Zero-Shot Detection of LLM-Generated Text via Implicit Reward Model
Authors: Runheng Liu
Heyan Huang
Xingchen Xiao
Zhijing Wu
Venue: NeurIPS 2025 poster ()
Keywords: Large Language Model
LLM Generated Text Detection
Reward Model
Zero-Shot Detection
Primary area: social_and_economic_aspects_of_machine_learning
TL;DR: We propose an effective zero-shot method for detecting LLM-generated text by leveraging implicit reward models.

Abstract: Large language models (LLMs) have demonstrated remarkable capabilities across various tasks. However, their ability to generate human-like text has raised concerns about potential misuse. This underscores the need for reliable and effective methods to detect LLM-generated text. 
In this paper, we propose IRM, a novel zero-shot approach that leverages Implicit Reward Models for LLM-generated text detection. Such implicit reward models can be derived from publicly available instruction-tuned and base models. Previous reward-based method relies on preference construction and task-specific fine-tuning. In comparison, IRM requires neither preference collection nor additional training.
We evaluate IRM on the DetectRL benchmark and demonstrate that IRM can achieve superior detection performance, outperforms existing zero-shot and supervised methods in LLM-generated text detection.

Zero-Shot Detection of LLM-Generated Text via Implicit Reward Model
Runheng Liu, Heyan Huang, Xingchen Xiao, Zhijing Wu'
School of Computer Science and Technology, Beijing Institute of Technology {rhliu, hh,6,, xcxiao, zhijingsu]@bit. edu. cn
Abstract
Large language models (LLMs) have demonstrated remarkable capabilities across various tasks. However, their ability to generate human-like text has raised con- cerns about potential misuse. This underscores the need for reliable and effective methods to detect LLM-generated text. In this paper, we propose IRM, novel zero-shot approach that leverages Implicit Reward Models for LLM-generated text detection. Such implicit reward models can be derived from publicly avail- able instruction-tune -unnedd and base models. Previous reward-based method relies preference construction and task-specific fine-tuning. In comparison, IRM requires neither preference collection nor additional training. We evaluate IRM the DetectRL benchmark and demonstrate that IRM can achieve superior de- tection performance, outperforms existing zero-shot and supervised methods LLM--generatd text detection.
1 Introduction
Large Language Models (LLMs) have demonstrated remarkable capabilities across various tasks In particular, their ability follow instructions and generate human-like content has made them essential tools various real-world applications. However, this trend raises concerns about the misuse of LLMs, such generating fake news [3] and plagiarism 4.. Since LLM -LM-geeerated text be indistinguishable from human-written text 5 is necessary to develop effective methods for detecting such content.
Detection methods can generally be categorized into two paradigms: supervised and zero-shot approaches. Supervised methods typically train classifier using both numan--ritted and LLM- generated texts. However, such classifiers often fail to generalize well to texts generated by unseen LLMs 71. In contrast, zero-shot methods provide alternative with more generalization ability and without the need for training S These methods leverage various LLMs and exploit statistical classification metrics to assess how likely text is to be generated by an LLM, such the average log likelihood or the log-rank of each tokens within the detected text 99 10 5). However, in real-world the source L.M of the detected text often unknown, thus these zero-shot methods have rely proxy LLM and suffer from a performance drop. This highlights the need to identify model-agnostic metrics for detection.
ReMoDetect [T]] has recently proposed using the reward score-the output of a reward model that measures the extent to which text aligns with human values-as detection metric. The rationale that powerful LLMs are typically trained to obtain high reward score, making this signal potentially model-agnostic Specifically, ReMoDetect constructs preference dataset from human and ChatGPT responses to the same prompt, and fine-tunes pre-trained reward model for adaptation to the detection task. However, this fine-tuning inherits the drawbacks of supervised methods. As
Corresponding author.
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

RMt-oebbetaa-33-aree--
ReMoDeted.
Llama-3.2-18 family
250
250
300
250
200
Requescy
200
150
150
160
100
50-
200
-5.0
5.0
-600 -400
-200
200
Human--W
LLX
Figure 1: Distributions of reward scores for human wrrtten and LLM-generated texts from the multi- LLM sub-task of the DetectRL benchmark. The source LLMs include GPT-3.5-turbo, HLLM---Bison Claude-Instant, and I.LaMA A-2-7BB. (a) shows distributions under RMM-dehrraavv--arge- pre-trained reward model. (b) shows distributions under ReMoDetect, which is initialized from RM-deherta-v33 -ar-g------------2 and fine-tuned on task-specific preference dataset. (c) illustrates distributions under an implicit reward model derived from Llama-3.2. 3.2-11 family without additional training.
which is
shown in Figure (b), when ReMoDetect evaluated on texts generated by unseen LLMs,, there remains substantial overlap between the two score distributions of human-written written and LLM-generated texts, suggesting the limited generalization ability.
In this paper, we propose IRM, novel zero-shot method that leverages implicit reward models for LLM-ggnerrted text detection. Such implicit reward models can be derived from publicly available instruction-tun tundoddtttddddddd-ooo and base models. Given detected text y. instruction-tuie
model we and base (er(y) This score serves the
model Tref, the implicit reward score of y formulated as r(y) log detection metric in our method, where higher score indicates that the input text is more likely to be generated by LLMs.. This formulation is built on Direct Preference Optimization (DPO) [12]. which provides theoretical support for parameterizing implicit reward models. Compared ReMoDetect, IRM requires neither preference collection nor additional training. As shown in Figure (c), the two distributions under IRM are more separable than those in (b), suggesting that our zero-shot metric transfers well to unseen LLMs.
me ma(y)
We evaluate IRM on the DetectRL benchmark [3 and demonstrate that IRM an effective zero-shot method for LLM-generatee text detection. Notably, with Llama-3.2, 3- 1B family, IRM achieves an aver- age score of 91.77%, surpassing previous zero-shot baselines such Log- Lik-Lekiidood (77.46%) and Log-Rank (77.42%). as well as Binoculars (87.67%) method which also utilizes two L.LMs during detection. Furthermore, IRM even outperforms the supervised reward-based method, ReMoDetect (85.86%). These results underscore IRM's potential as effective zero-shot detector for real-world applications.
Preliminaries
The mainstream alignment approach for LLMs is Reinforcement Learning from Human Feedback (RLHF) [14 [5], which relies on reward model as a proxy for human preferences. In this section, we first introduce the concept of reward modeling, followed by overview of the RLHF process.
Reward modeling. Typically, the reward model initialized from a pre-trained language model with additional linear head that outputs scalar value. is trained preference dataset, where human annotators compare multiple responses to the same prompt and rank them based on quality such helpfulness or harmlessness. Formally, the preference is modeled using the Bradley- Terry (BT) model [16]:
exp(r(x, v1 exp(r(z, p(y1 > V2(x) exp(r(x, (xp
(I)

---

instruction-tuned model
Tg TT(
"This article explores the domain of learning from compressed...
n (3)
r(y) log π rel (1)
ref
Teef
reward score
y
base model
Figure 2: IRM leverages open-source instruction-tuned and base models construct implicit reward model. The resulting reward score is used as a detection metric, where higher score indicates higher probability that y is generated by an LLM.
where denotes the reward model, is the prompt, and y1. Y2 two candidate responses. Given prompt-response pair (x, y), the reward model outputs a scalar score r(x, y), where a higher score indicates stronger alignment with human values.
During RLHF, the learned reward model is used to provide feedback for optimizing the language model. The LLM is framed as policy model we, which generates responses conditioned input prompts. The policy is optimized to maximize its expected reward while remaining close to reference model Teef- typically the original base LLM prior alignment. This leads to the following optimization objective:
RLHE
max D.yrrroll)) (r, v)l - 5lDx [To 2g
(2)
where denotes the prompt, y the response, the reward model, and / hyper controlling the strength of KL regularization.
Method
We introduce IRM, a zero-shot detection method for LLM--geeratee detection. We formalize the approach and show how it can be instantiated using publicly available instruction-tuned and base models.
Implicit reward model for detection. Direct Preference Optimization (DPO) form solution to the RLHF objective in Eq.
12 offers a closed-
1 ((x)
Teat (y) exp (2)
T (v)
where Z(x)= =,, E, [))(((| exp r v) is the partition function that normalizes the distribution.
By rearranging this equation, we can express the reward function of the policy and reference models, yielding an implicit reward model:
To (B( xur(y)
r(z, y) = Bog
+ 3 log (xx).
For simplicity, we let x Ø and be the detected text. In this case, the term 33 log Z(x) becomes constant across all detected texts. Importantly, applying linear transformation to the reward scores does not affect commonly used classification metrics such as AUROC and Fi. as long as the threshold adjusted accordingly. As a result, we define the detection metric as:
To(y) (g)
To To (Bes)) Σ log Tee(yAl
r log
(5)
where J. is the length and y/ denotes the i-th token. DPO also provides theoretical justification for the effectiveness of the implicit reward model. As shown in Eq. given reward model r(z, y)

---

and reference model wyf. one can analytically derive the optimal policy model Ta under the RLHF objective. Conversely, given learned policy model vy and reference model Tefs one can recover corresponding reward model such that Ty is optimal with respect to that reward under the same reference model. This bidirectional relationship ensures that the implicit reward model consistent with the behavior of the policy model relative to the reference model. Therefore, if the policy model aligns well with human preferences, the derived implicit reward model is also expected to exhibit strong performance in tasks such as LLM-generated text detection.
Constructing IRM using instruction-tuncd and base models. Typically, publicly available LLMs release both instruction sennnetioo-tneedddeee model and its corresponding base model. We leverage the instruction- tuned model as the policy model and the base model as the reference model. In this way, without any fine-tuning, we can obtain an implicit reward model for LLM -LM-generated text detection. Given detected text y, its reward score can be computed via Eq. [ Moreover, the same formulation naturally extends to LLMs trained via iterative alignment. Suppose instruction model Tr is obtained from the base model Ty through rounds of optimization: mo -> I
#T-1 + Tr. While the intermediate models T1, ..., TT-1 are typically not publicly released, we can still conceptually define the implicit reward at each step i by applying Eq.
T1 (ylæ)
(2 v) = 3 log
+ B log Z.(x).
(6)
(y)aa)
By summing the rewards over all iterations, we obtain the total reward:
क (y)la <o(y + +B Σ (1)
Σ r rr v) = Blog
Since Ø, the term B E (x) becomes constant. As linear transformation does not affect Tr(#) Therefore, given only the
the ranking of detected texts, the overall reward is determined by log To(y) instruction-tume and base models, we can construct an implicit reward model for detection without requiring access intermediate checkpoints.
4 Experiments
4.1
Settings
Datasets. We conduct evaluations on a large benchmark, DetectRL [33, which covers various domains, multiple LLMs and diverse attacks scenarios in real-world settings. We follow the test setting of DetectRL in the evaluation of detection methods. The statistics of the benchmark are reported Table 6 in Appendix I Notably, the texts in DetectRL are mostly complete, unlike previous works where the texts are often truncated to prefixes of complete texts. This allows for a more realistic evaluation of detection methods, as texts are typically not truncated real-world scenarios.
Models. We employ Gemma-2 [77. Llama-3.2, Gemma [18] Qwen-2 19] and Qwen-2.5 (2)
model families for implementation. These model families provide both publicly available base models and instruction-tuned models, which are essential for deriving the implicit reward model. Within these families, we focus on lightweight LLMs, such as Gemma-2-2B-ir and Llama-3.2-IB-IIn-e to ensure computational efficiency while maintaining competitive performance.
Baselines. We compare IRM with recent zero-shot methods, including Binoculars 21 and Lastde 22). as well typical zero-shot baselines such as Log- Likellhoodod p 10). Rank [5] Log-Rank [5], LRR 23 and Dast-DetcctGPT [24]. Since we employs reward score as detection metrics, we also well reward models from RewardBench (25 such as GRM (26 as baselines. For practical consideration, we exclude
include ReMoDttect [1] and its initialization, RM-Deherta-v3--arge
methods that require additional LLMs perturb the original text for metric computation, the extra cost is too high in real-world settings.
Metrics. Follow the settings of DetectRI, we report AUROC and F; Score as the main evaluation metries. AUROC widely used for assessing zero-shot detection methods and F, Score provides a comprehensive evaluation of detector capabilities by balancing the Precision and Recall.

---

Table 1: The overall performance of zero-shot detection methods on the DetectRL benchmark, covering robustness and generalization tasks, which include various domains, LLMs and attacks scenarios. also considers the effects text length and real-world human writing characteristics. The reported average score is computed across all tasks. For each task, the best results are marked in bold and the second best results are marked by underline. More detailed detection results are
available in Table 8 10 and 11 in Appendix A.2
Tasks Settings
Multi-
Multi-
Multi-
Generalization
Length
Human Wriling
Domain
LLM
Atlack
Domain
LLM
Attack
Train
Test
Avg.
Methods
AUROC
AUROC
Fi
AUROC
F
Fj
Fi
Fi
AUROC:
2-mmn-2-28-ii
Lag-1 .kklihhodd
77.92
70.65
Rank
$3.56
45.45
53.45
45.64
57.62
46.14
44.08
43.78
36.86
44.92
44.93
79.05
71.97
51.33
Log-Rank Rank
75.78
69.81
75.62
65.36
78.75
71.37
06.79
64.85
66.30
69.50
68.79
93.02
$8.05
73.38
I.R
77.43
70.81
76.81
66.62
79.28
71.32
68. 30
66.05
68.30
65.75
63.44
91.41
85.75
73.17
Past- DetecrGe
73.30
66.02
59.
89.56
67.61
59.70
56.31
54.45
53.61
Gemma-2-22 2-28 family (Genmnn-22
2-28-Ir Genuno- 2-28)
Binoculars
$0.85
74.52
50.43
71.24
13.00
76.58
73.11
20.95
73.64
73.03
71.71
93.29
89.07
77.81
IRM
84,65
77.70
86.56
77,43
88.38
79.02
76.97
76.62
78.64
60.30
58.15
81,19
76.01
27.05
3.2-18
Likeihhod
Rank
59.65
53.70
39.50
50.84
63.60
52.35
51.02
49.52
41.91
51.20
49.12
84.37
78:20
57.31
Log Rank
79.64
73.41
79.78
71.50
82.55
75.37
72.05
70.54
73.32
73.08
71.46
93.91
89.81
77.42
LRR
77,99
70.66
77.79
69.53
79.56
70.65
69. 25
68.
68.36
69.
68.05
91.62
$6.72
74.08
Fast- DetectiPT
Laade
$4.91
69.59
53.14
59.44
41.59
49.79
Momeo-1 1.2-18 family (1 (ummm-3.
[R)
Binoculars
92.48
85.63
92.08
$6.67
93.04
$7.02
85.00 07
83.18
85.60
80.62
81.88
94.63
91.82
82.62
IRM
97.97
93,75
97.24
92.12
97.19
92.01
90.23
90.72
90.87
82,34
K3,34
94.48
90.78
91.77
Implementation Details. All experiments are conducted on two NVIDIA RTX 4090 GPUs (24GB each). All model and datasets used in this paper are fully detailed and referenced Table 7 Appendix
A. A.]
4.2 Main Results
4.2.1 Zero-shot LLM-generated Text Detection
In Table I we present the overall performance of IRM and other zero-shot detection methods on the DetectRI. benchmark. Detailed results for each sub-task are reported in Table x 9 Appendix A.2 With the A.lam-33.2-1 family, IRM achieves the highest average score, improving the best result by 4.1 %, from 87.67% to 91.77%. Using the Gemma-2-28 family, IRM also attains competitive average score of 77.05%, slightly below the best result of 77.81%. All methods, except Fast-DetectGPT, perform better when using the Llama-3.2-ID family than with the Gemma-2-2B family, indicating that Llama-3.2-1D family more suitable for these zero-shot detection approaches.
10 and i1
4.2.2 Reward-based LLM LLM-generated Text Detection
In Table we present the overall performance of IRM and other reward models on the DetectRL. benchmark. With the Llama-3.2- 1B family, IRM achieves the highest average score, improving the best result by 5.8%, from 85.86% to 91.77%. Notably, IRM outperforms ReMoDetect, supervised reward model that fine-tunes a pre-trained reward model REM-debbrtaa-V--larg-- using task-specific data. In addition, IRM also outperforms competitive reward models from the RewardBench benchmark, such as GRM-Llama3.22
and GRM-gemma2-2B. when evaluated on DetectRL benchmark. This suggests potential mismatch between reward models optimized for preference classification and the requirements of LLM-ggenrated text detection, indicating that directly leveraging such models for detection may be suboptimal.
4.3 Analysis
Robustness to domains. As shown in Table 8 IRM outperforms other detection methods on 6 out of evaluation metrics and achieves the best average performance across domains. While its performance varies slightly across domains for instance, achieving particularly strong results on the arXiv dataset and relatively lower scores on the Review dataset-it maintains overall superiority throughout. For example, using the Llama-3.2- family, IRM achieves AUROC of 98.56% and
5

