Large Language Models can be Guided to Evade AI-generated Text Detection
Authors: Ning Lu
Shengcai Liu
Rui He
Yew-Soon Ong
Qi Wang
Ke Tang
Venue: Accepted by TMLR ()

Abstract: Large language models (LLMs) have shown remarkable performance in various tasks and have been extensively utilized by the public.
 However, the increasing concerns regarding the misuse of LLMs, such as plagiarism and spamming, have led to the development of multiple detectors, including fine-tuned classifiers and statistical methods.   In this study, we equip LLMs with prompts, rather than relying on an external paraphraser, to evaluate the vulnerability of these detectors.   We propose a novel Substitution-based In-Context example Optimization method (SICO) to automatically construct prompts for evading the detectors. SICO is cost-efficient as it requires only 40 human-written examples and a limited number of LLM inferences to generate a prompt.   Moreover, once a task-specific prompt has been constructed, it can be universally used against a wide range of detectors. Extensive experiments across three real-world tasks demonstrate that SICO significantly outperforms the paraphraser baselines and enables GPT-3.5 to successfully evade six detectors, decreasing their AUC by 0.5 on average. Furthermore, a comprehensive human evaluation show that the SICO-generated text achieves human-level readability and task completion rates, while preserving high imperceptibility. Finally, we propose an ensemble approach to enhance the robustness of detectors against SICO attack.

Published in Transactions on Machine Learning Research (05/2024)
Large Language Models can be Guided to Evade Al- Generated Text Detection
Ning Lu
nduab cst..
Guangdong Key Laborstory of Brain--nspired Intelligent Computation
Department of Computer Science and Engineering, Southern University of Science and Technology Department of Compuler Science and Engineering, Hong Kong Universily of Science and Technology
Shengeai Liu
leuscco@gmail..c
Centre for Frontier AT Research (CFAR), Agency for Science, Technology and Research (A STAR))
Rui He
her2018 sustech. edu.
Guangdong Key Laboralory of Bruin-Inspired Indelligent Computation
Department of Computer Science and Engineering, Southern University of Science and Technology
Yew-Soon Ong
asysong@@laa www.innww......... sg
Centre for Frontier Al Research (CFAR), Agency for Science, Technology and Research (A (STA)) College of Computing and Data Science, Nanyang Technological University (NTU)
Qi Wang Department of Computer Science and Engineering, Southern University of Science and Technology
wanggi edu..e.ee.ccc..
Ke Tang
tangk33@ustech..etu..
Guangdong Key Laboratory of Broin- Irsin--nspired Intelligent Computation
Department of Computer Science and Engineering, Southern University of Science and Technology
Equual contribution. "Corresponding author.
Reviewed on OpenReview: https: // openreview. net/ forum? id= ILEOmWzUrr
Abstract
Large language models (LLMs)) have shown remarkable performance in various tasks and have been extensively utilized by the public. However, the increasing concerns regarding the misuse of LLMs, such as plagiarism and spamming, have led to the development of multiple detectors, including fine-tuned classifiers and statistical methods. In this study, we equip LLMs with prompts, rather than relying on external paraphraser, to evaluate the vulnerability of these detectors. We propose a novel Substitution--aet based In-Context example Optimization method (SICO) to automatically construct prompts for evading the detectors. SICO is cost-efficient as it requires only 40 numan--ritter examples and a limited number of LLM inferences generate prompt. Morcover, once a task-speeific prompt has been constructed, it be universally used against. wide range of detectors. Extensive experiments across three real-world tasks demonstrate that SICO significantly outperforms the paraphraser baselines and enables GPT-3.5 to successfully evade six detectors, decreasing their AUC by 0.5 on average. Furthermore, comprehensive human evaluation show that the STCO-generated text. achieves human-level readability and task completion rates, while preserving high imperceptibility. Finally, we propose an ensemble approach to enhance the robustness of detectors against SICO attack.
The code publicly available httpa:///ithhut htt.a//a..ccc/ooo.nnnaa//aaaaaae Detecctr

