing LLMs are developed.\n- A brief comparison of training/inference time or parameter counts versus baselines would be helpful to understand there performance/complexity tradeoffs, which is another practical concern when deploying such detectors. \n- Recent focus has shifted to edited LLM texts, or partial human/LLM text. This is a more accurate representation of how LLM texts are used in practice. It would be interesting to see how the method would work on such data.", "was_revised": true, "final_justification": "The authors have addressed my overall concerns, and I will keep my positive score.", "rebuttal": "Thank you for your concrete comment and suggestion. To address your concern, we would like to provide the response to your reviews:\n\n> W1: While the authors provide experiments supporting their method, some of the intuition provided could benefit from some experiments that demonstrate the validity of the assumptions. For example, the OOD framework and modeling the LLM text distribution as \"in-distribution\" could benefit from some plots demonstrating that this is indeed the case in practice. My understanding is that Figure 1 is not a visualization of text embeddings on real data. If a figure demonstrating, say, the text embeddings of LLM texts and different human texts (say, coming from different domains or writing patterns) was shown, this would help support the OOD hypothesis. This could help clarify whether textual domain shift or human/LLM writing is the primary cause for a distribution shift. Right now it seems the authors argue that all LLM text across various domains can be viewed as in-distribution, whereas human text distributions are more varied.\n\nAs NeurIPS does not permit the inclusion of PDFs or anonymous external links in the rebuttal this year, we apologize in advance that we are unable to provide annotated figures or visual (such as t-SNE of embeddings) clarifications. We hope our written explanations are sufficiently clear, and we are happy to incorporate this additional clarification in the final version. For this question, we can provide the inter- and intra-LLM and human text cosine distance across diverse domains:\n\n| **Metric**           | **Dist** |\n|----------------------|----------|\n| Intra-distance LLM   |   0.3014 |\n| Intra-distance human |   0.4747 |\n| Inter-distance       |   1.6048 |\n\nWe compute the average cosine distance on the Deepfake dataset, which contains domains such as cmv, xsum, eli5 and so on, and LLMs including GPT-3.5-turbo, GLM-130B, Bloom-7B and so on. The embedding backbone we use is RoBERTa pretrained with contrastive loss. The results show that the Intra-distance of LLM is smaller than the human while the inter-distance between human and LLM is relatively large, supporting our OOD hypothesis that LLM text forms a coherent in-distribution cluster, while human-written texts—spanning varied styles and domains—act as natural OOD examples. We hope this can address your concern.\n\n\n> W2: Building on the previous point, I think some experiments regarding domain vs. human/LLM should be provided. My understanding is that the LLM-written parts of the training splits of the datasets are used to train the models. But if further splits across domains could be provided, that would be helpful to understand the method.\n\nYes, thanks for the suggestion, we provide the results of model trained within specific domain:\n\n| **Domain** | **AUC_ROC** | **PR_AUC** | **FPR-95%** |\n|------------|:-----------:|:----------:|:-----------:|\n| cmv        |        97.9 |       98.3 |         6.7 |\n| eli5       |        97.1 |       97.7 |        12.9 |\n| hswag      |        98.3 |       97.8 |         5.0 |\n| roct       |        97.6 |       96.5 |         6.0 |\n| sci_gen    |        98.7 |       98.3 |         4.0 |\n| squad      |        99.3 |       99.2 |         2.9 |\n| tldr       |        97.7 |       97.7 |         8.4 |\n| wp         |        99.5 |       99.5 |         0.4 |\n| xsum       |        97.7 |       98.0 |         7.0 |\n| yelp       |        97.2 |       97.0 |        10.6 |\n\nThese strong per-domain performances indicate that the model effectively distinguishes LLM vs. human text within individual domains, further supporting the validity of our OOD formulation.\n\n> W3: Is there a zero-shot variant based on the OOD framework that could be developed? The training of such detectors can present obstacles to future times when stronger and higher-performing LLMs are developed\n\nWe would like to first thank the reviewer for providing such an insightful and constructive proposal. It is indeed pretty interesting to extend our out-of-distribution detection framework to zero-shot methods. However, it is non-trivial and challenging to simply apply our current framework to zero-shot methods. The reason is that the current OOD detection methods generally require supervised (one-class) training, which is not compatible with current metric-based zero-shot methods. Nevertheless, we believe the idea behind our method, namely considering the human-generated texts as OOD data, can help to design novel statistic metrics for zero-shot methods, for example, help to find the best metric threshold in the zero-shot methods.\n\n> W4: A brief comparison of training/inference time or parameter counts versus baselines would be helpful to understand the performance/complexity tradeoffs, which is another practical concern when deploying such detectors.