---

Table The overall performance of rewerd-based detection methods on the DetectRL benchmark, covering robustness and generalization tasks, which include various domains, LLMs and attacks scenarios. also considers the effects of text length and real-world human writing characteristics. The reported average score is computed across all tasks. For each task, the best results are marked in bold and the second best results are marked by underline. More detailed detection results are
available in Table 8 9 10 and in Appendix AA2
Tasks Settings
Multi-
Multi-
Multi- Attack
Generalization
Length
Human Weitinn
Domain
I.LM
Domaain
L.M
Attack
Train
Test
Avg.
Reward Models L
AUROC
Fi
AUROC
F
AUROC
Fi
Fi
Fi
Ft
Fi
Fi
AUROC
Fi
ReMoDeteel
91.99
85.95
90.41
83.17
91.22
82.09
79.08
78.36
80.22
$8.53
85.87
91.63
87.65
85.86
RM-Dehesta--ie Dasteett----lagg---
73.08
65.01
70.37
64.91
71.34
63.44
56.70
62.25
61.21
79.68
72.71
$1.48
74.62
68.59
GRM 20MM---mmm2-22 2-26
51.07
31.20
50.57
45.32
50.69
39.97
27.53
41.58
56.30
45.71
53.97
63.69
60.37
49,07
GKM Liumal 2-38
45.47
21.27
22.85
48.56
30.80
19.03
46.81
49.99
54.64
IRM
Gemma family
$4.65
77.70
72.43
38.38
76.62
58.15
76.04
1.ams-3.2-18 family
97.97
93.75
92.12
97.19
92.01
90.23
90.72
90.87
52.
90.78
91.77
Table 3: The performance of IRM using the Llama-3.. 3.2- family on various attacks to wwrtten
texts.
DIPPER Paraphrase
Polish using LLMs
Back
Translation
Pre
Rec
F1
AUROC
Pre
Rec
F1
AUROC
Pre
Rec
Fi
AUROC
93.02
83.33
87.91
94.39
77.76
79.76
78.75
85.36
93.11
87.10
90.01
95.54
an F1 Score of 95.02% on the arXiv dataset, and an AUROC of 97.03% and an F1 Score of 91.65% on the Review dataset. One possible explanation is that positive reviews are tend be more neutral or benign compared to negative reviews, making them more likely to receive higher reward scores. This subtle property of the data may slightly reduce the separation margin between human-writte and LLM-ggnerated texts. Still, IRM maintains strong performance overall, underscoring its effectiveness across diverse domains.
Robustness to LLMs. As shown in Table 9 IRM outperforms other detection methods out of 8 evaluation metrics and achieves the best average performance across all LLMs. While IRM demonstrates strong generalization across wide range of generation models, its performance can be further enhanced when the instruction-tuned and base models used to construct the implicit reward model share a similar fodel-family background with the generation model. For example, when using the Gemma-2 2-2B family, IRM performs particularly well in detecting texts generated by PaLM-2- --bbon,,, achieving an AUROC of 88.65% and an Fi Score of 79.41% %. Similarly, with the -lama-332-11 family, IRM demonstrates outstanding performance in detecting Llama-2-70B's outputs, achieving an AUROC of 99.35% and an Fj Score of 96.58%
Robustness to attacks. As shown in Table 10 IRM outperforms other detection methods on 8 out of 10 evaluation metrics and achieves the highest average performance across all attacks applied to LLL-LLMgeeeee LeM-eenerrted texts. For example, when using Llama-3.2 IB family, IRM achieves an average AUROC of 97.19% and an average F1 Score of 92.01%. %. While IRM demonstrates strong robustness against attacks on LLM -LM-generated texts, its performance is relatively lower but still competitive when attacks are applied to Human-writted texts, as shown in Table 11 For example, with the Llama-3.2-10 family, IRM achieves an average AUROC of 94.48% and average F1 Score of 90.78%, which are slightly below than the best results: 94.63% for AUROC and 91.82% for F1 Score. We further investigate which attack type has the greatest impact on IRM's performance. As shown in Table 3 with the Llama-3.2- 1B family, IRM is particularly affected by the polishing attack, where LLMs prompted to improve human-writter texts. This result is intuitive: since the polished texts are generated by L.MMs and typically exhibit improved fluency or coherence, they tend to receive higher reward scores than their original, unpolished counterparts. As a result, the distinction between human-written and LLM LLM-gencrated texts become less clear, leading to a moderate drop in detection performance for IRM.
Generalization of IRM. In the generalization task, following the DetectRL. benchmark settings, we evaluate each sub-task using the optimal threshold from other sub-tasks and calculate the average F, Score across all sub-tasks. As shown in Table I IRM exhibits strong generalization capability

---

Table 4: The performance comparison of baseline zero-shot methods using instruction tuned and base models. Gemma-2-22-un and Llama-3.2 B-Instruct are instruction-tuu tuned models, while Gemma-2- 2B and Llama-3.2-1B are their corresponding base models.
Model
Log-Liketihood
Rank
Log-Rank
LRR
Fast- Rest-DetcctGPT
Lastde
Llama-3.2 3.2-1B I--Ittrruct
77.46
57.31
77.42
74.48
59,82
61.67
Llama-3 Llama-3.2-1B 3.2-IB
66.44
50.80
66.81
65.78
63,80
59.13
-11.02
-6.51
-10.61
-8.70
+3,98
-2.54
Gemma- 2-2B-it
72.53
51.33
73.38
73.17
67.61
60.32
Gemma-2-22
65.74
47.23
67.24
69.55
63.08
59.25
A
-6.79
-4.10
-6.14
-3.62
-4.53
-1.07
(a) Gemma-2-28 family Train
(b) Gemma-2-28 family Test
[c] Uame-3.2-18 family Train
(d) Llama-3.2-1B family Test
0.8
0.6-
0.5
0.5
3.6
0.4
0-0
0.2
0.2
0.2
100
200
500
100
200
300
100
200
500
1000
200
500
Text Length
Text Langth
Text Length
Text Length
Log Likolloodd Rank
Log LRR
DetoctGPT
Binoculars
Lastde
Figure 3: The performance of various zero-shot detection methods across different text lengths during training-time and test-time.
across different domains, LLMs and attacks. For instance, when using Llama-3.2-1P family, IRM achieves Fi Score of 90.23%, 90.72% and 90.87% on domain, LLM and attack generalization tasks. These results suggest that the decision boundary the implicit reward score is stable across various conditions, highlighting IRM's superior generalization ability.
Effectiveness of instruction-tun models for detection methods. As prior works often utilize base models when implementing detection methods, we follow this practice and implement baseline methods using both Llama-3.2-1B and Gemma-2-2B. As shown Figure 4 using instruction- tuned models consistently improves the performance of 5 out of 6 baseline methods. For instance, when using 2-1.B...--IBIIsttrucc. the performance of Log-Likelihood improves from 66.44% to 77. 77.46%. Similarly, with Gemma-2-2B-ir the performance increases from 65.74% to 72.53%. These results suggest that instruction tuned models are generally more effective for implementing detection methods.
Impact of text length. In the length task, following the DetectRL. benchmark settings, we analyze the impact of text length IRM's performance. For the train sub-task, derived from the dataset with a length interval of 160-180 and apply it to datasets with other length intervals. Conversely, for the test sub-task, the optimal threshold of each dataset evaluated on the dataset with a 160-180 length interval. We refer to the dataset used to derive the threshold as the training dataset, and the dataset used evaluate the threshold as the test dataset. As shown in Table T when using Llama-3.22 BB family, IRM achieves the highest Fj Score of 82.34% and 83.34% on the train and test sub-tasks, respectively. However, when using Gemma-2-2B family, IRM's ' performance drops significantly compared to other methods. To further investigate the influence of text length, we present the detailed results of train and test sub-tasks Figure IRM exhibits a distinct performance pattern trend compared to the other methods. Specifically, IRM tends to perform better than the length interval of the training dataset similar that of the test dataset. For example, using Gemma-2-22 2--BB family, thresholds derived from texts with lengths of 180-260 words perform better on 160-180- wood texts (Figure 3 (a)), while the threshold from texts with 160-180-word is more effective for texts of 80-1 words (Figure 3 (b)). Similarly, using 1lama-3.2-11 family, thresholds derived from texts of 140-260 words perform better on 160- (60-180-wonl texts (Figure 3 (c)), whereas the threshold from 160- 100-180-wa 180-word texts performs better texts of 140-200 words (Figure (d)). This phenomenon may
the optimal threshold

---

(a) Gemma-2-28 family
(b) Llama-3.244 3.2-18 family
Optimal Threshold
-20-
20
-40
-60
-80
300
Text Length
Text Length
RR
Figure 4: Optimal classification thresholds of IRM across datasets with varying text length intervals. The solid line shows the threshold values for each length interval (from to 360 words), and the red dashed line represents linear fit to illustrate the overall trend.
Table The performance of IRM with different model versions and sizes.
Tasks Settings
Multi-
Multi-
Multi-
Gemeralization LLM
Length
Human Writing
Domain
Domain
Attack
Avg.
Model Family
AUROC
AUROC
Fi
AUROC
Fi
Fi
Fi
Fi
Fi.
Ft.
AUROC
Qwen2-0.5B
90.14
83.57
89:43
82.54
90.47
83.55
82.48
81.59
83.34
74.17
70.67
86.11
78.27
82.79
Qwen2-1 1oxm2-1.58 1,58
89.68
82.49
89.64
82.59
89.44
81.59
81.
81
81.33
76.21
74.52
85.22
77.03
82.57
Owen2,5-0.5B
79.44
76.28
77.84
74,02
78.48
73.55
74.75
73.35
73.03
66.80
62.30
74.18
68.10
73.24
5we52.5-1.5B
74.70
Gemma: 2B
91.84
84.06
92.08
$4.77
93.17
85.18
83.
82.18
85.13
58.06
68.00
92.50
$7.90
83.72
Gemmu-2-22 2-2B
84.65
77.70
86.56
77.43
88.38
79.02
76.97
76.62
78.64
60.30
$8.15
81.19
76.04
77.05
Llamm-332- 3.2-1B
97.97
93.75
97.24
92.12
97.19
92.01
90.23
90.72
90.87
82.34
83.34
94.48
90.78
91,77
3.338
be attributed to the way the implicit reward score is computed. As shown in Eq. 5 the reward is accumulated over all tokens, the total reward varies with text length. Consequently, the reward distribution shifts across different length intervals, which affects the optimal threshold value. This trend is illustrated in Figure 4 where the optimal threshold of IRM changes with text length, showing an approximately linear relationship. Notably, for the Gemma-22 2-2B family, the optimal threshold fluctuates and deviates from the fitted red dashed line within the 160-20 100-220-worh word intervals. Besides, we can also observe that, with Gemma-2-22 family, the optimal threshold of IRM fluctuates and deviates from the red dash within 100-220-words intervals, which explain the performance drop of IRM when using Gemma-2-2B family. Since this length range corresponds to the train and test dataset in the length task, such instability in threshold values may explains the observed performance drop of IRM when using the Gemma-2-25 family in this task.
Impact of model version and size. We further investigate the impact of model version and size on the performance of IRM by implementing it across various model families, as presented in Table [5. When using the Llama-3.2 3.2-- family, IRM achieves the best average score of 91.77%, slightly higher than the 91.08% achieved with the larger Llama-3.2-3B family. A similar trend is observed in the Qwen2 and Qwen2.5 families: for example, IRM attains 73.24% with Qwen2.5-0.55 family, outperforming Qwen2.5-1.5B 5.5BB family (69.69%). Besides, IRM achieves 83.72% with the Gemma-2B family, compared 77.05% with Gemma-2-2B family. These results suggest that larger or newer versions of a model do not always lead to better detection performance.
Related Works
LLM-ggnerated text detection. Since generative language models have shown remarkable ca- pability in text generation, detecting Al-generated texts has attracted significant research attention. Current research primarily focus on supervised methods and zero-shot methods for LLMs. Supervised methods involve collecting labeled data and training classifiers for distinguishing human-writted written and generree-eeeeateed texts (27 29 [I]. However, it has been shown that many supervised methods
often suffer from overfitting to the training set 66 7) limiting their generalization ability. In contrast, zero-shot methods have shown better generalization ability, making them promising alternative. Current zero-shot methods are based pretrained LLMs and utilize heuristic metrics to classify
8