---

Published in Transactions on Machine Learning Research (05/2024)
1 Introduction
The rapid advancement. of large language models (LLMs)) such GPT (Brown et al.
2020) and LLaMa (Tou-
vron et al. 2023), has led to a largely-incresed capacity for generating high-quality human-like text. However, there are also growing concerns surrounding the misuse of these models, including generating fake product
reviews (Adelani et al., 2020 Lin et al. 2022) and misinformation (Lin et al.) 2022), enabling academic dishonesty (Stoke--Wlker 2022), and producing mislcading answers on websites StackOvorflow 2023
In response to these challenges, several methods for detecting Al-generated text have been proposed recently, ranging from fine-tuned classifiers (Guo al.) 2023 Solaiman et al. 2019), statistical methods [Mitchell
ct al. 2023), to watermarking (Kirchenbauer et al. 2023). There also online dctection services provided by companies such as GPTzero (Tian 2023). However, the robust of these detection methods has not been thoroughly evaluated. Recent studies [Krishaa et al., 2023 Sadasivan et al.) 2023) have shown the vulnerability of these detectors to the so-called paraphrase attacks, which adopt an external paraphraser to rewrite the text generated by LLMs to evade detectors.
In this work, rather than relying on an external paraphraser, we explore equipping LLMSs with carefully constructed prompts to evade detectors. The intuition is that, given the remarkable capabilities of LLMs, ap- propriate prompts can guide these models to potentially achieve and even exceed the evasion performance level of smaller external paraphrasers. We propose SICO, Substitution-basel In-Context example Optimization method, to automatically construct such prompts based on human-generated examples. Specifically, SICO iteratively substitules words and sentences within the in-context examples to provide more representative demonstrations for LLMs to generate text that cannot be detected, where the substitution procedure is directed by proxy detector (sce Figure [ for an overview of STCO).
We assess the evasion performance of SICO across three real-world lasks that are susceptible the misuse of LLMs, i.., academic essay writing, open-ended question answering, and fake review generation. The results demonstrate that SICO consistently outperforms the paraphrascr basclines, Icading to decrease in AUC by approximately 0.5 on average for six existing detectors. Additionally, comprehensive human evaluation involving 600 examples shows that the STCO-generated text is comparable to, and in some cases even better than, human-written text in terms of readability and task completion rates. It also demonstrates that SICO reduces the probability of being recognized by humans. In addition to its strong evasion performance, SICO is also cost-efficient and easy to use. Unlike paraphraser-based methods that often require extensive computational resources evidenced by the fine-tuning of 13B model on large dataset (Krishna et al. 2023) SICO only requires 40 human-generated examples and limited number of LLM inferences (e.g., costing approximately 1 USD using the GPT-3.5 API). Besides, once a task-specific prompt has been constructed by SICO, it can be universally used against a wide range of detectors.
Considering the importance of detecting AT-generated text to avoid their misuse, the results presented in this work certainly reveal the vulnerability of the existing detectors. Besides, this work presents the first empirical evidence that LLMs can evade detectors through a prompt-guided approach. The strong evasion performance of SICO suggests that it can be used as standard evaluation tool for any future Al-generated text detectors. Finally, we propose an ensemble approach to enhance the robustness of detectors against. SICO attack. We hope that these findings can better facilitate the research concerning the responsible use of LLMs. To summarize, our main contributions arc:
We introduce SICO, novel in-context example learning method, to automatically construct prompts that can guide LLMs to evade detectors.
With low cost, SICO achieves strong performance in evading six existing detectors across three tasks, significantly outperforming the paraphraser baselines.
comprehensive human evaluation verifies that the SICO-generated text achieves human-leve readability and task completion rates, while preserving high imperceptibility.
2