\n\nThank you for you suggestion. We provide the training and inference cost comparison of our method and baselines:\n\n| **Method**    | **Training Time per Epoch** | **Overall Training Time** | **Inference time** |\n|---------------|-----------------------------|---------------------------|--------------------|\n| FastDetectGPT | N/A                         | N/A                       | 72min              |\n| DeTeCtive     | 0.67h                       | 20h (30 epoch)            | 29min              |\n| Ours          | 0.67h                       | 3.3h (5 epoch)            | 4min               |\n\nThe time of training and inference is evaluated on single 4090 GPU. The backbone we use is  unsup-simcse-roberta-base. For the training time, the training time per epoch is similar to the DeTeCtive baseline since we share the same backbone model and the difference is the loss objective. However, our method leads to faster convergence, which reduces the overall training cost compared with DeTeCtive. For the inference, our method is also the fastest since FastDetectGPT requires LLM inference (such as GPT-Neo-2.7B), which needs 10 $\\times$ more computation and DeTeCtive needs database construction and KNN for searching, which brings extra inference time.\n\n> W5: Recent focus has shifted to edited LLM texts, or partial human/LLM text. This is a more accurate representation of how LLM texts are used in practice. It would be interesting to see how the method would work on such data.\n\nThanks for raising this up. We want to clarify that the test set RAID used in our experiments has already included the attacked data including paraphrase, insert paragraphs and so on. Moreover, we would like to provide the results comparison with baselines on test set with only attacked text from RAID:\n\n| **Attack-only RAID** | **AUC_ROC** | **PR_AUC** | **FPR-95%** |\n|----------------------|:-----------:|:----------:|:-----------:|\n| DeTeCtive            |        81.9 |       72.0 |        86.0 |\n| Ours                 |        96.1 |       70.2 |        19.8 |\n\nOur method achieves a substantially higher AUC_ROC and significantly lower FPR-95% compared to the baseline, indicating strong robustness on edited or partially human-generated text.\n\n\nWe hope our responses adequately address all your concerns. If you have any further questions or feedback, we would be glad to continue the discussion during the discussion phase."}, {"review_id": "xWSe0TVvnf", "reviewer": "Reviewer_twCw", "summary": "The paper argues that treating AI-text detection as a binary human vs. machine task is theoretically unsound because human writing is an open-world, highly heterogeneous distribution. It therefore reframes the problem as out-of-distribution (OOD) detection: model only the in-distribution (ID) machine-generated manifold and flag any deviation as human-authored. Concretely, the authors instantiate three OOD objectives—DeepSVDD, HRN, and Energy-based scoring—on top of a RoBERTa encoder and combine them with a supervised contrastive term. Extensive experiments on DeepFake, M4-multilingual and RAID show large gains (e.g. 98.3 % AUROC, 8.9 % FPR95 on DeepFake) over zero-shot and supervised baselines, with additional analyses for multilingual, adversarial and unseen-domain/model settings. Practical guidance on when to choose each loss is provided.", "questions": "See Weaknesses.", "limitations": "NA", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 3, "significance": 3, "originality": 2, "strengths_and_weaknesses": "Strengths:\n1. Clear theoretical motivation. Theorem 2 formalises why binary classifiers overfit when human heterogeneity is large.\n2. Casting detection as one-class/OOD aligns with the asymmetric data geometry illustrated in Fig. 1 and avoids modelling an unbounded human space.\n3. All three OOD losses surpass prior detectors across AUROC, AUPR and FPR95 on three benchmarks.\n\nWeaknesses:\n1. One-class/OOD ideas have a long history in NLP anomaly detection; related work could cite and empirically compare to prior one-class text detectors.\n2. The χ²-divergence in Theorem 2 is not empirically estimated, so the link between theory and practice remains qualitative.\n3. Encoder choice fixed to RoBERTa. How would results change with more recent lightweight or multilingual encoders?\t\n4. How sensitive are DeepSVDD radius or energy margins to training-set size?", "was_revised": true, "final_justification": "My major concern is the limited novelty. After reading the manuscript, I found this paper is essentially a incremental or combinational work, where all the parts of the proposed method originates from the estabilished literature without any specific modification tailor to LLM-generated text detection. Even if considering this paper as a benchmarking paper, it seems insufficient for the authors to only evaluate two OOD detection losses. This raises several questions that is unanswered in the manuscript:\n\nwhat is the motivation of the authors use the two losses?\nhow other OOD detection losses performs in LLM-generated text detection. if they fail to work, why?", "rebuttal": "Thank you for your detailed review and comment. To address your concern, we would like to provide the response to your reviews:\n\n> W1: One-class/OOD ideas have a long history in NLP anomaly detection; related work could cite and empirically compare to prior one-class text detectors.