---

texts. These metrics include likelihood [9 [O], entropy, rank, log-rank [5], probability curvature 8 24 30 etc. Additionally, perturbing texts and measuring the variation of metrics is commonly used augmentation method for constructing better metrics [22 [T, but it incurs extra computational costs. Our method is zero-shot method that leverages the characteristics of aligned LLMs and derives metric from LLMs in an off-the-shelf manner, without the need of additional training. Additionally, our method does not require perturbing texts to compute the variation of metrics, avoiding extra computational costs.
LLM-generann texts and
Implicit reward model. In LLM alignment, the primary focus is on obtaining well-alignes LLM, rather than high-quality reward model. Thus, although DPO and other methods use implicit reward models implement L.LM alignment, the implicit reward models obtained after training are typically not reused. Recently, some research has leveraged implicit reward models to label process rewards for reasoning tasks [34]. Since our method uses the reward score as a metric for distinguishing human-written and LLM-generated texts, we propose leveraging implicit reward models to compute the reward score for texts.
Discussion and Conclusion
In this paper, propose IRM, novel method for zero-shot detection of LLM-generated text. IRM utilizes implicit reward models to compute reward scores as detection metrics. Experiments on the DetectRL benchmark demonstrate that IRM is effective zero-shot method for LLM LLL--genrrtee text detection. Notably, with Llama-3.22 1B family. IRM achieves an average score of 91.77%, %, surpassing previous vero-shot baselines such Log- Likelihood, Log-Ran Rank and Binoculars. Furthermore. IRM even outperforms the supervised baseline ReMoDetect, showing that IRM remains highly effective without any task-specific adaptation. These results underscore IRM's potential as effective zero-shot detector for real-world applications.
Limitations and future works. In experiments, focus exclusively lightweight LLMs, excluding larger LLMs due to computational constraints. Similarly, we do not consider generative reward models baselines, they typically require larger LLMs and more computation resources. Besides, we restrict our analysis to deriving IRM from LLMs within the same model family. For cases where only instruction-tuned models available, deriving corresponding IRM not feasible. We leave how to effectively leverage L.MSs from different model families for future work.
Societal impact. IRM contributes to the responsible use of LLMs by providing zero-shot method for detecting LLM- -egeereer text. This capability can enhance transparency and help mitigate misuse in high-stakes domains such education and media. On the other hand, misclassification may inadvertently suppress human-generater text, highlighting that need for continuous development more powerful detection methods.
Acknowledgments and Disclosure of Funding
We thank all the anonymous reviewers for their insightful and valuable feedback on this paper. This work is supported by the National Natural Science Foundation of China (Grant No.U21B320 B2009).
References
[1] Tom B. Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, Sandhini Agarwal, Ariel Herbert- Gretchen Krueger, Tom Henighan, Rewon Child, Aditya Ramesh, Daniel M. Ziegler, Jeffrey Wu, Clemens Winter, Christopher Hesse, Mark Chen, Eric Sigler, Mateusz Litwin, Scott Gray, Benjamin Chess, Jack Clark, Christopher Berner, Sam McCandlish, Alec Radford, llya Sutskever, and Dario Amodei. Language models are few-shot learners, 2020. httpttttp//aaaae wttp:///..rraa/////00////
org/ aboaa/as///0.... 14165 14165
[2] OpenAI, Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Flo- rencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, Red Avila, Igor Babuschkin, Suchir Balaji, Valerie Balcom, Paul Balteseu, Haiming Bao,

---

Mohammad Bavarian, Jeff Belgum, Irwan Bello, Jake Berdine, Gabriel Bernadett- Bernadett-Shapir. Christopher Berner, Lenny Bogdonoff, Oleg Boiko, Madelline Boyd, Anna-Luisa Brakman, Greg Brockman, Tim Brooks, Miles Brundage, Kevin Button, Trevor Cai, Rosie Campbell, An- drew Cann, Brittany Carey, Chelsea Carlson, Rory Carmichael, Brooke Chan, Che Chang. Fotis Chantzis, Derek Chen, Sully Chen, Ruby Chen, Jason Chen, Mark Chen, Ben Chess, Chester Cho, Casey Chu, Hyung Won Chung, Dave Cummings, Jeremiah Currier, Yunxing Dai, Cory Decareaux, Thomas Degry, Noah Deutsch, Damien Deville, Arka Dhar, David Dohan, Steve Dowling, Sheila Dunning, Adrien Ecoffet, Atty Eleti, Tyna Eloundou, David Farhi, Liam Fedus, Niko Felix, Simón Posada Fishman, Juston Forte, Isabella Fulford, Leo Gao. Elie Georges, Christian Gibson, Vik Goel, Tarun Gogineni, Gabriel Goh, Rapha Gontijo-Lopes, Jonathan Gordon. Morgan Grafstein, Scott Gray, Ryan Greene, Joshua Gross, Shixiang Shane Gu, Yufei Guo, Chris Hallacy, Jesse Han, Jeff Harris, Yuchen He, Mike Heaton, Johannes Heidecke, Chris Hesse, Alan Hickey, Wade Hickey, Peter Hoeschele, Brandon Houghton, Kenny Hsu, Shengli Hu, Xin Hu, Joost Huizinga, Shantanu Jain, Shawn Jain, Joanne Jang, Angela Jiang, Roger Jiang, Haozhun Jin, Denny Jin, Shino Jomoto, Billie Jonn, Heewoo Jun, Tomer Kaftan, Lukasz Kaiser, Ali Kamali, Ingmar Kanitscheider, Nitish Shirish Keskar, Tabarak Khan, Logan Kilpatrick, Jong Wook Kim, Christina Kim, Yongjik Kim, Jan Hendrik Kirchner, Jamie Kiros, Matt Knight, Daniel Kokotajlo, Lukasz Kondraciuk, Andrew Kondrich, Aris Konstantinidis, Kyle Kosic, Gretchen Krueger, Vishal Kuo, Michael Lampe, Ikai Lan, Teddy Lee, Jan Leike, Jade Leung, Daniel Levy, Chak Ming Li, Rachel Lim, Molly Lin, Stephamie Lin, Mateusz Litwin, Theresa Lopez, Ryan Lowe, Patricia Lue, Anna Makanju, Kim Malfacini, Sam Man- ning. Todor Markov, Yaniv Markovski, Bianca Martin, Katie Mayer, Andrew Mayne, Bob McGrew, Scott Mayer McKinney, Christine McL.avey, Paul McMillan, Jake McNeil, David Medina, Aalok Mehta, Jacob Menick, Luke Metz, Andrey Mishchenko, Pamela Mishkin, Vinnie Monaco, Evan Morikawa, Daniel Mossing, Tong Mu, Mira Murati, Oleg Murk, David Mély, Ashvin Nair, Reüchiro Nakano, Rajeev Nayak, Arvind Neelakantan, Richard Ngo, Hyeonwoo Noh, Long Ouyang, Cullen O' Keefe, Jakub pachocki, Alex Paino, Joe Palermo, Ashley Pan- tuliano, Giambattista Parascandolo, Joel Parish, Emy Parparita, Alex Passos, Mikhail Pavlov, Andrew Peng, Adam Perelman, Filipe de Avila Belbute Peres, Michael Petrov, Henrique Ponde de Oliveira Pinto, Michael, Pokorny Michelle Pokrass. Vitchyr H. Pong, Tolly Powell, Alethea Power, Boris Power, Elizabeth Prochl, Raul Puri, Alec Radford, Jack Rae, Aditya Ramesh, Cameron Raymond, Francis Real, Kendra Rimbach, Carl Ross, Bob Rotsted, Henri Roussez, Nick Ryder, Mario Saltarelli, Ted Sanders, Shibani Santurkar, Girish Sastry. Heather Schmidt, David Schnurr, John Schulman, Daniel Selsam, Kyla Sheppard, Toki Sherbakov, Jessica Shieh, Sarah Shoker, Pranav Shyam, Szymon Sidor, Eric Sigler, Maddie Simens, Jordan Sitkin, Kata- rina Slama, Ian Sohl, Benjamin Sokolowsky, Yang Song, Natalie Staudacher, Felipe Petroski Such, Natalie Summers, Ilya Sutskever, Jie Tang, Nikolas Tezak, Madeleine B. Thompson, Phil Tillet, Amin Tootoonchian, Elizabeth Tseng, Preston Tuggle, Nick Turley, Jerry Tworek, Juan Felipe Cerón Uribe, Andrea Vallone. Arun Vijayvergiya, Chelsea Voss, Carroll Wainwright, Justin Jay Wang, Alvin Wang, Ben Wang. Jonathan Ward, Jason Wei, CJ Weinmann, Akila Welihinda, Peter Welinder, Jiayi Weng, Lilian Weng, Matt Wiethoff, Dave Willner, Clemens Winter, Samuel Wolrich, Hannah Wong, Lauren Workman, Sherwin Wu, Jeff Wu, Michael Wu, Kai Xiao, Tao Xu, Sarah Yoo, Kevin Yu, Qiming Yuan, Wojciech Zaremba, Rowan Zellers, Chong Zhang, Marvin Zhang, Shengjia Zhao, Tianhao Zheng, Juntang Zhuang, William Zhuk, and Barret Zoph. Gpt-4 technical report, 2024, URL //axxi org/oogg/aaoo.oooo.. 2203 2303.08774
[3] Rowan Zellers, Ari Holtzman, Hannah Rashkin, Yonatan Bisk, Ali Farhadi, Franziska Roesner, and Yejin Choi. Defending against neural fake news. Advances in neural information processing systems, 32, 2019.
[4] Rishi Bommasani, Drew A. Hudson, Ehsan Adeli, Russ Altman, Simran Arora, Sydney von Arx, Michael S. Bernstein, Jeannette Bohg, Antoine Bosselut, Emma Brunskill, Erik Brynjolfsson, Shyamal Buch, Dallas Card, Rodrigo Castellon, Niladri Chatterji, Annie Chen, Kathleen Creel, Jared Quincy Davis, Dora Demszky, Chris Donahue, Moussa Doumbouya, Esin Durmus, Stefano Ermon, John Etchemendy, Kawin Ethayarajh, Li Fei-Fei, Chelsea Finn, Trevor Gale, Lauren Gillespie. Karan Goel, Noah Goodman, Shelby Grossman, Neel Guha, Tatsunori Hashimoto, Peter Henderson, John Hewitt, Daniel E. Ho, Jenny Hong, Kyle Hsu, Jing Huang, Thomas Icard, Saahil Jain, Dan Jurafsky. Pratyusha Kalluri, Siddharth Karamcheti, Geoff Keeling, Fereshte Khani, Omar Khattab, Pang Wei Koh, Mark Krass, Ranjay Krishna, Rohith Kuditipudi, Ananya Kumar, Faisal Ladhak, Mina Lee, Tony Lee, Jure Leskovec, Isabelle Levent, Xiang Lisa
10

---

Li, Xuechen Li, Tengyu Ma, Ali Malik, Christopher D. Manning, Suvir Mirchandani, Eric Mitchell, Zanele Munyikwa, Suraj Nair, Avanika Narayan, Deepak Narayanan, Ben Newman, Allen Nie, Juan Carlos Niebles, Hamed Nilforoshan, Julian Nyarko, Giray Ogut, Laurel Orr, Isabel Papadimitriou, Joon Sung Park, Chris Piech, Eva Portelance, Christopher Potts, Aditi Raghunathan, Rob Reich, Hongyu Ren, Frieda Rong, Yusuf Roohani, Camilo Ruiz, Jack Ryan, Christopher Ré, Dorsa Sadigh, Shiori Sagawa, Keshav Santhanam, Andy Shih, Krishnan Srinivasan, Alex Tamkin, Rohan Taori, Armin W. Thomas. Florian Tramër, Rose E. Wang. William Wang, Bohan Wu, Jiajun Wu, Yuhuai Wu, Sang Michael Xie, Michihiro Yasunaga, Jiaxuan You, Matei Zaharia, Michael Zhang, Tianyi Zhang, Xikun Zhang, Yuhui Zhang, Lucia Zheng, Kaitlyn Zhou, and Percy Liang. On the opportunities and risks of foundation models, 2022. URL battps://arxiin org/ abs//108.072220
[5] Sebastian Gehrmann, Hendrik Strobelt, and Alexander Rush. GLTR: Statistical detection and visualization of generated text. In Marta R. Costa-jussà and Enrique Alfonseca, editors, Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics: System Demonstrations, pages 111-116, Florence, Italy, July 2019, Association for Com- putational Linguistics. doi: 10. 10.18663/11/P19-30199 URL https://acllatthooo// P19-3019/
org/
[6] Anton Bakhtin, Sam Gross, Myle Ott, Yuntian Deng, Marc' Aurelio Ranzato, and Arthur Szlam. Real or fake? learning to discriminate machine from human generated text, 2019, URL https: //ttps://axii...o org/ /wt./ 03351
[7] Adaku Uchendu, Thai Le, Kai Shu, and Dongwon Lee. Authorship attribution for neural text generation. In Bonnie Webber, Trevor Cohn, Yulan Hc, and Yang Liu, editors, Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP), pages 8384-8395, Online, November 2020. Association for Computational Linguistics. doi: 10. 1865// v1/2020.eemll-mmiin 673. httpsst:::/// pestps://acll http//ooccntoooog...oooo owrlloyy.goo//ooo 2220.20000.om emnlp-main. 6733
[8] Eric Mitchell, Yoonho Lee, Alexander Khazatsky, Christopher D. Manning, and Chelsea Finn. Detectgpt: zero-shot -eeeereee text detection using probability curvature. In Proceedings of the 40th International Conference on Machine Learning, ICML' JMLR.org, 2023.
[9] Tatsunori B. Hashimoto, Hugh Zhang, and Percy Liang. Unifying human and statistical evaluation for natural language generation. In Jill Burstein, Christy Doran, and Thamar Solorio, editors, Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologics, Volume 1 (Long and Short Papers), pages 1609-1701, Minneapolis, Minnesota, June 2019. Association for Computational Linguistics. doi: 18863//1//N/// 1169. URL https: / // /cl acw.anoolttooyyo.ooooooo org www.oorgg///eeeeee
[10] Irene Solaiman, Miles Brundage, Jack Clark, Amanda Askell, Ariel Herbert- Jeff Wu, Alec Radford, Gretchen Krueger, Jong Wook Kim, Sarah Kreps, Miles McCain, Alex Newhouse, Jason Blazakis, Kris McGuffie, and Jasmine Wang. Release strategies and the social impacts of language models, 2019. URL https: /topp:://arxiiz wwwpaarwww.....rraaaraaaaaaaaaae wbtggbbss1990... 09203
[11] Hyunseok Lee, Jihoon Tack, and Jinwoo Shin. Remodetect: Reward models recognize aligned LLM's generations. In The Thihty-eighth Annual Conference on Neural Information Processing Systems, 2024. URL httppp/s//pppprrrreeeeeeeet//ees prrt www.pwm111www
[12] Rafael Rafailov, Archit Sharma, Eric Mitchell, Christopher D Manning, Stefano Ermon, and Chelsea Finn. Direct preference optimization: Your language model is secretly a reward model. In Thirty-sevntth Conference on Neural Information Processing Systems, 2023. URL
[13] Junchao Wu, Runzhe Zhan, Derek F. Wong. Shu Yang. Xinyi Yang, Yulin Yuan, and Lidia S. Chao. DetectRL: Benchmarking LLM-gencrated text detection in real-world scenarios. In The Thihty-eight Conference on Neural Information Processing Systems Datasets and Benchmarks
Track, 2024. URL URR.http://ooperevviv net//oorumTi http:////pppppooeeeeeeee/a/aaaap
[14] Nisan Stiennon, Long Ouyang, Jeffrey Wu, Daniel Ziegler, Ryan Lowe, Chelsea Voss, Alec Radford, Dario Amodei, and Paul Christiano. Learning to summarize with human feedback. Advances in neural information processing systems, 33:3008-302.. 2020.
11