---

Published in Transactions on Machine Learning Research (05/2024)
2 Related works
2.1 Al-generated text detection
In recent years, the research community has developed wide range of detectors for Al-generated contents. general, these detectors can be classified into three categories: training-basete statistical, and watermarking methods. Training-based methods treat the detection problem networks are trained using Al-generated lext and human-wrillen text. Early studies utilized classifiers to identify fake reviews (Hovy) 2016) and fake news (Zellers et al.) 2019). More recently, researchers have trained classificrs using text generated by LLMs, such as the GPT-3.5 detector (Guo et al. 2023) and GPT-2 detector (Solaiman et al., 2019). Statistical methods, on the other hand, focus on zero-shot detection without any additional training overhead. These methods seek to distinguish between human-written text, and Al-generated text based on the statistical characteristics of text, such as the statistical irregularities in measures like entropy (Lavergne et al.) 2008), perplexity (Beresneva, 2016) and token rank (Gchrmann et al. 2019h. A recent method, DeT [Mitchell et al. 2023), exploits the phenomenon that Al-generated text tends to lie in the negative curvature regions of log probability of text. The watermarking methods involve modifying the LLM's text generation process to imprint specific patterns on the generated text, such that it can be detected (Abdelnabi & Fritz 2021 Grinbaum & Adomaitis 2022 Kirchenbauer et al. 2023 Although the proposed method STCO primarily focuses on the first two types detection methods, it can also help evade watermarking when acted as an external paraphraser, as shown in Appendix F
binary classification task, where neural
Recent studies have found that paraphrasing network to rewrite the original AT-generated text (Krishna et al. 2023 Sadasivan et al. 2023). In contrast, SICO climinates the need for extra models or training steps. SICO provides an automatic approach that iteratively improves prompt, unlike the in-the-wild prompts, which which are typically discovered through manual trial and error (Uploader 2023
evade these detectors, which trains additional neural
2.2 In-context learning
With the increasing scales of models and corpora (Radford et al. 2019 Chowdhery et al. 2022 Gou
lt al.] 2022] Wei et al.] (2024), LLMs have demonstrated the in-context learning (ICL) ability, allowing them perform tasks with only a few examples provided as demonstrations (Brown et al. 2020 Recent studies have focused on designing demonstrations during inference, which can be divided into demonstration selection, ordering, and formatting (Dong et al. 2022). Specifically, demonstrations can be selected based
on unsupervised metrics or supervised strategies (Kim et al. 2022 Gonen et al.] 2022 Wei et al. 2023
For ordering, Liu et al. (2021) sorted examples by their distances to the input. Regarding demonstration
formatting, Wei et al. (2022) proposed the so-called shain-of-thoughe (COT) format, and subsequent works have developed automatic COT (Zhang et al., 2022). In contrast to these works, we focus on iteratively optimizing demonstrations through substitutions. In principle, the proposed method SICO can be used in combination with the bbove-mentioned methods, potentially leading to improved performance.
3 Substitution-based in-context example optimization (SICO)
The illustration of SICO is presented in Figure 1 First, LLM is asked to extract language features of human-written text. Then, the in-context examples are initialized and optimized. The final prompt is composed of the feature, task instruction, and optimized in-context examples. Below, we first describe how to evaluate a prompt during its optimization and then claborate all the stops of SICO.
3.1 Prompt Evaluation
Given a natural language processing task, denote the task input as x. To assess the utility of a prompt p, we first collect a set of task inputs, Xevat- For cach input Xevats p and x are first concatenated (denoted by p& æ) and fed into the LLM, whose output text (denoted by LLM(p O z)) then classified by a proxy ortector. Let PAi be the predicted probability of LLM(p 2)) to be Al-generated, then the utility score of
3

---

Published in Transactions on Machine Learning Research (05/2024)
Al-generated text
human-written text
Constructed Prompt
feature extraction LLM
feature
writings high clarity
Ask LLM to extract human-writter text feature.
conciseness
task instruction
Based description, questions style:
Bushes grow low with many stems, Shrubs are taller and more defined bushes multiple
Par 0.9
Q:
between
optimized example
A: Bushes are short with numerous stems. Shrubs
are taller and more distinct than bushes, also having multiple stems.
Bushes grow many Shrubs taller more distinct than bushes, also having multiple stems.
Par: 0.6
user task input
Q: How long does take trace phone call? A:
word substitution
Bushes with numerous Shrubs taller and distinct than bushes, also having multiple stems.
output text
PAi 0.3
User
Pau:
LLM
Optimize in-context examples be less Al-like.
Users employ the constructed prompt evade detectors.
Figure 1: Illustration of how SICO generates prompts for the question answering task. The probability PAL as predicted by the proxy detector, indicates the likelihood that the given text is Al-generated. Once SICO prompt constructed, serves as a template, allowing users to insert various task inputs (highlighted in purple text).
prompt p, denoted by U(p), is defined as one minus the averaged predicted probability across Xeval (the higher U, the better):
u(p) Xeval zEXeva!
Σ Pai(LLM(p x)).
(1)
3.2 Prompt Construction
Data collection We first collect set of K triplets, i.e., D = { yyr Fiuman) ) where a is a task input and VÂ viuman are the corresponding outputs generated by the LLM and humans, respectively. Note is used for prompt construction and is independent of Xeval which is used for prompt evaluation.
Feature extraction This step involves the K pairs of AT-generated and human-wrillen outputs from D, denoted by (VAr )) k= We provide LLM with these pairs and ask LLM to extract the distinct linguistic features of human-written text, denoted as feature The top left of Figure L demonstrates this process and generale text to describe the feature of human-written text. This feature text is then utilized for sentence paraphrasing and included in the final prompt.
In-context example optimization We initialize the in-context examples as (a vi), where vit is generated by paraphrasing yÂz- More specifically, the feature treature is concatenated with a paraphrasing instruction to instruct LLM paraphrase the AT-generated text obtain the initial y The paraphrasing instruction is " "Based on the description, paraphrase the following text be human style".
Then the in-context output lie is iteratively optimized to be less Al-like, determined by the probability PAI calculated by the proxy detector. By presenting more and more representative, i.c. lower PAI in-context demonstrations to LLM, it is expected to understand how to generate human-like outputs. This in-context example optimization procedure is the key step in SICO for improving evasion performance, as verified by the ablation study in Section 5.1 Formally, the optimization goal can be expressed as:
Vir = arg min PAI(V()) Vi (VIM(y..)
(2)
4