\n\nWe believe there is OOD idea in previous NLP anomaly detection for classification, which is not applied in LLM detection. However, we would like to reiterate that we are the first to apply out-of-distribution detection methods to LLM detection. Moreover, we validate our method empirically and theoretically.  Specifically, we have demonstrated the effectiveness of the algorithm on a range of classic OOD methods such as DeepSVDD, Energy-based and HRN OOD detection methods. Our method achieves SoTA performance on diverse LLM detection tasks including multilingual and attacked text settings. Meanwhile, the generalizability is also validated.\n\nWe would like to kindly ask the reviewer to provide the specific citation of prior one-class text detectors. We are happy to provide the comparison in LLM detection settings.\n\n> W2: The χ²-divergence in Theorem 2 is not empirically estimated, so the link between theory and practice remains qualitative.\n\nThank you for your suggestion. We would like to provide the empirical  $\\chi^2$-divergence estimation of our setting:\n\n| **Domain**    | **Divergence** |\n|---------------|----------------|\n| wp_human      |         1.8790 |\n| hswag_human   |         0.3229 |\n| yelp_human    |         0.3107 |\n| sci_gen_human |        24.6070 |\n| squad_human   |         0.1500 |\n| eli5_human    |        22.1010 |\n| tldr_human    |         0.2894 |\n| xsum_human    |         0.1820 |\n| cmv_human     |         0.6971 |\n| roct_human    |         1.0137 |\n| Avg.          |         9.0491 |\n\nWe evaluate the $\\chi^2$-divergence on Deepfake dataset, which contains multiple domains and source LLMs. We use the full human set as the true distribution and sample subsets as the fitted distribution. We apply the RoBERTa model to compute the embedding. The results show that while some domains such as squad and xsum obtain low $\\chi^2$-divergence, some other domains like sci_gen and eli5 gain significantly high divergence. Moreover, the average divergence is also large (9.0491), demonstrating the gap between the fitted and true human distribution.\n\nWe would like to point out that in Theorem 2, we unfortunately have a typo: the last term for the loss of $\\hat{D}$ should be $0.9 q_H (D+1) \\cdot \\Delta$ instead of $0.9 q_H (D-1) \\cdot \\Delta$. We corrected this typo in the appendix and our final version. Thus even with smaller values of the $\\chi^2$-divergence (e.g. D<1), the potential difference in loss is still significant.\n\n> W3: Encoder choice fixed to RoBERTa. How would results change with more recent lightweight or multilingual encoders?\n\nThank you for your suggestion. In fact, we already included the results of different backbones in Table 6 in the appendix including BERT, RoBERTa and FLAN-T5. Following your suggestion, we provide results of more efficient backbone E5-small with 33M parameters and Multilingual-E5-base:\n\n| **Domain**      | **AUC_ROC** | **PR_AUC** | **FPR-95%** |\n|-----------------|:-----------:|:----------:|:-----------:|\n| E5-small        |        96.7 |       97.5 |        11.4 |\n| E5-multilingual |        96.6 |       96.6 |        12.5 |\n\nThe model is trained with the identical setting on DeepFake and DeepSVDD. Both efficient and multilingual backbones achieve comparable results, indicating the robustness of our method for backbone choice.\n\n\n> W4: How sensitive are DeepSVDD radius or energy margins to training-set size?\n\nWe clarify that in our DeepSVDD experiments, we only use simple one-class setting which does not rely on the radius. For the energy margins and training-set size, we provide the sensitivity analysis experiment on DeepFake dataset:\n\n| **Setting**                   | **AUC_ROC** | **PR_AUC** | **FPR-95%** |\n|-------------------------------|:-----------:|:----------:|:-----------:|\n| M_in=-27, M_out=-2, full set  |        97.6 |       97.2 |        12.3 |\n| M_in=-30, M_out=-2, full set  |        96.7 |       96.0 |         7.4 |\n| M_in=-20, M_out=-2, full set  |        96.7 |       95.9 |         7.5 |\n| M_in=-27,  M_out=-5, full set |        97.1 |       96.5 |         6.1 |\n| M_in=-27, M_out=0, full set   |        96.4 |       95.5 |         8.8 |\n| M_in=-27, M_out=-2, half set  |        97.1 |       96.4 |         6.2 |\n| M_in=-30, M_out=-2, half set  |        97.1 |       96.5 |         6.7 |\n| M_in=-20, M_out=-2, half set  |        96.6 |       95.7 |         8.0 |\n| M_in=-27,  M_out=-5, half set |        97.1 |       96.4 |         6.2 |\n| M_in=-27, M_out=0, half set   |        96.3 |       95.4 |         8.7 |\n\nWe can see that the model performance is robust with different energy margin and training set size.\n\nWe hope our responses adequately address all your concerns. If you have any further questions or feedback, we would be glad to continue the discussion during the discussion phase."