---

[15] Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida. Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, et al. Training language models to follow instructions with human feedback. Advances in neural information processing systems, 35:27730-27744, 2022.
[16] Ralph Allan Bradley and Milton E. Terry. Rank analysis of incomplete block designs: I. the method of paired comparisons. Biometrika, 39:324, 1952.
[17] Gemma Team, Morgane Riviere, Shreya Pathak, Pier Giuseppe Sessa, Cassidy Hardin, Surya Bhupatiraju, Léonard Hussenot, Thomas Mesnard, Bobak Shahriari, Alexandre Ramé, Johan Ferret, Peter Liu, Pouya Tafti, Abe Friesen, Michelle Casbon, Sabela Ramos, Ravin Kumar, Charline Le Lan, Sammy Jerome, Anton Tsitsulin, Nino Vieillard, Piotr Stanczyk, Sertan Girgin, Nikola Momchev, Matt Hoffman, Shantanu Thakoor, Jean-Bastien Grill, Behnam Neyshabur, Olivier Bachem, Alanna Walton, Aliaksei Severyn, Alicia Parrish, Aliya Ahmad, Allen Hutchi- son, Alvin Abdagic, Amanda Carl, Amy Shen, Andy Brock, Andy Coenen, Anthony Laforge, Antonia Paterson, Ben Bastian, Bilal Piot, Bo Wu, Brandon Royal, Charlie Chen, Chintu Kumar, Chris Perry, Chris Welty, Christopher A. Proouuette-hhoo Danila Sinopalnikov, David Weinberger, Dimple Vijaykumar, Dominika Rogoziñska, Dustin Herbison, Elisa Bandy, Emma Wang, Eric Noland, Erica Morcira, Evan Senter, Evgenii Eltyshev, Francesco Visin, Gabriel Rasskin, Gary Wei, Glenn Cameron, Gus Martins, Hadi Hashemi, Hanna Hiimczak-Plucisste Harleen Batra, Harsh Dhand, Ivan Nardini, Jacinda Mein, Jack Zhou, James Svensson, Jeff Stanway, Jetha Chan, Jin Peng Zhou, Joana Carrasqueira, Joana Iljazi, Jocelyn Becker, Joe Fernandez, Joost van Amersfoort, Josh Gordon, Josh Lipschultz, Josh Newlan, Ju yeong Ji, Kareem Mohamed, Kartikeya Badola, Kat Black, Katie Millican, Keelin McDonell, Kelvin Nguyen, Kiranbir Sodhia, Kish Greene, Lars Lowe Sjoesund, Lauren Usui, Laurent Sifre, Lena Heuermann, Leticia Lago, Lilly McNealus, Livio Baldini Soares, Logan Kilpatrick, Lucas Dixon, Luciano Martins. Machel Reid, Manvinder Singh, Mark Iverson, Martin Görner, Mat Velloso, Mateo Wirth, Matt Davidow, Matt Miller, Matthew Rahtz, Matthew Watson, Meg Risdal, Mehran Kazemi, Michael Moynihan. Ming Zhang, Minsuk Kahng, Minwoo Park, Mofi Rahman, Mohit Khatwani, Natalie Dao, Nenshad Bardoliwalla, Nesh Devanathan, Neta Dumai, Nilay Chauhan, Oscar Wahltinez, Pankil Botarda, Parker Barnes, Paul Barham, Paul Michel, Pengchong Jin, Petko Georgiev, Phil Culliton, Pradeep Kuppala, Ramona COmanescu, Ramona Merhej, Reena Jana, Reza Ardeshir Rokni, Rishabh Agarwal, Ryan Mullins, Samaneh Saadat, Sara Mc Carthy, Sarah Cogan, Sarah Perrin, Sébastien M. R. Arnold, Sebastian Krause, Shengyang Dai, Shruti Garg, Shruti Sheth, Sue Ronstrom, Susan Chan, Timothy Jordan, Ting Yu, Tom Eccles, Tom Hennigan, Tomas Kocisky, Tulsee Doshi, Vihan Jain, Vikas Yadav, Vilobh Meshram, Vishal Dharmadhikari, Warren Barkley, Wei Wei, Wenming Ye, Woohyun Han, Woosuk Kwon, Xiang Xu, Zhe Shen, Zhitao Gong, Zichuan Wei. Victor Cotruta, Phoebe Kirk, Anand Rao, Minh Giang. Ludovic Peran, Tris Warkentin, Eli Collins, Joelle Barral, Zoubin Ghahramani, Raia Hadsell, D. Sculley, Jeanine Banks, Anca Dragan, Slav Petrov, Oriol Vinyals, Jeff Dean, Demis Hassabis, Koray Kavukcuoglu, Clement Farabet, Elena Buchatskaya, Sebastian Borgeaud, Noah Fiedel, Armand Joulin, Kathleen Kenealy, Robert Dadashi, and Alek Andreev. Gemma 2: Improving open language models at a practical size, 2024. URL https: //tp:///////ia/ai org/ ht.b:/2488000
[18] Gemma Team, Thomas Mesnard, Cassidy Hardin, Robert Dadashi, Surya Bhupatiraju, Shreya Pathak, Laurent Sifre, Morgane Rivière, Mihir Sanjay Kale, Juliette Love, Pouya Tafti, Léonard Hussenot, Pier Giuseppe Sessa, Aakanksha Chowdhery, Adam Roberts, Aditya Barua, Alex Botev, Alex Castro-Ros. Ambrose Slone, Amélie Héliou, Andrea Tacchetti, Anna Bulanova, Antonia Paterson, Beth Tsai, Bobak Shahriari, Charline Le Lan, Christopher A. Choquette-Chon Clément Crepy, Daniel Cer, Daphne Ippolito. David Reid, Elena Buchatskaya, Eric Ni, Eric Noland, Geng Yan, George Tucker, George-Christiaan Muraru, Grigory Rozhdestvenskly. Henryk Michalewski, Ian Tenney, Ivan Grishchenko, Jacob Austin, James Keeling, Jane Labanowski. -aan-ttttstte Lespiau, Jeff Stanway, Jenny Brennan, Jeremy Chen, Johan Ferret, Justin Chiu, Justin Mao-Jones, Katherine Lee, Kathy Yu, Katie Millican, Lars Lowe Sjoesund, Lisa Lee, Lucas Dixon, Machel Reid, Maciej Mikula, Mateo Wirth, Michael Sharman, Nikolai Chinaev, Nithum Thain, Olivier Bachem, Oscar Chang, Oscar Wahltinez, Paige Bailey, Paul Michel, Petko Yotov, Rahma Chaabouni, Ramona Comanescu, Reena Jana, Rohan Anil, Ross Mcllroy, Ruibo Liu, Ryan Mullins, Samuel I. Smith, Sebastian Borgeaud, Sertan Girgin, Sholto Douglas, Shree Pandya, Siamak Shakeri, Soham De, Ted Klimenko, Tom Hennigan, Vlad Feinberg, Wojeiech
12

---

Stokowiec, Yu hui Chen, Zafarali Ahmed, Zhitao Gong, Tris Warkentin, Ludovic Peran, Minh Giang, Clément Farabet, Oriol Vinyals, Jeff Dean, Koray Kavukcuoglu, Demis Hassabis, Zoubin Ghahramani, Douglas Eek, Joelle Barral, Fernando Pereira, Eli Collins, Armand Joulin, Noah Fiedel, Evan Senter, Alek Andreev, and Kathleen Kenealy. Gemma: Open models based on gemini research and technology, 2024. URL https://axxxx org/ abs /200. 08295
[19]
An Yang, Baosong Yang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Zhou, Chengpeng Li, Chengyuan Li, Dayiheng Liu, Fei Huang, Guanting Dong, Haoran Wei, Huan Lin, Jialong Tang, Jialin Wang, Jian Yang. Jianhong Tu, Jianwei Zhang, Jianxin Ma, Jianxin Yang, Jin Xu, Jingren Zhou, Jinze Bai, Jinzheng He, Junyang Lin, Kai Dang, Keming Lu, Keqin Chen, Kexin Yang, Mei Li, Mingfeng Xue, Na Ni, Pei Zhang, Peng Wang. Ru Peng, Rui Men, Ruize Gao, Runji Lin, Shijie Wang, Shuai Bai, Sinan Tan, Tianhang Zhu, Tianhao Li, Tianyu Liu, Wenbin Ge, Xiaodong Deng. Xiaohuan Zhou, Xingzhang Ren, Xinyu Zhang, Xipin Wei, Xuancheng Ren, Xuejing Liu, Yang Fan, Yang Yao, Yichang Zhang, Yu Wan, Yunfei Chu, Yuqiong Liu, Zeyu Cui, Zhenru Zhang, Zhifang Guo, and Zhihao Fan. Qwen2 technical report, 2024. URL https: //tpvv////iiv/aeaa wwrxxiv..r///// abs/ aba/2407.... 2407 10671
[20] Qwen, :, An Yang, Baosong Yang. Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chengyuan Li, Dayiheng Liu, Fei Huang, Haoran Wei, Huan Lin, Jian Yang, Jianhong Tu, Jianwei Zhang. Jianxin Yang. Jiaxi Yang. Jingren Zhou, Junyang Lin, Kai Dang, Keming Lu, Keqin Bao, Kexin Yang. Le Yu, Mei Li, Mingfeng Xue, Pei Zhang, Qin Zhu, Rui Men, Runji Lin, Tianhao Li, Tianyi Tang, Tingyu Xia, Xingzhang Ren, Xuancheng Ren, Yang Fan, Yang Su, Yichang Zhang, Yu Wan, Yuqiong Liu, Zeyu Cui, Zhenru Zhang, and Zihan Qiu. Qwen2.5 technical report, 2025. URLhttpes /tatpp://arxiv...o arxiv. wwtggaas//12.....
[21] Abhimanyu Hans, Avi Schwarzschild, Valeriia Cherepanova, Hamid Kazemi, Aniruddha Saha, Micah Goldblum, Jonas Geiping, and Tom Goldstein. Spotting LLMs with binoculars: Zero- shot detection of machine generated machine-generated text. In Forty-first International Conference on Machine Learning, 2024. URL httph:t//ppenreeeee//e
[22] Yihuai Xu, Yongwei Wang, Yifei Bi, Huangsen Cao, Zhouhan Lin, Yu Zhao, and Fei Wu. Training-free free LLM- --M-eenertted text detection by mining token probability sequences. In The Thirteenth International Conference on Learning Representations, 2025. URL https
//openreview pppperreriee.ne/ffouuuiic.oo
[23] Jinyan Su, Terry Zhuo, Di Wang, and Preslav Nakov. DetectI.LM: Leveraging log rank information for zero-shot detection of machine-generated text. In Houda Bouamor, Juan Pino, and Kalika Bali, editors, Findings of the Association for Computational Linguistics: EMNLP 2023, pages 12395-12412. Singapore, December 2023, Association for Computational Linguisties. doi: 10. 00581/66332222333 1/t.://///033...nignemmmmmmppppp 2023 1.23.inndie fww.iiiiinggiii emnlp. 827/
URL httthttts///caatttti
org/
[24] Guangsheng Bao, Yanbin Zhao, Zhiyang Teng, Linyi Yang, and Yue Zhang. Fast-detectGPP:: Efficient zero-shot detection of machine-generated text via conditional probability curvature. In The Twelfth International Conference on Learning Representations, 2024. URL https
//openreview.. (tgperrwwriee..et/foooumraaaaaad aet//forumiid-BBocere8B3
[25] Nathan Lambert, Valentina Pyatkin. Jacob Morrison, LJ Miranda, Bill Yuchen Lin, Khyathi Chandu, Nouha Dziri, Sachin Kumar, Tom Zick, Yejin Choi, Noah A. Smith, and Hannaneh Hajishirzi. Rewardbench: Evaluating reward models for language modeling, 2024. URL
https://arxx: wwwpxiiw.orr///ooooooooo abs/ 13787
[26] Rui Yang. Ruomeng Ding, Yong Lin, Huan Zhang, and Tong Zhang. Regularizing hidden states enables learning generalizable reward model for LLMs. In The Thirty-eighth Annual Conference on Neural Information Processing Systems, 2024. URL https::tp////peereeel stte/forummidddjhhMtttt
[27] Xiaomeng Hu, Pin-Yo Chen, and Tsung- Yi Ho. RADAR: Robust Al-text detection via adversar- ial learning. In Sevethh Conference on Neural Information Processing Systems, 2023.
13

---

[28] Vivek Verma, Eve Fleisig, Nicholas Tomlin, and Dan Klein. Ghostbuster: Detecting text ghost- written by large language models. Kevin Duh, Helena Gomez, and Steven Bethard, editors. Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguisties: Human Language Technologies (Volume Long Papers), pages 1702-1717, Mexico City, Mexico, June 2024. Association for Computational Linguistics. doi: URL
11.18663/11/2224Amaall-oo 95/
[29] Yang Xu, Yu Wang, Hao An, Zhichen Liu, and Yongyuan Li. Detecting subtle differences between human and model languages using spectrum of relative likelihood. Yaser Al- Onaizan, Mohit Bansal, and Yun-Nung Chen, editors, Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages 10108-10121, Miami, Florida, USA, November 2024. Association for Computational Linguistics. doi: 10. 10.18653/v1/2224 emnip-main.564. URL htttt::stp//aattaiataaa
org/2024. org/22024.mmllppmain www.lemmii..m.meemmmm 564/
[30] Guangsheng Bao, Yanbin Zhao, Juncai He, and Yue Zhang. Glimpse: Enabling white- box methods use proprietary models for zero-shot -LM--genertted text detection. In The Thirteenth International Conference on Learning Representations, 2025. URL https
//oparrevies.net//fouumm22 http:/forummiddndnfue
[31] Xianjun Yang. Wei Cheng, Yue Wu, Linda Ruth Petzold, William Yang Wang, and Haifeng Chen. DNA-GPT: Divergent n-gram analysis for training-firee detection of GPT-generater text. In The Twelfth International Conference on Learning Representations, 2024. URL https
//openreview.c wttpennrrieee.nnt/fouum/iiaae Xlaxx=mmj
[32] Chengzhi Mao, Carl Vondrick, Hao Wang, and Junfeng Yang. Raidar: generative AI detection via rewriting. In The Twelfth International Conference on Learning Representations, 2024.
URL httpp/////ppppeeeeeeeeeeeeeeeeea wtt..r//oouuur..ccto0/uuuuuuum
[33] Shixuan Ma and Quan Wang. Zero-shot detection of LLM-generated text using token cohesive- ness. In Yaser Al-Onaizan, Mohit Bansal, and Yun-Nung Chen, editors, Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages 17538-17553, Mi- ami, Florida, USA, November 2024. Association for Computational Linguistics. doi: 10.18653/ #1/2024.emnlp mainnnlppmmnmmmmmmm main 971. URL httpsttts:/// acl awl.nnhologgy....ooooooooooooooe org 2024, emnlp-main. 971/
[34] Lifan Yuan, Wendi Li, Huayu Chen, Ganqu Cui, Ning Ding, Kaiyan Zhang, Bowen Zhou, Zhiyuan Liu, and Hao Peng. Free process rewards without process labels, 2024. URL https
//arxiv. warxiv.org//o.o..o.........ooo.r ooggabs// absa 2412. 01981
[35]
Liam Dugan, Alyssa Hwang, Filip Trhlik, Andrew Zhu, Josh Magnus I Ludan, Hainiu Xu, Daphne ippolito, and Chris Callison-Burch. RAID: A shared benchmark for robust evalua- tion of machine-generatee text detectors. In Lun-We Wei Ku, Andre Martins, and Vivek Sriku- mar, editors, Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 12463-12492 Bangkok, Thailand, August 2024. Association for Computational Linguistics. doi: 10. 16653/v1/2024.ack https://aclanthool
URL
org/ 2024. acl long. 674/
[36] Zhihui Chen, Kai He, Yucheng Huang, Yunxiao Zhu, and Mengling Feng. Divscore: Zero-shot detection of I1m- -enereeed text specialized domains, 2025. URL /tttp::////: org/
abs/2506 .660056655.
[37] Chris Yuhao Liu, Liang Zeng, Yuzhen Xiao, Jujie He, Jiacai Liu, Chaojic Wang. Rui Yan, Wei Shen, Fuxiang Zhang, Jiacheng Xu, Yang Liu, and Yahui Zhou. Skywork-reward-v2: Scaling preference data curation via human-ai synergy, 2025. URL httpp:://axxvv.rrrg..p.. art.///////////1 01352)
14