---

Published in Transactions on Machine Learning Research (05/2024)
Algorithm Substitution--aset in-context example optimization (SICO)
Require: large language model LLM, prompt utility function U(-)) D = {(afer VÂD Vimmann )e= Neval, total
iteration number
1: Extract language feature leature using UWAD Wluman) and LLM Construct in-context outputs Vic [teauree Ppara yi), Ak E K} Initialize p" +- feature @ Prask @ {(rter v
4: for = 1 to N do
5: for k = 1 to K do
6: Generate sentence-level word-level substitutions C* of y switching based on n Ric + GroedyOPT(yf.. C*)
7: Optimize s using Algorithm end for
Construct new prompt P: P f- feeature @ Ptusk ① { (
10:
if u(p)= > u(p") then
11:
Update in-context examples vic ofc and update the best prompt p" +-
12: end if
13: end for
14: return p
where SIM())e) denotes the set of text that is semantically similar to Vic. The goal of setting such semantic restriction to maintain the usability of the text during optimization. In SICO, we generate semantically similar text by replacing words and rephrasing sentences. This is explained in detail below.
Substitution type To generate bhc that is semantically similar to Bie, we employ substitution at word level and sentence level in turn. For word-level substitution, we use WordNet (Miller 1998). lexical databasc of English words, to construct a synonym substitution set. We restrict substitutions to content words and ensure that the substitution would not change the part-of-speech tags. We use mask language model to filter out the candidate words that not fits the context. For sentence-level substitution, instruction combined with extracted feature, denoted as tjeature @ Ppara This combined instruction is used to prompt. LLM to generate paraphrases for each Vic- Using (eaauue will make the generated paraphrases be more human-like, thus increasing the efficiency of optimization.
utilize the paraphrasing
Algorithm As illustrated in Algorithm I SICO would optimize (oft) for N iterations (lines 4-17). At each iteration, each vic would be optimized by greedy substitution (line 11), as presented ? Specifically, for the i-th original
Algorithm Greedy text optimization (GreedyOPT)
in Algorithm y4 in the text y, let Ct, denote its j-th synonym/parapp parapphaae, and let SUB(U;, C.j) denote the new text resulting from substituting ys with Ct For each substitution position i, SICO identifies the best substitution C.,, by checking which Ci, results the lowest Al probability when replacing y: (Line 1 in Algorithm 2).
Require: Text y, substitutions C of y proxy detector PAI C. arg min PAI(H(.)), Vy E C
where y(.)) = SUB( Ct.) for each y/ in y do y SUB( Ct,
After obtaining the optimized in-context output ie. the new prompt is constructed as و featuue @ Peask θ {xft o K ( k= where Ptask is the task instruction, as illustrated in Figure [ Then f would be compared with the current best prompt p based on their utility scores as defined in Eq. [1] If scores
4: end for
5: return
higher, SICO replaces p" with it. After N iterations, p" returned the final prompt. More implementation details of SICO shown in Appendix A
Content words are the words that carry meanings, consisting of nouns, verbs, adjectives and adverbs.
5