}, {"review_id": "vNtIVsw5ek", "reviewer": "Reviewer_vd2x", "summary": "The paper proposes to reformulate the problem of detecting LLM-generated text from binary classification to an out-of-distribution (OOD) detection task. The authors argue that human-written texts are inherently diverse and cannot be modeled as a single distribution, while machine-generated texts exhibit more stable statistical properties. They use one-class (DeepSVDD, HRN) and score-based (energy-based) OOD detection methods to detect human texts as outliers. Theoretical analysis supports the failure of binary classifiers due to distribution mismatch, and extensive experiments on multilingual, adversarial, and unseen-domain settings demonstrate strong empirical performance, outperforming prior zero-shot and training-based baselines.", "questions": "- **(Q1)** Your approach relies on score-based decisions (e.g., DeepSVDD radius, HRN sigmoid, energy scores), but the paper does not describe how inference thresholds are selected. Are these thresholds fixed, learned, or tuned on validation data? Are they consistent across datasets or adjusted per domain? Please clarify this, and ideally include ablation or robustness analysis over threshold choices.\n- **(Q2)** The proposed framework combines the OOD loss with a supervised contrastive loss. However, your ablation study (Table 3) only compares different OOD losses against binary classification, but does not isolate the effect of the contrastive term. Could you include an ablation where $\\alpha = 0$ and separately $\\beta = 0$ to assess how much of the gain comes from contrastive learning? This would help assess whether the gains are due to the OOD formulation itself or enhanced representation learning from contrastive supervision.\n- **(Q3)** Can you quantify somehow intra-class variance of LLM texts across different domains or models? It would be better to show statistically that LLM texts are indeed statistically coherent and form a compact in-distribution set. This would strengthen the argument for using a one-class formulation and help validate the theoretical motivation.\n- **(Q4)** Most datasets used in evaluation include outputs from relatively early-generation LLMs. Do you plan to test on newer model outputs, or maybe select a subset from data which contains only newer models?", "limitations": "Yes", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 2, "significance": 2, "originality": 3, "strengths_and_weaknesses": "Strengths:\n- **(S1)** Conceptual Novelty and Motivation: the paper treats machine-generated text detection as an out-of-distribution (OOD) detection task, rather than a binary classification problem. This is a novel and theoretically motivated perspective \n- **(S2)** Theoretical Proofs and Clarity: authors support their claim with solid theoretical analysis, including formal proofs of how binary classifiers fail under realistic distribution shifts. This gives strong credibility to the motivation for the OOD formulation.\n- **(S3)** Strong Empirical Results: the proposed framework achieves state-of-the-art results across several benchmarks (DeepFake, M4-multilingual, RAID).\n\nWeaknesses:\n- **(W1)** Unvalidated Assumption of LLM Homogeneity: a central assumption is that LLM-generated texts form a compact, learnable distribution, unlike human texts. However, this assumption is neither empirically validated nor tested across different models or domains. If LLM texts are multimodal or diverse, this could possibly make method worse\n- **(W2)** Lack of Ablation: the proposed framework combines the OOD loss with a supervised contrastive loss. However, the paper does not ablate the contribution of this component. It is unclear whether the performance gains are because of the OOD formulation itself or primarily from the contrastive learning\n- **(W3)** Old Datasets: most of the datasets contains relatively old models, which generations could be very easily detected", "was_revised": true, "final_justification": "The rebuttal convincingly addressed major concerns, especially through strong ablation results and evaluations on newer LLM outputs, which improved my confidence. The inter-/intra-class analysis and theoretical framing are interesting, though additional quantitative evidence could further prove the need for the OOD formulation. I believe, it is worth improving. As limitation also remains the scope of evaluation", "rebuttal": "Thank you for your insightful review. To address your concern, we would like to provide the response to your reviews:\n\n> W1: Unvalidated Assumption of LLM Homogeneity: a central assumption is that LLM-generated texts form a compact, learnable distribution, unlike human texts. However, this assumption is neither empirically validated nor tested across different models or domains. If LLM texts are multimodal or diverse, this could possibly make method worse\n\nThank you for your suggestion. As NeurIPS does not permit the inclusion of PDFs or anonymous external links in the rebuttal this year, we apologize in advance that we are unable to provide annotated figures or visual clarifications. We hope our written explanations are sufficiently clear, and we are happy to incorporate this additional clarifications in the final version. For this question, we can provide the inter- and intra-LLM and human text cosine distance across diverse domains:\n\n| **Metric**           | **Dist** |\n|----------------------|----------|\n| Intra-distance LLM   |   0.3014 |\n| Intra-distance human |   0.4747 |\n| Inter-distance       |   1.6048 |\n\nWe compute the average cosine distance on the Deepfake dataset, which contains domains such as cmv, xsum, eli5 and so on, and LLMs including GPT-3.5-turbo, GLM-130B, Bloom-7B and so on. The embedding backbone we use is RoBERTa pretrained with contrastive loss. The results show that the Intra-distance of LLM is smaller than the human while the inter-distance between human and LLM is relatively large, supporting our OOD hypothesis that LLM text forms a coherent in-distribution cluster, while human-written texts—spanning varied styles and domains—act as natural OOD examples.. We hope this can address your concern.