---

NeurIPS Paper Checklist
Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: See Abstract and section 1.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results be expected to generalize other settings.
is fine include aspirational goals as motivation as long is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification: See Section
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those not discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification. asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low images are taken in low lighting. Or speech-to-text system might be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach address problems of privacy and faimess.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [NA]
15

---

Justification:
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated referenced in the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that affects the main claims and/or conclusions of the paper (regardless whether the code and data are provided or not)?
Answer: [Yes]
Justification: See section 4.1.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how to reproduce that algorithm.
(b) the contribution is primarily a new model architecture, the paper should describe the architccture clearly and fully.
(c) If the contribution is new model (e.g., a large language model), then there should either way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reprodueibility. the case of closed-source models, may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
16

---

Answer: [Yes]
Justification:
We provide codes and data with instruction files in supplemental materials.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips.. cc/
for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurlPS code and data submission guidelines (https
/
wwt.Suubmisioooooiiooooooooo for more details.
The authors should provide instructions on data access and preparation, including how access the raw data, preprocessed data, intermediate data, and generated data,
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended the paper) is recommended, but including URLs to data and code is permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification:
See appendix A.1.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core the paper to a level detail that is necessary appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, supplemental material.
7. Experiment statistical significance
Does the paper report error bars suitably and correctly defined other appropriate information about the statistical significance of the experiments?
Question:
Answer: [No]
Justification: Our method deterministic and does not involve stochastic components such as random initialization, sampling, or data splits. Therefore, statistical significance measures or error bars are applicable.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.
The factors of variability that the error bars capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
17

---

It should be clear whether the error bar is the standard deviation or the standard error of the mean.
is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables figures symmetric error bars that would yield results that are out range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain the text how they were calculated and reference the corresponding figures tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: See section 4.1.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't 't make it into the paper).
9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics
Answer: [Yes]
Justification:
We confirm paper with the NeurlPS Code of Ethics.
Guidelines:
The answer NA means that the authors have reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., there special consid- eration due to laws or regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: See section 6.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No. they should explain why their work has no socictal impact why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
18

---

The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility ML).
11. Safeguards
Question:
Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Answer: [NA]
Justification: We do not release any data or models in this paper, and thus no specific safeguards are required.
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g.. code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification:
We have clearly cite all the existing assets used.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (c.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the batasets.papersstt paperswi thcode. cww/ datasets package should be provided. For popular datasets,
has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
19

---

If this information is not available online, the authors are encouraged to reach out to the asset's creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification:
We do release new
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/mmoel as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsoureing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification: None.
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included the main paper.
According the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Question:
Answer: [NA]
Justification: None.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and expect authors to adhere to the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such the institution conducting the review.
16. Declaration of LLM usage
20

---

Question: Does the paper describe the usage of LLMs if it is important, original, or non-standard component of the core methods this research? Note that if the LLM used only for writing, editing, or formatting purposes and does not impact the core methodology, scientific rigorousness, or originality the research, declaration is not required.
Answer: [Yes]
Justification: Our proposed method IRM leverages publicly available LLMs, including instruction-tuna tuned and base models, to construct an implicit reward model for L.M--genertted text detection. These models are integral to the core methodology and are clearly described in the main text.
Guidelines:
The answer NA means that the method development in this research does involve LLMs as any important, original, or non non-standard components.
Please refer to our LLM policy (https://neun)) / http///rppppcccooeeeeeeeeeeeeeee /ct.c/ooeeeeeeccee2225////////// for what should or should not be described.
21

---

A Details of Main Experiments
A.1 Details of Models and Datasets
Table 6: Statistic of DetectRL benchmark.
Setting
Sub Setting
Size
Academic
2008
News
2008
Multi-Domain
Creative
2008
Social Media
2008
GPT-3.5-turbo 2008
Claude-instant
2008
Multi-LLM
PaL-M-2-bison
2008
Llama-2-700
2008
Direct
2016
Prompt
2032
Multi-Attack
Paraphrase
2016
Perturbation
2016
Data Mixing
2008
Varing Text Length
16200
Direct
2016
Paraphrase
2016
Human Writing
Perturbation
2016
Data Mixing
2012
Table 7: Dataset and model details.
Name Used
Full Name
Author
Source
DetectRL
DetectRL
13
GitHub
3aama-322-3B-nnsinn
meta
HuggingFac Face
Llama-3.2-38
meta-llama/l
meta
Huggingrace
1amma-3.--1B-Insmmeee
meta-llama/l
HuggingFace
1.ama-3.2-1B
meta- (tttlllamm/lllma33.222
Hugging Face
Gemma-2-22 2-22-it
google/gemma-2-2b-it
Hugging Face
Gemma-2.
google/gemma-2226
Hugeing Face
Demma-2B-it
google/gemma-222265
HugeingLac Pace
Gemma-22
google/gemmaa-2226
18
Hugging Face
20
Hugging
Qwen2.5-1.5B
Qwen/Qwen2.5-115B
20
Hugging Face
Qwen2.5-0.5BIInstee
Qwen/Qwen2.5-005B Instrucct
20
Hugenngrace
Qwen2.5-0.5B
Qwen/Qwen2.5-005BB
20
Hugeing raace
Owen2-1.5B-Instaee
Qwenn/Owen2-11S---innntue
19
Huguing
Qwen2-1.5p
Qwen/Qwen2-I.5B
Hugying
Owen2-0.5B-Instruus
Owcnn/Owen--0.5B-Immmtt
19
Hugying
Qwen2-0.5B
Qwcn/Qwen2-005B
19
Hugging
RMM-Debetaa<33-arge-22
OpenAssistant
Hugging
ReMaDetect
byunneok//ReMaDDDeeerhhhhhrr
11
Hugging
CRM-gemma2-28
Ray2333/GMM-gemmaa
26
Hugging Face
GRM-Llama332-3B
Ray2333/GRM
-lamm--- Beeaa----eeardnodeeeeee.
26
HuggingFace
22

---

A.2 Detailed Results of Main Results
Table The performance of various detection methods in the multi-domain task. The best results are marked in bold and the second best results are marked by underline.
Metrics
AUROC Fi
AUROC Fi
AUROC F. AUROC Fi
AUROC
Domain Settings-
ArXiv
XSum
Writing
Review
Avg.
Gemuna-2-22 2-22-r
Log-Likelihood
74.48
68.01
59.84
54.29
81
74.37
83.44
78.34
74.75
68.75
Rank
50.87
41.75
41.25
28.91
60.26
54.23
61.86
56.92
53.56
45.45
Log-Rank
76.11
70.78
61.23
55.84
81.18
74.43
84.60
78.19
75.78
69.81
LRR
78.98
73,43
65.07
78.80
70.29
79.01
77.43
70.81
Pest-DetecIGPT
73.25
67.17
70.92
68.41
61.06
68
61.18
70.26
Lastde
65.63
58.99
58.50
52.64
58.52
52.81
59.84
58.89
60.62
55.83
Gemma-2-2B family (Gemma-2-2B-it Gemma--22BB
Binoculars
84.07
79.69
69.40
64.60
84.60
75.80
85.34
78.20
80.85
74.57
IRM
97.17
91.24
96.55
76.47
69.18
68
59.60
84.65
77.70
Llama-3.2- 3---IB-nstrucct
Likelihhooo
79.00
72.61
67.10
61.74
83.15
76.22
88.37
83.38
79.40
73.49
Rank
58.48
51.12
44.80
37.06
59.81
56.76
75.50
69.87
59.65
53.70
Log-Rank
73.63
67.55
60.60
83.12
76.54
88.56
82.89
79.64
73.41
LRR
77.46
69.80
65.95
81.25
74.68
87.29
78.85
77.99
70.66
Fust-DetecIGPT
85.71
78.26
78.71
72.16
42.42
24.82
65.33
58.50
68.04
58.44
Lastde
80.17
71.95
65.55
59.82
52.15
38.66
62.59
53.68
65.11
Llama-3.2-14 family (Llama-3.2-11
Binoculars
93.17
86.51
88.43
81.16
92.03
84.95
96.27
89.91
92.48
85.63
IRM
98.56
95.02
98.45
95.15
97.84
93.19
91.65
97.97
93.75
Reward Models
ReMoDetect
92.34
84.63
80.74
75.92
98.12
93.33
96.75
89.92
91.99
85.95
AM--eehrta-v3-llagee--
58.16
45.78
59.37
52.06
95.49
89.59
79.30
72.62
73.08
65.01
GGMM-gemma2-28
33.30
1.18
63.47
57.68
70.16
64.95
37.33
0.98
51.07
31.20
GRM Llama3.2222 3B
45.94
19.45
43.20
66.08
58.82
3.31
45.47
21.27
23

---

Table 9: The performance of various detection methods in the multi-LLM task. The best results are marked in bold and the second best results are marked by underline.
Metries
AUROC Fi
AUROC
Fi
AUROC
F.
AUROC Fi AUROC
LLM Settings
GPT-3.5
Claude
PaLM-2
Llama-2
Avg.
Gemma-2-222
LikeLikeddoodd
78.20
69.58
51.97
29.87
80.40
73.01
88.03
78.78
74.65
62.81
Rank
55.17
47.92
48.46
41.12
52.18
44.44
57.99
49.09
53.45
45.64
Log-Rank
78.48
69.46
54.43
38.13
80.76
73.14
88.81
80.73
75.62
65.36
LRR
76.60
68.24
62.97
48.44
79.08
69.57
88.58
80.25
76.81
66,62
Fust-DetecIGPT
67.94
62.45
38.21
20.61
81.85
74.71
90.02
81.62
69.51
59.85
Lastde
57.40
58.63
44.49
29.57
65.51
63.65
71.39
67.78
59.70
54.91
Gemmu-2-22 2B family (Gemma-2-2B-irc 1en----ii-eemma----
Gemma-2-2B)
Binoculars
77.48
69.55
62.21
48.61
89.44
82.36
92.61
84.43
80.43
71,24
IRM
84.03
75.68
86.46
78.44
88.65
79.41
87.11
76.21
86.56
77.43
1lama-3.2- 18-1t-hsttrct
Log-L LigLiikelhood
83.26
77.22
59.05
45.91
83.76
76.20
92.63
86.03
79.67
71.34
Rank
63.72
55.82
51.31
36.78
58.10
51.88
64.86
58.90
59.50
50.84
Log-Rank
82.98
74.79
59.73
48.50
83.75
76.31
92.67
86.41
79.78
71.50
LRR
79.73
71.92
60.56
49.61
80.75
72.97
90.13
82.81
77.79
69.33
Fast-Detect DeteccteePTT
66.27
61.23
44.10
23.85
79.15
72.33
84.96
77.47
68.62
58.72
Lastde
57.91
49.93
54.02
42.85
67.54
60.69
76.18
68.69
63.91
55.54
Llama-3.2 3.B-IB family (Llama-3.2-1D I-0---Instttttttt
Llama-3.2-12)
Binoculars
92.26
84,89
81.38
74.40
95.56
90.90
99.10
96.50
92.08
86.67
IRM
97.40
92.22
96.27
89.79
95.95
89.88
99.35
96.58
97.24
92.12
Reward Models
ReMoDetect
96. 14
89.24
82,26
76.74
87.82
79.01
95.41
87.68
90.41
83.17
DDeberta-v3-largee
78.16
70.24
65.27
51.88
64.61
71.44
73.45
66.08
70.37
64.91
GR CiRM-gemma2--2
60.93
63.53
53.03
56.21
41.78
1.75
46.52
59.78
50.57
45.32
GRM-Llama3.2-35 59.63
46.36
36.70
0.98
43.56
25.71
44.69
18.33
46. 15
22.85
Table 10: The performance of various detection methods in the multi-attack task. The best results marked in bold and the second best results are marked by underline.
Metries
AUROC Fi
AUROC Fl
AUROC Fi
AUROC Fi
AUROC Fl
AUROC Fi
Attack Settings
Direct
Prompt
Paraph.
Perturb
Mixing
Avg.
Gemmo-2-28-it
Likelikel
94.95
88.15
90.97
84,30
70.95
63.77
$9.70
54.04
73.01
62.96
77.92
70.65
Rank
79.26
69.84
79.06
70.58
67.04
54.58
14.08
00.00
48.64
35.71
$7.62
46.14
Log-Rank
95.25
88.56
91.21
84.38
71.40
64.61
61.72
55.57
74.19
63.71
78.75
71.37
LRR
93.16
85.08
88.92
80.63
70.88
63.38
67.39
59.72
76.07
67.77
79.28
71.32
Fust-Detec1GFT
90.59
83.81
84.84
81.34
73.33
68.05
48.55
35.48
69.16
61.41
73.30
66.02
Lastde
91.75
84.12
87.26
81.02
71.32
60.46
18.77
0.00
61.45
55.96
66.11
56.31
Gemma-2-2B 2-28 fumily (Gemmm----2B--ee 12--2-it+-G0 222---t-Gemma--222
Binoculars
97.19
91.76
93.27
88.30
79,39
73.27
66.54
57.00
78.59
72.55
83,00
76.58
IRM
89.13
80.01
88.12
77.83
85.50
77.67
85.44
74.45
92.70
85.13
88.38
79.02
Llama- 3.2 I-I--Instrcct
Log-1 likelihood
76.31
Rank
86.85
76.62
85.57
76.43
72.80
62.55
18.43
00.00
54.55
46.14
63.60
$2.35
Log-Rank
97.06
92.08
93.49
87.83
76.40
70.75
67.16
56.74
78.66
69.46
82.55
75.37
LRR
87.67
63.73
74.67
79.56
70.65
Fast-Detecte DetectGPT
63.94
56.31
60.30
53.76
69.95
63.01
72.12
65.21
81.54
74.05
69.58
62.47
Lastde
87.30
79.51
82.70
74.39
74.29
64.53
3..80
66.69
7.886
61.99
69.59
69.42
Llamu- 3.2-18 fananill (1lamu-3..221 hustrucc+ Lluna 3.2 1B]
Binoculars
99.15
96.10
96.52
91.94
90.56
83.01
88.62
81.60
90.37
82.46
93.04
87.02
IRM
98 94
95.52
97.70
93.02
98.00
92.57
95.65
88.65
95.68
90.28
97.19
92.01
Reward Models
ReMoDetect
97.12
91.00
93.47
84.59
88.59
73.86 86
88.
80.44
88.19
80,55
91.22
82.09
RM Dewerta--h--arreeeee
v3-large-v2
81.88
73.10
76.54
65.28
62.23
45.66
70.96
70.44
65.11
62.74
71.34
63.44
GRM-gemma2-2B
57.93
56.02
56.33
$2.33
46.54
66.68
47.42
63.66
45.20
61.15
50.69
59.97
54.84
46.79
53.77
41.73
44.56
34.62
39.87
6.92
49.75
23.95
48.56
30.80