---

Published in Transactions on Machine Learning Research (05/2024)
3.3 SICO for Paraphrasing
The approach described above directly generates the task output to evade detectors. We refer to this direct approach as SICO-Gen. Alternatively, SICO can be easily adapted for paraphrasing, which we term SICO-Para. Instead of direct generation, SICO-Para evades detectors in two steps. Initially, LLM produces an intermediate task output, lypically incapable of evading detectors. Then. this output is paraphrased using SICO-Para to successfully evade detectors. Switching from SiCO-Gen to SICO-Para requires only two adjustments: (1) the task input set to the Al-generated output text in D and X Xeeat (2) task instruction Ptask modified to paraphrasing instruction.
4 Experiments
4.1
Experimental Setup
Tasks & datasets We consider three real-world tasks that are susceptible to the misuse of LLMs, i.e., academic essay writing (Writing), open-ended question answering (QA), and fake review generation (Review). We use GPT-3.5, one of the most powerful LLMs, to complete the tasks and generate text in our experiments.
For academic writing, we employ Wikipedia paragraphs from SQuAD dataset (Raipurkar et al. 2016 as text. Following the approach in Mitchell et al. (2023), we use the first 30 words of these paragraphs as task inputs and ask GPT-3.5 to complete the rest. For open-ended question answering, we sample questions from Eli5 Fan et al. 2019) dataset and ask GPT-3.5 to generate answers, following Krishna et. al. 2023). For fake review generation, we first instruct GPT-3.5 to extract the business name and five keywords from human-written reviews from Yelp dataset (Zhang et al. 2015), and then generate fake reviews based on the extracted information with specified sentiment. For each task, we collect 200 examples from GPT-3.5 (called original Al-generated text) and 200 human-written examples from corresponding dataset.
More details about dataset can be found Appendix F
Detectors Six representative detectors belonging to three different types are considered. Details of these detectors can be found in Appendix C
Truining-based methods. (i) GPT-3.5 Detector (GPT3-D) (Guo et al. 2023 RoBERTa model [Liu et al. 2019) fine-tuned on text generated by GPT-3.5. (ii) GPT2 Detector (GPT2-D) (Solaiman el al. 2019): a RoBERTa detector officially released by OpenAI, fine-tuned on GPT2 -ePr--geeeated text.
Statistical methods. (i) DetectGPT (Mitchell et al., 2023) evaluates the variation in a language model's 's log probability by introducing minor perturbations to the detected text. (ii) Log- Ran-Rank (Mitchell et al.) 2023) is a statistical method that employs language model to compute the mean prediction rank of each token in a text, given its preceding context. We utilize relatively smaller language model, GPT2-medium (Radford
et al. 2019), for both methods. Because Mireshghallah et al. (022) find that smaller language models have better detection performance than larger ones.
APIs 3 (i) GPTzero Tian 2023 is a widely-used commercial detector, cooperated with many academic organizations. (ii) OpenAI Detector (OpenAI-D) (OpenAl 2023) is officially offered by OpenAI, fine-tuned from language model.
Baselines We consider four paraphrasing baselines that evade detectors by paraphrasing the original Al-generated text. Specifically, two recently proposed methods are considered: (1) Parrot (Sadasivan et al., 2023) and (2) DIPPER (Krishna et al. (023). Both methods employ an external neural network specifically trained for paraphrasing. In addition, we include two prompting basclines to instruct GPT-3.5 to paraphrase the original Al-generated text: (3) GPT- that uses the Aaraightfoowart instruction "Paraphruse this" to assess the capabilities of GPT-3.5 without intricate prompt engineering, and (4) Human Prompt that utilizes human-designed prompt. More details can be found in Appendix A.2
Evaluation metrics We use the area under the ROC curve (AUC) to measure the performance of detectors. The ROC curves are also illustrated to show the detection performance under different classification thresholds.
We consider the API versions of May 15, 2023. For AT-D, we follow the implementation of Krishna et al. 2023

---

Published in Transactions on Machine Learning Research (05/2024)
Table I: AUC scores detectors on text generated by different methods. " refers to the detector's AUC score on the original Al-generatod text, without applying any evasion methods. Symbol * represents that SICO uses GPT3-D as the proxy detector for prompt construction. For each detector, the lowest AUC score is indicated in bold, and the second-lowest. is underlined.
Dataset
Method
GPT3-D*
GPT2-D GPTzero OpenAI-D DetectGPT
Log-Rank
0.908
0.848
0.779
0.789
0.834
0.914
Parrot
0.666
0.645
0.632
0.744
0.502
0.577
DIPPER
0.736
0.907
0.689
0.750
0.550
0.684
Writing
GPT-Para
0.879
0.623
0.631
0.690
0.569
0.713
Human Prompt
0.852
0.560
0.491
0.655
0.676
0.759
SICO-Para
0.239
0.332
0.290
0.488
0.149
0.147
SICO-Gen
0.242
0.099
0.184
0.311
0.441
0.318
0.981
0.906
0.923
0.781
0.876
0.956
Parrot 0.922
0.837
0.849
0.698
0.689
0.806
DIPPER
0.888
0.962
0.869
0.722
0.604
0.782
QA
GPT-Para 0.956
0.797
0.811
0.699
0.640
0.782
Human Prompt
0.912
0.625
0.791
0.656
0.662
0.757
SICO-Para
0.407
0.576
0.572
0.541
0.178
0.183
STCO-Gen
0.668
0.489
0.494
0.524
0.497
0.535
0.925
0.952
0.939
0.960
0.808
0,982
Parrot
0.871
0.934
0.913
0.882
0.654
0.893
DIPPER
0.875
0.984
0,888
0.824
0.515
0.814
Review
GPT-Para
0.899
0.851
0.833
0.925
0.542
0.864
Human Prompt
0.839
0.610
0.856
0.858
0.619
0.851
SICO-Para
0.465
0.264
0.599
0.540
0.270
0.300
SICO-Gen 0.455
0.619
0.399
0.607
0.485
0.583
For each task, we evaluate AUC score using 200 human-written text and 200 original paraphrased AI- generated text. For each task input, we run each evasion method only once, instead of repeating multiple times until successful evasion, to simulate real-workd scenarios where the target detector is inaccessible.
Experimental settings We set Xevaal = 32, K = 8, N = 6, and use GPT-3.5, specifically xpt-3.5-turbe 0301, as the LLM, where the inference parameters are kept in default. And we use GPT3-D as the proxy detector. Experiments using other LLMs and proxy detectors are presented in Section 5.2
4.2 Evasion Performance and Analysis
Table presents the performance of SICO and other baselines against six detectors in AUC score. SICO consistently outperforms other baselines by a substantial margin in all cases. Notably, in most cases, SICO reduces the AUC score to less than 0.5, equivalent to the expected performance of random classifier. Figure shows the ROC curves of evasion methods on academic writing task. One can clearly observe that SICO curves lie below others along different Uhresholds, often lower than the random classifier curve. More evasion results including ROC cures and detection rates are shown in Appendix G
One interesting trend is that SICO-Para consistently outperforms SICO-Gen against statistical detectors, i.c., DetectGPT and Log-Rank. We speculate this performance difference comes from the varying influence of the prompt on the generated text between the two methods. In SICO-Para, the distribution generated text is largely influenced by the original AT-generated text, which in the prompt. However, in STCO-Gen, the distribution of generated text depends more on the previously generated text. Given that statistical detectors have access to the newly generated text but not the prompt, their estimation of token probability becomes