\n\n\n> W2: Lack of Ablation: the proposed framework combines the OOD loss with a supervised contrastive loss. However, the paper does not ablate the contribution of this component. It is unclear whether the performance gains are because of the OOD formulation itself or primarily from the contrastive learning\n\nThank you for your suggestion. We will the ablation of each loss component:\n\n| **Methods**             | **AUC_ROC** | **PR_AUC** | **FPR-95%** |\n|-------------------------|:-----------:|:----------:|:-----------:|\n| Contrastive Loss        |        88.6 |       93.5 |        76.1 |\n| OOD loss                |        93.7 |       94.1 |        33.7 |\n| Contrastive + OOD Loss  |        98.3 |       98.3 |         8.9 |\n\nThese results highlight the critical role of the OOD loss. Even without contrastive learning, the OOD loss alone substantially improves performance, especially in terms of FPR-95%, indicating its strong discriminative power. While contrastive learning offers additional benefits, the OOD loss is the primary driver of robustness and separation between distributions. \n\n> W3: Old Datasets: most of the datasets contains relatively old models, which generations could be very easily detected\n\nThank you for the helpful comment. At the time of our submission, RAID was already the most up-to-date benchmark available. To further address your concern, we split the RAID test set to isolate newer models such as GPT-4, ChatGPT, and LLaMA-70B-Chat, and additionally evaluated our method on a recent benchmark, EvoBench [1], using the XSum dataset with GPT-4o outputs. The results are as follows:\n\n| **Newer Model only**    | **AUC_ROC** | **PR_AUC** | **FPR-95%** |\n|-------------------------|:-----------:|:----------:|:-----------:|\n| DeTeCtive (RAID subset) |        87.2 |       83.2 |        79.7 |\n| Ours (RAID subset)      |        93.2 |       74.7 |        39.1 |\n| DeTeCtive (GPT4o)       |        74.7 |       87.3 |        90.2 |\n| Ours (GPT4o)            |       100.0 |      100.0 |         0.0 |\n\nThese results show that our method maintains strong performance even on outputs from state-of-the-art models, demonstrating its effectiveness beyond older-generation LLMs.\n\n\n> Q1: Your approach relies on score-based decisions (e.g., DeepSVDD radius, HRN sigmoid, energy scores), but the paper does not describe how inference thresholds are selected. Are these thresholds fixed, learned, or tuned on validation data? Are they consistent across datasets or adjusted per domain? Please clarify this, and ideally include ablation or robustness analysis over threshold choices.\n\nThank you for the thoughtful question. We would like to clarify that our evaluation metrics—ROC-AUC, PR-AUC, and FPR at 95% TPR—are all threshold-independent or use standardized criteria for threshold selection. Specifically, ROC-AUC and PR-AUC measure performance across all possible decision thresholds, providing a holistic view of the model's discriminative ability. The FPR at 95% TPR metric, while threshold-based, uses a fixed target TPR to compute the corresponding FPR, ensuring consistency and comparability across models and datasets. Therefore, our method does not require the manual tuning or learning of specific thresholds during inference, and the reported results are not sensitive to any particular threshold choice.\n\n> Q2: The proposed framework combines the OOD loss with a supervised contrastive loss. However, your ablation study (Table 3) only compares different OOD losses against binary classification, but does not isolate the effect of the contrastive term. Could you include an ablation where and separately to assess how much of the gain comes from contrastive learning? This would help assess whether the gains are due to the OOD formulation itself or enhanced representation learning from contrastive supervision.\n\nThank you for your question. We have already provided the ablation study of each loss component in W2. Please have a check. Hope this could address your concern.\n\n> Q3: Can you quantify somehow intra-class variance of LLM texts across different domains or models? It would be better to show statistically that LLM texts are indeed statistically coherent and form a compact in-distribution set. This would strengthen the argument for using a one-class formulation and help validate the theoretical motivation.\n\nYes, we have already provided the intra and inter distance in W1. Please have a check.\n\n> Q4: Most datasets used in evaluation include outputs from relatively early-generation LLMs. Do you plan to test on newer model outputs, or maybe select a subset from data which contains only newer models?\n\nYes, we have provided the results in W3. Please have a check.\n\n\n[1] Yu, Xiao, et al. \"EvoBench: Towards Real-world LLM-Generated Text Detection Benchmarking for Evolving Large Language Models.\" Findings of the Association for Computational Linguistics: ACL 2025. 2025.\n\nWe hope our responses adequately address all your concerns. If you have any further questions or feedback, we would be glad to continue the discussion during the discussion phase."}]