---

Table 11: The performance of various detection methods in the human writing task. The best results are marked in bold and the second best results are marked by underline.
Metries
AUROC Fi
AUROC Fi
AUROC F
AUROC Fi
AUROC Fi
Attack Settings +
Direct
Paraph.
Perturb
Mixing
Avg.
Gemma-2-22 2-2B-i
Log-Likelihood
94.96
88.15
83.10
76.82
99.78
98.56
93.28
86.64
92.78
87.54
Rank
79.27
69.84
70.44
64.51
97.48
93.54
69.03
59.18
79.05
71.77
Log-Rank
95.25
88.56
83,20
78.49
99.81
98.60
93.80
86.53
93.02
88.05
LRR
93.16
85.08
81.79
78.78
99.41
96.66
91.27
82.49
91.41
85.75
Fust-DetecIGPT
90.59
83.82
77.95
71.34
98.61
94.92
91.09
84.37
89.56
83.61
Lastde
91.75
84.12
78.53
75.68
99.66
97.53
92.62
85.20
90.64
85.63
Gemmu-2-22 family (Gemma-2-22-irz
Gemma-2-28)
Binoculars
97.19
91.77
81.44
77.73
99.85
98.51
94.67
88.28
93.29
89.07
IRM
89.13
80.02
64.60
60.92
75.28
74.29
95.77
88.92
81.19
76.04
Alama-3.2-1 3.2--....BBBBBB 2--I--nstruct
Log-Likelin Likeeiied
97.03
91.67
83.00
78.12
99.95
99.26
96.11
90.34
94.02
Rank
86.65
76.62
70.69
70.07
99.55
97.52
80.58
68.60
84.37
78.20
Log-Rank Log- Rank
97.06
92.08
82.78
78.16
99.96
99.45
95.98
89.52
93.94
89.81
LRR
94.55
87.67
80.36
77.37
99.79
97.91
91.80
83.91
91.62
86.72
Fast-DetectGPT
63.95
56.32
52.58
42.72
47.42
40.47
79.36
72.98
60.83
53.12
Lastde
87.30
79.51
73.02
70.37
97.98
93.72
91.79
84.38
87.52
82.00
Llama-3.2- 3.2-1B 3 family (Llama-3.2-18 I-n---Insuct++
-.a.a-..amaaaa--ma 3.2-1B)
Binoculars
99.16
96.10
81.25
78.81
99.84
98.56
98.26
93.82
94.63
91.82
IRM
98.94
95.52
80.84
76.22
99.35
96.33
98.79
95.06
94.48
90.78
Reward Models
ReMoDetect
97.12
91.00
76.02
74.91
99.51
97.09
93.89
87.59
91.63
87.65
beeherta-v3-large-..
81.88
73.10
78.40
75.71
88.37
79.06
77.29
70.60
81.48
74.62
GRM--emmaa--21
57.94
56.03
68.50
61.71
69.80
65.10
58.53
58.63
63.69
60.37
GRM-Llama3.2-31
54.84
46.79
63.65
59.71
65.91
59.13
58.44
52.93
60.71
54.64
25

---

B Additional Experiments
B.1 Additional Benchmarks
Settings. We further evaluate our method on the RAID 35 and DivScore [36] benchmarks. We adopt LLaMA-3.2-IB as the backbone detector, which demonstrated strong performance on the DetectRL benchmark. For the RAID benchmark, due to the large scale, we randomly sample 512 annotated pairs from the training split for each source model. We report AUROC as the main evaluation metric. For the DivScore benchmark, we use the official test split for evaluation and report both AUROC and Fi Score. Since the lengths of test samples vary considerably, we compute the mean of implicit rewards across all tokens, instead of the sum (Eq. 5t. to normalize the decision threshold, which empirically shows an approximately linear relationship with text length (see Figure 4
Table 12:
Results on RAID benchmark.
Method
chatgpt
gpe4
gpt3
gpt2
llama-chat
mistral
mistral-chut
mpt
mpt-chat
cohere
cobere-chat
Log-Likelihood
98.48
93.51
97.35
68.77
98.93
97.78
48.84
80.08
89.26
92.42
Log-Rank
98.71
92.95
96.94
71.13
99.12
71.34
98.03
51.83
81.27
87.43
91.89
Binoculars
99.66
96.38
99.12
79.30
99.05
72.45
98.22
51.99
83.41
97.06
98.00
IRM
99.58
99.27
87.43
86.31
99.99
62.25
99.35
57.57
92.42
87.14
92.10
ReMoDetect
99.69
97.82
94.57
57.36
99.33
59.18
97.70
43.06
89.63
85.29
93.02
Table 13: Results on DivScore benchmark.
DeepSeek-R
DeepSeek V3 AUROC
GPT-4o
O3-mini
Avg.
Method
AUROC
F1
AUROC
AUROC
AUROC
F1
Log-Likelihoo
88.64
86.11
98.87
97.68
85.96
81.50
90.37
87.47
90.96
88.19
Log-Rank
87.56
84.85
98.91
97.69
86.28
82.34
90.86
88.01
90.90
88.22
Binoculars
98.03
94.18
99.87
99.03
94.84
90.74
95.61
91.88
97.09
93.96
IRM
97.39
93.67
99.27
97.77
99.08
96.74
97.95
94.25
96.61
ReMoDtect
95.86
90.69
99.73
98.20
99.56
97.46
98.73
94.73
98.47
95.27
IRM performs competitively across a wide range of models, supporting the generalizability of our approach.
Results.
shown in Table 12 and Table 13
B.2 Additional Baselines
models as additional baselines. These reward models are trained on large-scale preference data and use backbones up to 8B parameters. They achieve SOTA on the RewardBench benchmark, providing a strong reference evaluate whether reward model scaling enhances generalization in L.M--geeerteed text detection.
Settings. We further include Skywork Reward-V V2
Skywork-Reward-
Table 14: Comparison of IRM and Skyywork-Reward V2 on the DetectRL benchmark.
Tasks Settings
Multi- Domain AUROC
Malti- LLM
Multi- Attack
Generalizatinn
Length
Human
Domain F.
LLM F,
Attack
Truin F;
Test
Writing
Methods
AUROC
AUROC
AUROC
ZJoma-3.
Skywork- Rewwedew
71.33
62,97
70.67
66.
65.85
59.06
65.
63.23
45.41
61.78
39.32
58.74
IRM
90.52
84.67
89.01
83.18
88.70
82.13
81. 10
79.3
81.47
74.28
76.78
82.61
76.11 18
$2.31
3.2-1-
Skywook Reward
63.48
48.47
63.33
57.78
60.32
41.35
44.50
$6.99
32.58
34.77
49.65
30.52
6.91
45.43
IRM
97.25
97.21
Skywork RV
68.21
57.01
67.94
62.23
66.08
55.31
54.21
61.97
40.19
46.90
35.00
19.82
52.97
IRM
14,42
58.02
73.08
39.05
73.70
62.
55.77
$7.90
61.15
42.54
41.27
09.61
58.49
60.57
Results. As shown Table 14 IRM consistently outperforms the ewwardmmoellbbase methods, even when using the same or smaller backbones. This further supports our claim that standard preference- trained reward models, despite their size and strong performance on preference classifica- tion, do not generalize well to the LLM LLM-generated generated text detection task. In contrast, IRM's implicit reward modeling inherently aligned with this detection objective, leading to robust performance across different settings.
26

---

Algorithm 1 Inference pipeline of IRM
Inputs: policy model wa, reference model Tel. detected text decision threshold Output: authenticity label E (human-written, LLM-ggnnrated]
1: Prot f (x)
2: Py (2)
3: < log - log Pref
> Compute implicit reward score
4: if then
5:
< human-written
6: else
7:
< LLM-gennrater
8: end if
9: return
27