---

Published in Transactions on Machine Learning Research (05/2024)
Grg Farrot
DIMEE
Human Prompt
SIcD-Gen randam
GPT-Para
SICO-Fara
GPT-3.5 Detector
GPT2 Detector
GPTzero
0.8
Fille Positive Rate
0.2
0.0
OpenAl Detector
DetectGPT
Log-Rank
1.0
False Positive Rate
0.2
0.0
0.0
0.2
0.4
0.6
0.8
1.0
0.0
0.2
0.4
0.6
0.8
1.0
0.0
0.2
0.4
False Positive Rate
False Positive Rate
False Positive Rate
Figure 2: ROC curves for six detectors evaluating text generated by various evasion methods in academic writing task.
less accurate for SICO-Para text, thus misleading the detection. It might also explain why GPT-Para reduce the performance of statistical detectors.
4.3
Human Evaluation
4.3.1
Text Quality
From the users' perspective, using Al-generated text goes beyond evading detection systems; the usability of text equally critical. For example, for academic writing task, users expect the text be readable, properly formatted, and relevant to the given topic. Therefore, evaluate the usability of text based on two criteria: readability and (ask completion rate. For each lask, randomly sample 200 examples generated by four methods (50 per method), including human-writte written text. Then we ask three human annotators to rate the readability of text on a scale from to 5, and judge the text accomplishes the task's goal. More details of human evaluation are shown in Appendix D
Table 2: Human evaluation results. "A ".vg.D."
D." represents the average difference between the results achieved by the evasion method and the results achieved by human- written text on the three tasks. The best value of each task is set bold.
Readability
Task Completion Rate % t
Method
Writing
QA
Review
Avg.D.
Writing
QA
Review
Avg.D. 1
DIPPER
3.52
4.12
3.42
-0.27
70.6
100
61.6
-13.3
SICO-Para
3.68
4.36
3.58
-0.09
82.0
100
72.4
-5.9
SICO-Gen
3.84
4.28
3.70
-0.02
93.6
100
69.6
-2.9
Human-Written
Human- Written
3.92
4.36
3.60
98.2
100
73.8
8