Author rebuttal:

Meta-review: The proposed approach formulates LLM generated text detection as a single class out-of-distribution detection problem, where human-written texts is treated distributional outliers while machine-generated texts are treated as in-distribution data.

The strength of the paper lies in reformulating LLM text detection as OOD rather than binary classification is a compelling conceptual shift that aims to provide a more fine-grained assumption on human and LLM text distributions, and its extensive experiments.

For weakness, the AC summarize the discussion between the author and reviewers, where almost all weaknesses are properly addressed:
1. Justification and Validation of the OOD Assumption
Reviewers' Points (mbi1, VQzR, vd2x): Multiple reviewers questioned the central premise of treating human-generated text as OOD. They requested both theoretical justification and empirical experiments to validate this assumption.

Authors' Response: The authors addressed this by providing new experiments measuring the intra-distance of LLM/human texts and the inter-distance between them, arguing the results validate their OOD setup. They also added a direct empirical comparison using LLM-generated text as the OOD set, as requested.

2. Experimental Rigor and Ablation Studies
Reviewers' Points (mbi1, vd2x, twCw): Reviewers requested crucial ablation studies to isolate the effects of the different loss components (contrastive vs. binary classification). They also asked for sensitivity analysis regarding training set size and hyperparameters, as well as a comparison of computational efficiency (training/inference time).

Authors' Response: The authors provided the requested ablation studies by testing model configurations with β=0 and α=0. They also added a new sensitivity analysis for training data size and hyperparameters and included a table comparing training/inference times against baselines.

3. Scope of Evaluation and Baselines
Reviewers' Points (twCw, vd2x): Concerns were raised about the limited scope of the evaluation. Reviewers noted a lack of comparison to prior one-class/OOD text detectors, the use of only a single model backbone (RoBERTa), and the need for testing on more recent LLMs.

Authors' Response: The authors clarified the distinction between their research setting and that of prior work. They expanded their evaluation by providing results for more efficient and multilingual backbones. Crucially, they added new results on more challenging and recent datasets, including a newer subset of RAID and a GPT-4o subset of EvoBench.

4. Theoretical and Empirical Divergence Estimation
Reviewer's Point (twCw): One reviewer pointed out the absence of an empirical estimation for the paper's theoretical χ²-divergence claim.

Authors' Response: The authors addressed this by adding an empirical estimation of the χ²-divergence to the paper, along with further analysis to strengthen their theoretical claims.

Therefore the AC recommends acceptance.
Decision: Accept (poster)