Reviews:
[{"review_id": "DZgZcFYlyX", "reviewer": "Reviewer_xWbt", "summary": "This paper proposes IRM, a zero-shot LLM text detector based on implicit reward models. It uses instruction-tuned and base model pairs to compute their log likelihood ratio, which serves as the detector signal. These implicit reward models have the benefit of not needing to train an explicit reward model for the task of LLM detection, and instead directly use pre-trained instruction-tuned and base model pairs, which are generally readily available. Experiments show improved performance compared to other zero-shot LLM detection methods, and directly supervised methods, like the ones that train a direct reward model.", "questions": "See weaknesses.", "limitations": "yes", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 2, "significance": 2, "originality": 3, "strengths_and_weaknesses": "Strengths\n- the paper is well-written and easy to follow \n- the method is novel for the text detection scenario. I do not believe any other method has used the log likelihood ratio used in RLHF as a signal for LLM text detection\n- Experiments are fairly extensive, covering multiple domains, models, attacks on detectors (such as rewriting). \n- A study on the impact of text length is also provided, which has not been extensively reported in prior works, and is helpful to know the limitations of the method\n\nWeaknesses\n- Intuitively, if text comes from the preference dataset, shouldn't they have high implicit reward, even if written by a human, since the preference dataset should align more with what humans would write? This seems to contradict the intuition provided in the paper (Figure 1, right side). I am curious how this figure would look if we compared the implicit reward distribution between preference data, non-preference data, for both human and LLM versions. While any detector signal (such as implicit reward) can in theory be used, it would be great to clarify the intuition behind the implicit reward. \n- An additional benchmark dataset would help strengthen the paper, such as RAID (https://arxiv.org/abs/2405.07940). While DetectRL covers many scenarios, it would help support the papers claims if at least one other standard benchmark dataset suite is included. \n- It would be helpful to understand the effect of LLM size on the detector performance, similar to https://arxiv.org/pdf/2305.09859 for DetectGPT. This would help users understand which instruction-tuned/base model policy pairs and their sizes are the most \"universal\" across LLMs and datasets..\n- Is there a fully-supervised classifier baseline, such as RoBERTa? The fully supervised models seem trained for reward modeling, but I wonder how a baseline that directly tries to classify human/LLM text would compare.", "was_revised": true, "final_justification": "The authors have addressed all of my concerns, so I am raising my score.", "rebuttal": "> Weakness1: Intuitively, if text comes from the preference dataset, shouldn't they have high implicit reward, even if written by a human, since the preference dataset should align more with what humans would write? This seems to contradict the intuition provided in the paper (Figure 1, right side). I am curious how this figure would look if we compared the implicit reward distribution between preference data, non-preference data, for both human and LLM versions. While any detector signal (such as implicit reward) can in theory be used, it would be great to clarify the intuition behind the implicit reward. \n\nThank you for the thoughtful comment. We understand the intuition that preferred texts should receive high reward scores, possibly even human-written ones. However, we would like to clarify a key point: in RLHF pipelines, preference datasets consist of multiple LLM-generated responses, which are then ranked by human annotators. They do not include human-written completions labeled as “preferred.” This distinction is critical: the reward model is trained to distinguish between better and worse LLM outputs, not between LLM-generated and human-written texts.\n\nWe believe this confusion may stem from conflating “human-preferred” with “human-written.” While human-written texts may be of high quality, they are not optimized to align with the reward model. In contrast, LLM outputs in RLHF are directly optimized to maximize reward scores. This explains the distribution shown in Figure 1 (right): LLM outputs tend to have higher IRM scores than human-written ones, reflecting their alignment with the learned reward model.\n\nThis misunderstanding is further compounded by how ReMoDetect constructs its training data. Unlike RLHF preference datasets that rely on pairwise human annotations, ReMoDetect labels LLM outputs as “preferred” and human-written texts as “dispreferred” without any human annotation. While useful for detection tasks, they differ substantially from the RLHF reward model’s training setup and may inadvertently blur the line between \"human-preferred\" and \"human-written.\"\n\nWe also appreciate the suggestion of comparing IRM score distributions across more fine-grained categories (e.g., preference vs. non-preference subsets for both LLM and human text). While insightful, such comparisons would require carefully constructed datasets containing both LLM-generated and human-written responses with explicit human preference annotations—which, to our knowledge, do not currently exist, as they would be prohibitively expensive and would undermine the scalability motivations behind RLHF.\n\nWe hope this clarification helps reconcile the intuition and resolves the concern.\n\n> Weakness2: An additional benchmark dataset would help strengthen the paper, such as RAID. While DetectRL covers many scenarios, it would help support the papers claims if at least one other standard benchmark dataset suite is included.\n\nWe sincerely appreciate the reviewer’s thoughtful suggestion to evaluate our method on an additional benchmark dataset such as RAID. We agree that demonstrating generalization across diverse benchmarks is important for validating the robustness of detection methods. In response, we have conducted comprehensive experiments on two benchmark in addition to DetectRL: RAID [1] and DivScore [2].\n\nWe firstly evaluate our method on the RAID benchmark. Due to the large size of the dataset, we randomly sample 512 annotated pairs for each source model from the training split for evaluation. We adopt LLaMA-3.2-1B as the backbone detector, as it showed strong performance on DetectRL. We report AUROC as the main evaluation metric.\n\n| Method     | chatgpt | gpt4  | gpt3  | gpt2  | llama-chat | mistral | mistral-chat | mpt   | mpt-chat | cohere | cohere-chat |\n|-|-|-|-|-|-|-|-|-|-|-|-|\n| Log-Likelihood | 98.48   | 93.51 | 97.35 | 68.77 | 98.93      | 69.82   | 97.78        | 48.84 | 80.08    | 89.26  | 92.42       |\n| Log-Rank    | 98.71   | 92.95 | 96.94 | 71.13 | 99.12      | 71.34   | 98.03        | 51.83 | 81.27    | 87.43  | 91.89       |\n| Binoculars | 99.66   | 96.38 | 99.12 | 79.30 | 99.05      | 72.45   | 98.22        | 51.99 | 83.41    | 97.06  | 98.00       |\n| IRM        | 99.58   | 99.27 | 87.43 | 86.31 | 99.99      | 62.25   | 99.35        | 57.57 | 92.42    | 87.14  | 92.10       |\n| ReMoDetect | 99.69 | 97.82 | 94.57 | 57.36 | 99.33| 59.18 | 97.70| 43.06 | 89.63| 85.29  | 93.02  |\n\nAs shown in the above Table, IRM achieves competitive performance across a wide range of models, demonstrating the generalizability of our approach beyond the original DetectRL setup.\n\nTo further assess our method’s robustness in domain-specific and high-stakes settings, we additionally evaluate on DivScore [2], a recently released benchmark containing human preference data in legal and medical domains. It includes outputs from four reasoning-oriented LLMs: DeepSeek-R1, DeepSeek-V3, GPT-4o, and O3-mini. We use the official test split for evaluation and adopt LLaMA-3.2-1B as the backbone.\n\n| Method         | DeepSeek-R1 |       | DeepSeek-V3 |       | GPT-4o |       | O3-mini |       | Avg.  |       |\n|----------------|-------------|-------|-------------|-------|--------|-------|---------|-------|-------|-------|\n|                | AUROC       | F1    | AUROC       | F1    | AUROC  | F1    | AUROC   | F1    | AUROC | F1    |\n| Log-Likelihood | 88.64       | 86.11 | 98.87       | 97.68 | 85.96  | 81.50 | 90.37   | 87.47 | 90.96 | 88.19 |\n| Log-Rank       | 87.56       | 84.85 | 98.91       | 97.69 | 86.28  | 82.34 | 90.86   | 88.01 | 90.90 | 88.22 |\n| Binoculars     | 98.03       | 94.18 | 99.87       | 99.03 | 94.84  | 90.74 | 95.61   | 91.88 | 97.09 | 93.96 |\n| IRM            | 97.39       | 93.67 | 99.27       | 97.77 | 99.08  | 96.74 | 97.95   | 94.25 | 98.42 | 96.61 |\n| ReMoDtect      | 95.86       | 90.69 | 99.73       | 98.20 | 99.56  | 97.46 | 98.73   | 94.73 | 98.47 | 95.27 |\n\n| Method         | DeepSeek-R1 |       | DeepSeek-V3 |      | GPT-4o |       | O3-mini |      | Avg.  |      |\n|----------------|-------------|-------|-------------|------|--------|-------|---------|------|-------|------|\n|                | FPR         | FNR   | FPR         | FNR  | FPR    | FNR   | FPR     | FNR  | FPR   | FNR  |\n| Log-Likelihood | 21.44       | 9.19  | 3.23        | 1.50 | 15.00  | 19.02 | 17.48   | 9.11 | 14.29 | 9.71 |\n| Log-Rank       | 21.95       | 11.01 | 3.04        | 1.66 | 15.47  | 17.57 | 16.22   | 9.18 | 14.17 | 9.86 |\n| Binoculars     | 6.42        | 5.31  | 1.00        | 0.93 | 5.60   | 11.82 | 10.33   | 6.37 | 5.84  | 6.11 |\n| IRM            | 7.26        | 5.53  | 1.57        | 2.82 | 2.72   | 3.75  | 5.05    | 6.34 | 4.15  | 4.61 |\n| ReMoDtect      | 11.46       | 7.58  | 2.16        | 1.45 | 2.37   | 2.67  | 6.39    | 4.25 | 5.60  | 3.99 |\n\nAcross both tables, IRM demonstrates consistently strong performance on recent reasoning models, achieving high AUROC and F1 while also maintaining low FPR and FNR. These results provide strong empirical evidence for the reliability and robustness of IRM when applied to real-world, safety-critical domains.\n\nWe hope these additional results address the concern and further strengthen the empirical foundation of our work.\n\n> Weakness3: It would be helpful to understand the effect of LLM size on the detector performance, similar to [3] for DetectGPT. This would help users understand which instruction-tuned/base model policy pairs and their sizes are the most \"universal\" across LLMs and datasets.\n\nThank you for raising this insightful point. We agree that understanding how the detector’s backbone size influences performance is important for identifying practical and robust detection strategies. To this end, we extend our analysis in Table 5 by evaluating IRM with larger (>7B) backbones. The table below reports the results on the DetectRL benchmark:\n\n| Backbone     | Avg.   |\n|--------------|-------|\n| Llama-3.2-1B | 91.77 |\n| Llama-3.2-3B | 91.08 |\n| Llama-3.1-8B | 82.31 |\n| Gemma-2-2B   | 77.05 |\n| Gemma-2-9B   | 64.34 |\n\nWe observe a similar trend to that reported in [3]: smaller models within the same family often yield better detection performance. Notably, Llama-3.2-1B backbone achieves the best overall results, suggesting that smaller models may act as more universal detectors across various source models and datasets.\n\n> Weakness4: Is there a fully-supervised classifier baseline, such as RoBERTa? The fully supervised models seem trained for reward modeling, but I wonder how a baseline that directly tries to classify human/LLM text would compare.\n\nThank you for raising this important point. DetectRL benchmark provides 4 supervised baselines including models such as RoBERTa and XLM-RoBERTa. We report the results of these supervised baselines and IRM:\n\n| Model              | Avg.  |\n|--------------------|-------|\n| RoBERTa-base       | 93.02 |\n| RoBERTa-Large      | 91.49 |\n| XLM-RoBERTa-base   | 91.71 |\n| XLM-RoBERTa-Large  | 90.59 |\n| IRM (Llama-3.2-1B) | 92.12 |\n\nWe find that IRM outperforms 3 out of the 4 supervised baselines, despite requiring no task-specific training. This highlights the strength of our framework in a zero-shot setting.\n\n[1] RAID: A Shared Benchmark for Robust Evaluation of Machine-Generated Text Detectors\n\n[2] DivScore: Zero-Shot Detection of LLM-Generated Text in Specialized Domains\n\n[3] Smaller Language Models are Better Black-box Machine-Generated Text Detectors"}, {"review_id": "78myJyPihn", "reviewer": "Reviewer_NPcg", "summary": "This paper introduces IRM, a zero-shot text detector. It scores a text via the DPO reward model parameterization, i.e. the log-ratio between an instruction-tuned model and its corresponding base model.", "questions": "- On Table 5, as the paper states, \"larger or newer versions of a model do not always lead to better detection performance.\" Do you have any interpretation of why this is the case? Intuitively, it seems that the implicit reward model from a larger backbone should be better at estimating reward, which should, in turn, improve its ability to recognize \"overoptimized text.\"\n- Have you tried larger models, such as 7b models or beyond? I'd be interested to see whether the scaling trends continue to hold.\n- Could you try the same method with other types of reward models based on the same backbones (without further fine-tuning)? For example, https://huggingface.co/Ray2333/GRM-gemma2-2B-rewardmodel-ft this model uses the gemma2-2b backbone.", "limitations": "- Tests on quite small models.\n- Motivation for considering implicit reward models is unclear.", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 2, "significance": 2, "originality": 2, "strengths_and_weaknesses": "- The method has a simple implementation and yields significant gains. It requires no extra data, fine-tuning, or text perturbation. The motivation is clear: machine-generated text typically overoptimizes reward during RLHF, so reward can be a criterion for distinguishing btw human and machine text.\n- The paper provides thorough ablations on text length and robustness.\n- The motivation for specifically focusing on implicit reward models is unclear to me. Aside from DPO-style reward models, you could use any available reward model for this purpose (sequence classifier or even generative reward models). There are a bunch in [1]. Do you have a reason for focusing on implicit reward models specifically?\n\n[1] https://huggingface.co/spaces/allenai/reward-bench", "was_revised": true, "final_justification": "I am raising my score. The authors addressed my concerns, particularly the one around motivation for focusing on implicit RMs.", "rebuttal": "> Weaknesses1: The motivation for specifically focusing on implicit reward models is unclear to me. Aside from DPO-style reward models, you could use any available reward model for this purpose (sequence classifier or even generative reward models). There are a bunch in RewardBench. Do you have a reason for focusing on implicit reward models specifically?\n\nThank you for the insightful question. While it is possible to use various existing reward models such as sequence classifiers or generative reward models, our focus on implicit reward models is motivated by both practical considerations and theoretical alignment with the nature of LLM-generated text.\n\nSpecifically, many publicly available reward models are trained for preference classification, not detection of LLM-generated content. These are fundamentally different tasks. Furthermore, reward models used during real-world RLHF pipelines are not publicly released, limiting their practical applicability in detection.\n\nIn contrast, DPO-style implicit reward models offer a principled proxy for the unknown reward functions used during RLHF. The log-likelihood difference between an instruction-tuned model and its base model can be interpreted as an implicit reward signal that reflects how much a given response is encouraged during alignment training. This aligns well with the over-optimization nature of LLM-generated text, making it a natural fit for detection tasks.\n\nFinally, we conducted empirical evaluations of several SOTA public reward models trained on preference data (see the rebuttal for Question 3), and observed that they perform poorly on LLM-generated text detection tasks—further validating the effectiveness of our implicit reward model approach.\n\n> Questions1: On Table 5, as the paper states, \"larger or newer versions of a model do not always lead to better detection performance.\" Do you have any interpretation of why this is the case? Intuitively, it seems that the implicit reward model from a larger backbone should be better at estimating reward, which should, in turn, improve its ability to recognize \"overoptimized text.\"\n\nThank you for raising this insightful question. While larger models tend to be better at estimating reward signals within the distribution they are trained on, the zero-shot detection task inherently involves a cross-distribution generalization challenge. Specifically, IRM is designed to detect whether a given text has been overoptimized with respect to another model’s reward signal—not the preferences of the IRM model itself.\n\n\nIn practice, different LLMs are trained on diverse datasets and optimized via different RLHF pipelines. Even when they target similar alignment goals (e.g., helpfulness, factuality), the actual learned preferences can differ significantly due to differences in training data and optimization processes. This phenomenon, which we refer to as reward divergence, means that larger models do not necessarily provide better detection signals—sometimes, a smaller model generalizes better across such divergent reward landscapes.\n\n> Questions2: Have you tried larger models, such as 7b models or beyond? I'd be interested to see whether the scaling trends continue to hold.\n\nThank you for raising this insightful point. We extend our analysis in Table 5 by evaluating IRM with a range of backbone sizes. The table below reports the results on the DetectRL benchmark:\n\n| Backbone     | Avg.   |\n|--------------|-------|\n| Llama-3.2-1B | 91.77 |\n| Llama-3.2-3B | 91.08 |\n| Llama-3.1-8B | 82.31 |\n| Gemma-2-2B   | 77.05 |\n| Gemma-2-9B   | 64.34 |\n\nThese results show that larger backbone models do not necessarily lead to better detection performance in the IRM framework. This trend is particularly evident within model families, where smaller models often outperform their larger counterparts. This supports our claim that IRM's success relies more on cross-model generalization than on reward estimation fidelity, and that larger models may overfit to their own reward landscape, reducing their effectiveness in detecting overoptimization from other models.\n\n> Questions3: Could you try the same method with other types of reward models based on the same backbones (without further fine-tuning)?\n\nThank you for the suggestion. We conducted additional experiments using public reward models trained on large-scale preference data, specifically the Skywork-Reward-V2 [1] models, which achieve SOTA results on the RewardBench benchmark. These reward models are trained on 40 million preference pairs and use backbones up to 8B in size, allowing us to assess whether reward model scaling improves generalization in LLM-generated text detection. \n\nWe compare IRM and Skywork-Reward-V2 under the same backbones, without additional fine-tuning, and report their performance on the DetectRL benchmark.\n\n| Backbone     | Skywork-Reward-V2 | IRM   |\n|--------------|-------------------|-------|\n| Llama-3.1-8B | 58.74             | 82.31 |\n| Llama-3.2-3B | 45.43             | 91.08 |\n| Qwen3-8B     | 52.97             | 60.57 |\n\nThese results demonstrate that IRM consistently outperforms the reward-model-based methods, even when using the same or smaller backbones. This further supports our claim that standard preference-trained reward models, despite their size and strong performance on preference classification, do not generalize well to the LLM-generated text detection task. In contrast, IRM’s implicit reward modeling remains robust across settings.\n\n[1] Skywork-Reward-V2: Scaling Preference Data Curation via Human-AI Synergy"}, {"review_id": "Ksbnqubb0i", "reviewer": "Reviewer_zjGC", "summary": "This paper introduces a new framework Implicit Reward Model (IRM), a training-free LLM-generated text (LGT) detector which is motivated by prior work ReMoDetect. The method utilized implicit reward implied by Direct Preference Optimization (DPO). Experiments conducted on detection benchmark (DetectRL) show that IRM significantly outperforms other baselines. Also, the paper shows the robustness of IRM against the domain, LLM, attack, and text-length shifts.", "questions": "[Q1] Detecting recent reasoning models: Have you evaluated IRM and other baselines with outputs from reasoning models such as OpenAI o3 or Deepseek-R1?\n\n[Q2] Can you provide evaluation results on detecting randomly sampled generations by adjusting temperatures?", "limitations": "yes", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 4, "clarity": 4, "significance": 3, "originality": 3, "strengths_and_weaknesses": "[S1] Great detection performance and generalization: IRM consistently outperform baselines. \n\n[S2] No further training needed: The detector don’t need further training which significantly \n\n[S3] Extensive experiments: Contains extensive evaluation across various benchmarks and baselines. \n\n[S4] Insightful Analysis: The paper quantifies threshold drift with length, explores model version and size effects.\n\n[W1] Didn't analyzed about detecting reasoning models: DetectRL doesn’t contains recent reasoning models’ responses such as openai o3 or deepseek-r1.", "was_revised": true, "final_justification": "After reading the authors' rebuttal and further discussions with the authors, I have decided to maintain my score of 5. My main justification is that most of my initial concerns have been addressed, although some issues remain.\n\n**Resolved**\n\n1. Evaluation on recent Large Reaasoning Models (LRMs): The authors introduced a new detection evaluation and showed that IRM outperforms the baselines. They also provided interesting observations that some metric-based detection methods are not robust for LRMs, whereas IRM remains robust.\n\n**Unresolved**\n\n1. Robustness of Detection under Varying Generation Temperatures: While the authors noted the lack of significance in this evaluation and cited time constraints, this concern remains unresolved.", "rebuttal": "> Weaknesses 1 and Questions1: Didn't analyzed about detecting reasoning models: DetectRL doesn’t contains recent reasoning models’ responses such as openai o3 or deepseek-r1. Detecting recent reasoning models: Have you evaluated IRM and other baselines with outputs from reasoning models such as OpenAI o3 or Deepseek-R1?\n\nThank you for raising this important point. We agree that evaluating detectors on outputs from strong reasoning models is crucial, especially given their increasing prevalence in real-world use cases.\n\nTo address this, we conducted additional experiments on the DivScore [1] benchmark, which includes four professionally legal and medical datasets generated by recent reasoning-oriented LLMs: DeepSeek-R1, DeepSeek-V3, GPT-4o, and O3-mini. For evaluation, we use the main test split of DivScore and adopt LLaMA-3.2-1B as the backbone, which demonstrated strong performance on DetectRL. In addition to AUROC and F1, we also report false positive rate (FPR) and false negative rate (FNR), as these provide a more nuanced understanding of detection quality in high-stakes settings.\n\n| Method         | DeepSeek-R1 |       | DeepSeek-V3 |       | GPT-4o |       | O3-mini |       | Avg.  |       |\n|----------------|-------------|-------|-------------|-------|--------|-------|---------|-------|-------|-------|\n|                | AUROC       | F1    | AUROC       | F1    | AUROC  | F1    | AUROC   | F1    | AUROC | F1    |\n| Log-Likelihood | 88.64       | 86.11 | 98.87       | 97.68 | 85.96  | 81.50 | 90.37   | 87.47 | 90.96 | 88.19 |\n| Log-Rank       | 87.56       | 84.85 | 98.91       | 97.69 | 86.28  | 82.34 | 90.86   | 88.01 | 90.90 | 88.22 |\n| Binoculars     | 98.03       | 94.18 | 99.87       | 99.03 | 94.84  | 90.74 | 95.61   | 91.88 | 97.09 | 93.96 |\n| IRM            | 97.39       | 93.67 | 99.27       | 97.77 | 99.08  | 96.74 | 97.95   | 94.25 | 98.42 | 96.61 |\n| ReMoDtect      | 95.86       | 90.69 | 99.73       | 98.20 | 99.56  | 97.46 | 98.73   | 94.73 | 98.47 | 95.27 |\n\n| Method         | DeepSeek-R1 |       | DeepSeek-V3 |      | GPT-4o |       | O3-mini |      | Avg.  |      |\n|----------------|-------------|-------|-------------|------|--------|-------|---------|------|-------|------|\n|                | FPR         | FNR   | FPR         | FNR  | FPR    | FNR   | FPR     | FNR  | FPR   | FNR  |\n| Log-Likelihood | 21.44       | 9.19  | 3.23        | 1.50 | 15.00  | 19.02 | 17.48   | 9.11 | 14.29 | 9.71 |\n| Log-Rank       | 21.95       | 11.01 | 3.04        | 1.66 | 15.47  | 17.57 | 16.22   | 9.18 | 14.17 | 9.86 |\n| Binoculars     | 6.42        | 5.31  | 1.00        | 0.93 | 5.60   | 11.82 | 10.33   | 6.37 | 5.84  | 6.11 |\n| IRM            | 7.26        | 5.53  | 1.57        | 2.82 | 2.72   | 3.75  | 5.05    | 6.34 | 4.15  | 4.61 |\n| ReMoDtect      | 11.46       | 7.58  | 2.16        | 1.45 | 2.37   | 2.67  | 6.39    | 4.25 | 5.60  | 3.99 |\n\n\n\nAcross both tables, IRM demonstrates consistently strong performance on recent reasoning models, achieving high AUROC and F1 while also maintaining low FPR and FNR. These results support the robustness and reliability of IRM for detecting high-quality responses from modern reasoning LLMs.\n\n\n\n> Questions2: Can you provide evaluation results on detecting randomly sampled generations by adjusting temperatures?\n\nThank you for this insightful question. Sampling temperature indeed has a significant influence on the quality and diversity of LLM-generated outputs. However, existing benchmarks, such as DetectRL, typically fix the temperature at a scalar value (e.g., 1.0) and do not explore how detection performance varies across temperature settings.\n\nThis design choice is grounded in practical usage. In many real-world applications, such as ChatGPT or similar LLM-based systems, users cannot directly control temperature or generation strategy, and the outputs are produced under a fixed decoding setup predefined by the provider. Therefore, the kinds of generations actually presented to users are restricted to a narrow range of temperature settings.\n\n[1] DivScore: Zero-Shot Detection of LLM-Generated Text in Specialized Domains"}, {"review_id": "q7Qy5VyOHK", "reviewer": "Reviewer_FXJi", "summary": "This paper proposes a novel, lightweight approach to detect AI-generated texts. The proposed method leverages the implicit reward model constructed from the relation between internal representations of base and instruction-tuned versions of an LLM theoretically backed by the properties of RLHF finetuning. Using it, authors develop a detector of artificial texts. Conducted experiments show its high performance against various generating models and adversarial attacks on different text domains (styles/genres).", "questions": "See Weaknesses.", "limitations": "Yes", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths:\n\n- An interesting approach leveraging the RLHF-nature of the common model instruction fine-tuning scheme. Proposed method achieves noticeable improvements over competitive solutions and is relatively easy to deploy.\n\n- Experiments are quite extensive, showing the robustness of the proposed AI-text detector to domain shift and various adversarial attacks. Evaluation also covers some less common attacks (e.g., translation of a text generated in another language).\n\n- The paper is well-structured and processing in a logically coherent manner.\n\n\nWeaknesses:\n\n- My main concerns with this paper are particular limitations of the evaluation of the proposed method. First of all, only one dataset is used - DetectRL - and it covers models primarily from the first half/mid-2023. Some more modern models (e.g., GPT4-o or something else) would be appreciated.\nSecondly, evaluation metrics. In practice, type I and type II errors (false positive and false negative) have different weights. None of the metrics provided for the experiments (AUROC and $F_1$) cover this aspect; I would suggest providing FPR/FNR (or any other appropriate metric). \nAlso, I would like to ask if it is possible to include metrics for baselines in Table 3?\n\n- On another note, a clearly outlined pipeline for application of the proposed method to a text (possibly, an example) in the paper (appendices) would be much appreciated.", "was_revised": true, "final_justification": "The reply to my review answers my concerns regarding the proposed method and its evaluation. I have also read responses to other reviews.\n\nIn their replies, authors provide numerous new results showing high performance of the proposed method against various modern generating models; they include evaluation on more benchmarks (e.g., RAID, DivScore), and additional quality metrics were provided.\n\nConsidering the incorporation of the new results and proposed changes, I think that this paper can be accepted (and I raise my overall score for it from 4 to 5).", "rebuttal": "> Weaknesses1: My main concerns with this paper are particular limitations of the evaluation of the proposed method. First of all, only one dataset is used - DetectRL - and it covers models primarily from the first half/mid-2023. Some more modern models (e.g., GPT4-o or something else) would be appreciated. \n\nThank you for raising this important point. We agree that evaluating detectors on outputs from more modern models is crucial, especially given their increasing prevalence in real-world use cases.\n\nTo address this, we conducted additional experiments on the DivScore [1] benchmark, which includes four professionally legal and medical datasets generated by more modern LLMs: DeepSeek-R1, DeepSeek-V3, GPT-4o, and O3-mini. For evaluation, we use the main test split of DivScore and adopt LLaMA-3.2-1B as the backbone, which demonstrated strong performance on DetectRL. In addition to AUROC and F1, we also report false positive rate (FPR) and false negative rate (FNR), as these provide a more nuanced understanding of detection quality in high-stakes settings.\n\n| Method         | DeepSeek-R1 |       | DeepSeek-V3 |       | GPT-4o |       | O3-mini |       | Avg.  |       |\n|----------------|-------------|-------|-------------|-------|--------|-------|---------|-------|-------|-------|\n|                | AUROC       | F1    | AUROC       | F1    | AUROC  | F1    | AUROC   | F1    | AUROC | F1    |\n| Log-Likelihood | 88.64       | 86.11 | 98.87       | 97.68 | 85.96  | 81.50 | 90.37   | 87.47 | 90.96 | 88.19 |\n| Log-Rank       | 87.56       | 84.85 | 98.91       | 97.69 | 86.28  | 82.34 | 90.86   | 88.01 | 90.90 | 88.22 |\n| Binoculars     | 98.03       | 94.18 | 99.87       | 99.03 | 94.84  | 90.74 | 95.61   | 91.88 | 97.09 | 93.96 |\n| IRM            | 97.39       | 93.67 | 99.27       | 97.77 | 99.08  | 96.74 | 97.95   | 94.25 | 98.42 | 96.61 |\n| ReMoDtect      | 95.86       | 90.69 | 99.73       | 98.20 | 99.56  | 97.46 | 98.73   | 94.73 | 98.47 | 95.27 |\n\n| Method         | DeepSeek-R1 |       | DeepSeek-V3 |      | GPT-4o |       | O3-mini |      | Avg.  |      |\n|----------------|-------------|-------|-------------|------|--------|-------|---------|------|-------|------|\n|                | FPR         | FNR   | FPR         | FNR  | FPR    | FNR   | FPR     | FNR  | FPR   | FNR  |\n| Log-Likelihood | 21.44       | 9.19  | 3.23        | 1.50 | 15.00  | 19.02 | 17.48   | 9.11 | 14.29 | 9.71 |\n| Log-Rank       | 21.95       | 11.01 | 3.04        | 1.66 | 15.47  | 17.57 | 16.22   | 9.18 | 14.17 | 9.86 |\n| Binoculars     | 6.42        | 5.31  | 1.00        | 0.93 | 5.60   | 11.82 | 10.33   | 6.37 | 5.84  | 6.11 |\n| IRM            | 7.26        | 5.53  | 1.57        | 2.82 | 2.72   | 3.75  | 5.05    | 6.34 | 4.15  | 4.61 |\n| ReMoDtect      | 11.46       | 7.58  | 2.16        | 1.45 | 2.37   | 2.67  | 6.39    | 4.25 | 5.60  | 3.99 |\n\nAcross both tables, IRM demonstrates consistently strong performance on recent reasoning models, achieving high AUROC and F1 while also maintaining low FPR and FNR. These results support the robustness and reliability of IRM for detecting high-quality responses from modern reasoning LLMs.\n\n> Weaknesses2: Secondly, evaluation metrics. In practice, type I and type II errors (false positive and false negative) have different weights. None of the metrics provided for the experiments (AUROC and $F_1$) cover this aspect; I would suggest providing FPR/FNR (or any other appropriate metric). \n\nThank you for this valuable suggestion. While the standard evaluation protocol of the DetectRL benchmark does not include FPR/FNR metrics, we agree that false positive and false negative rates are important in practical applications. To address this, we report below the FPR and FNR for our method and competitive baselines on the multi-LLM sub-task of the DetectRL benchmark, using Llama-3.2-1B as the backbone.\n\n| Method         | GPT-3.5 |       | Claude |       | PaLM-2 |       | Llama-2 |       | Avg.  |       |\n|----------------|---------|-------|--------|-------|--------|-------|---------|-------|-------|-------|\n|                | FPR     | FNR   | FPR    | FNR   | FPR    | FNR   | FPR     | FNR   | FPR   | FNR   |\n| Log-Likelihood | 11.60   | 29.86 | 7.60   | 67.96 | 8.20   | 33.43 | 6.50    | 19.64 | 8.47  | 37.72 |\n| Log-Rank       | 6.50    | 36.41 | 10.40  | 64.68 | 7.30   | 33.83 | 7.50    | 18.25 | 7.92  | 38.29 |\n| Binoculars     | 7.80    | 20.54 | 19.90  | 29.07 | 4.80   | 12.70 | 2.90    | 4.07  | 8.85  | 16.59 |\n| IRM            | 5.30    | 9.92  | 11.00  | 9.62  | 7.50   | 12.30 | 2.20    | 4.56  | 6.50  | 9.10  |\n| ReMoDetect     | 7.30    | 13.59 | 44.70  | 10.12 | 27.50  | 16.87 | 8.20    | 15.58 | 21.92 | 14.04 |\n\nAs shown, IRM consistently achieves lower FPR and FNR across models.\n\n> Weaknesses3: Also, I would like to ask if it is possible to include metrics for baselines in Table 3?\n\nThank you for the suggestion. We provide below an extended Table 3 with detailed results for competitive baselines.\n\n| Method     | DIPPER Paraphrase |       |       |       | Polish using LLMs |       |       |       | Back Translation |       |       |       |\n|------------|-------------------|-------|-------|-------|-------------------|-------|-------|-------|------------------|-------|-------|-------|\n|            | Pre               | Rec   | $F_1$ | AUROC | Pre               | Rec   | $F_1$ | AUROC | Pre              | Rec   | $F_1$ | AUROC |\n| Log-Likelihood | 92.57             | 84.03 | 88.09 | 93.76 | 85.79             | 76.69 | 80.98 | 88.43 | 99.01            | 99.01 | 99.01 | 99.87 |\n| Log-Rank    | 92.52             | 84.62 | 88.39 | 93.92 | 87.03             | 75.89 | 81.08 | 88.66 | 99.01            | 99.31 | 99.16 | 99.90 |\n| Binoculars | 88.67             | 81.55 | 84.96 | 92.14 | 82.89             | 81.25 | 82.06 | 89.39 | 98.59            | 96.83 | 97.70 | 99.70 |\n| IRM        | 93.02             | 83.33 | 87.91 | 94.39 | 77.76             | 79.76 | 78.75 | 85.36 | 93.11            | 87.10 | 90.01 | 95.54 |\n| ReMoDetect | 95.30             | 86.41 | 90.63 | 96.35 | 80.00             | 56.35 | 66.12 | 77.50 | 99.40            | 98.31 | 98.85 | 99.81 |\n\n> Weaknesses4: On another note, a clearly outlined pipeline for application of the proposed method to a text (possibly, an example) in the paper (appendices) would be much appreciated.\n\nThank you for the suggestion. We agree that a clearly outlined pipeline would improve the clarity and usability of our method. In the final version, we will include a figure that illustrates the full application process of IRM with a step-by-step example. This figure will demonstrate how to compute the implicit reward scores from a given text and how these scores are used to make the final classification decision.\n\n[1] DivScore: Zero-Shot Detection of LLM-Generated Text in Specialized Domains"}]