---

Published in Transactions on Machine Learning Research (05/2024)
As shown in Table 2 both SICO-Gen and SICO-Para demonstrate superior performance over DIPPER. in terms of task completion and readability over three tasks. Furthermore, STCO-generated text performs competitively compared with human- text in both metrics, with negligible difference less than 0.1. In contrast, DIPPER exhibits inferior performance relative to human-written text, particularly with a notable 0.27 decline readability.
4.4 Imperceptibility
Another key factor for the usability of Al-generated text is its imper- ceptibility. If text easily identified as AT-generated by humans, its usability might be significantly influenced. Thus, we conducted an experiment to assess the imperceptibility of text. We sampled 200 examples (50 each from AI, DIPPER, SICO-Gen, and human) across three tasks. Three human annotators were asked to identify whether the lext was Al-generated or human-wrilten. All annotators in the experiment used ChatGPT before. The values in Table g show the percentage of texts recognized as Al-generated by the annotators, where a lower percentage indicates higher imperceptibility. The re- sults demonstrate that SICO remarkably reduces the probability of being recognized by annotators for QA and review generation tasks. For the academic writing lask, the similar low detection rales for Al and human-generated text (24% VS 18%) annotators' detection capabilities are less accurate for this task, explaining why SICO is less effective here. More details can be found in Appendix
Table 3: Imperceptibility of text from
different sources.
Source
Writing
QA
Review
AI DIPPER SICO
24%
52%
54%
31%
46%
66%
22%
14%
37%
Human
18%
13%
22%
4.5
Cost Efficiency
In terms of the data prerequisite, SICO only needs K + [Xevail human-written input-output examples to build prompt, which is 8 + 32 = 40 in the experiments. The other Al-generated text can be produced by LLM leveraging these human samples. Furthermore, SICO offers the advantage of low cost. for prompt construction. Based on three repeated runs, the actual USD costs of SICO-Para are 1.04 + 0.04, 1.08 + 0.05, and 0.75 0.04 for Writing, QA, Review tasks, respectively.
5 Further Experiments
5.1 Ablation Study
We conducted an ablation study over academic writing task to to evaluate the contribution of individual components within the SICO framework. "Human-ICE" denotes the approach where human-written text is directly utilized as the in-context example for constructing the prompt. "w/o fcature" and "w/o ICE" refer to the prompts without feature text and the optimized in-context examples, respectively. "w/o OPT" represents the initial prompt before optimization (see Line 3 Algorithm 1. In our experiment, we explore SICO-Para on three types of detectors: GPT3-D, OpenAI-D and DetectGPT.
Results in Table that directly using human- text is ineffective, even making the detection more accurate. We speculate that the human-written examples are too heterogeneous and characterized in multiple ways, so LLM cannot effectively learn their attributes. Besides, the importance of feature text is comparatively less than that of optimized in-context examples. Furthermore, the result reveals the significant role of the optimization step in SICO. Using in-context examples that are not optimized is essentially equivalent to not using any in-context examples.
5.2 SICO with Different Proxy Detectors and LLMs
As described in Scction 3 SICO requires proxy detector and a LLM to construct a prompt. In this experiment, we explore the performance of SICO-Para on writing task, using three types of proxy detectors: (1) training-based model GPT-3.5 detector, (2) APT detector GPTzero, and (3) statistical method GPt.

---

Published in Transactions on Machine Learning Research (05/2024)
Table 4: The AUC scores of detectors on text generated by different methods. "." indicates the case where no evasion method is used. 'AVG' represents the average AUC scores across detectors.
Method
GPT3-D
OpenAI-D DetectGPT
AVG
0.908
0.789
0.834
0.844
Human-ICE.
0.918
0.825
0.847
0.863
SICO-Para
0.239
0.488
0.149
0.292
w/o feature
+0.106
+0.072
+0.051
+0.076
w/o ICE
+0.359
+0.133
+0.411
+0.301
w/o OPT
+0.361
+0.154
+0.364
+0.293
For different LLMs, adopt Vicuna-13B CChangg et al. 2023 open-source chatbot fine-tuned from
LLaMa (Touvron et al. 2023). Results in Table show that SICO maintains high degree of detection evasion performance, regardless of proxy detectors or LLMs. In most cases, SICO manages to reduce the AUC of detectors by approximately 0.4. More results of using different LLMs can be found in Appendix [B.4
Table 5:
The AUC scores of SICO using different proxy detectors and LLMs on writing task. The first line indicates the performance without applying any evasion method.
LLM
Proxy Detector
GPT3-D
GPT2-D
GPTzero
OpenAT-D
DetectGPT
Log-Rank
0.908
0.848
0.779
0.789
0.834
0.914
GPT-3.5
GPT3-D
0.239
0.332
0.290
0.488
0.149
0.147
GPT-3.5
GPTzero
0.549
0.143
0.299
0.458
0.429
0.493
GPT-3.5
DetectGPT
0.291
0.361
0.244
0.483
0.174
0.173
Vicuna-138
GPT3-D
0.393
0.777
0.380
0.690
0.337
0.375
5.3
Examples of SICO text
Table Fake reviews generated by SICO. The first line shows the task input of review generation.
Object: Sushi Station Keywords: revolving sushi bar, affordable, krab mix, creamy sauce, fresh PAi
menu. Sentiment: Positive
A1: If you're sushi lover, you have to check out Sushi Station! This revolving sushi bar is not only affordable, but it offers fresh and delicious menu that will leave craving more. My personal favorite is the krab mix sushi with its creamy sauce - it's simply heavenly. The staff is friendly and attentive, and the atmosphere is perfect for a casual night out with friends or family. Don't 't hesitate to give Sushi Station a try you won't be disappointed!
0.99
Sushi enthusiasts, please (ake note: Sushi Station provides unbeatable revolving sushi bar experience at wallet-friendly prices. Their menu is of the freshest quality and tastes nothing short of delicious. My top pick has to be the krab mix sushi; its creamy sance is pure bliss. Additionally, their friendly staff provided excellent service, while the casual ambiance proved ideal for relaxed night out with friends or family. Don't hesitate to give Sushi Station a try, you won't. regret it!
SICO-Para:
0.00
recently tried out Sushi Station's revolving sushi bar and must say, it was an amazing experience. The affordable pricing along with the wonderful krab mix and creamy sauce they offer is what really made it stand out from the rest. The menu was constantly updated with fresh and delicious options making hard to choose just one. If you're looking for a great sushi experience, Sushi Station is definitely worth visit.
SICO-Gen:
0.04
10