Author rebuttal:

Meta-review: Summary of Claims and Findings:

This paper introduces the Implicit Reward Model (IRM), a novel, training-free detector for AI-generated text. It leverages the log-likelihood ratio between instruction-tuned and base models as a proxy for the reward signal, positing that AI text is over-optimized for this signal and is thus detectable. The method demonstrates state-of-the-art zero-shot performance and robustness across various models, domains, and adversarial attacks.

Strengths:

The paper's key strengths are its novelty and simplicity (the method is training-free), strong empirical performance that outperforms other zero-shot baselines, and insightful analysis of how factors like text length and detector size impact performance.

Weaknesses & Rebuttal Summary:

Initial weaknesses flagged by reviewers included a limited evaluation scope (a single benchmark, older models) and a lack of practical metrics like FPR/FNR. The authors' rebuttal was exemplary. They conducted extensive new experiments on the RAID and DivScore benchmarks, incorporated modern reasoning models (e.g., GPT-4o), and added the requested FPR/FNR analysis. This comprehensive response fully addressed all major reviewer concerns, leading to a consensus to accept.

Recommendation Justification:

The recommendation is based on the paper's novel and effective method, which was validated by an exceptionally thorough rebuttal. The new experiments significantly strengthened the paper's claims of robustness and generalizability. The work, in its revised form, is a strong and well-vetted contribution to a critical area of research.
Decision: Accept (poster)