---

Published in Transactions on Machine Learning Research (05/2024)
Table 6 presents the fake reviews generated by SICO-Gen and SICO-Para. The generated text shows high readability and fulfill the task's s goal, successfully mentioning all keywords and generating positive reviews of the specified object. The Al probability, denoted as PAI in the table, is determined by the GPT3-D, More examples are shown in Appendix H
6 Defensive Methods for SICO
6.1 Training Detectors with SICO Data
To defend against SICO, a straightforward approach is to train a detector on SICO text. We proposed an ensemble method, which utilizes two detectors trained separately to identify original Al-gencratod text and SICO text. The final AT probability for an input calculated using the highest one from the two detectors, based on the assumption that both detectors should assign a low probability to human-writter text. We avoided training a single detector with SICO text augmentation because our experiments indicated that this approach reduces the model's ability to identify the original Al-generated text.
To test the effectiveness of this method, we obtain the S1CO detector by fine-tuning a RoBERTa model with 5k SICO examples and 5k writtewwitten examples. The human-written examples are sampled from WebText training set (Radford et al., 2019). The SICO examples are generated by using three different SICO-Para prompts to rewrite AT-generated text from the GPT2 output dataset (Solaiman et al. 2019 The SICO prompts used for detector training is entirely different from the one used for attack. We adopted the "GPT2-D" as the original Al-generated lext detector. The results in Table show that the ensemble approach significantly improves detection capabilities against SICO text, while maintaining the ability to identify the original Al-generated text. We believe this approach can be casily adapted to defend against other lypes of atlacks, such as DIPPER, by training and incorporating detectors with adversarial attack.
Table 7: AUC scores of ensemble detector against normal AT-generated text and STCO text. "AI" refers the detoctor's AUC score on the original Al-gencrated text.
Dataset
Detector
AI
SICO-Para
SICO-Gen
GPT2-D
0.848
0.332
0.099
Writing
+ SICO-D
0.842(-0.008)
0.762;+0.430)
0.691
GPT2-D
0.906
0.576
0.489
QA
+ SICO-D
0.892(-0.014)
0.815
0.784
GPT2-D
0.952
0.264
0.619
Review
+ SICO-D
0.949, 0.003)
(..85)
(.834(10.218))
6.2 Discussion of AI Detection Arms Race
Considering the evolution of AI detection techniques, the attackers and defenders are actually engaged in an arms race, where both sides contimuuuly develop their own optimal strategies of variability and sophistication to overcome the opponents. We expect the newly proposed attack method will remain effective until the defender collects enough adversarial examples and trains new detector them. Then the attacker might develop new technique to evade the most recent detector. This arms race presupposes that both sides are willing to share information like attack technique or detector API. If cither side stops sharing, the race will come to a halt. Practically speaking, the defenders hold a superior position in this race, as they can restrict the access to detector, thereby preventing the attacker from improving their methods. Moreover, the defender, typically large company, possessos more resources, including financial and computing power. The arms race represents the ultimate question in this field, which complex and significant. Hence, we only provided a surface-level discussion. A more thorough investigation and experimentation it left for future research.
11

---

Published in Transactions on Machine Learning Research (05/2024)
7 Conclusion
In conclusion, we have proposed a novel in-context learning approach, SICO, designed to guide LLMs generating text that can effectively evade detectors. Our extensive experiments on evasion demonstrate the superior performance of SICO, which significantly reduces the detection capabilities of existing Al text detectors across three tasks. A comprehensive human evaluation shows SICO text can achieve human-level readability and task completion rates.
Looking ahcad, SICO could act as a data generator and be integrated during the training phase of AT detectors, which may enhance their robustness. Furthermore, the core concept of SICO, namely, substitution- in-context learning, could be applied to a variety of text generation tasks. We believe that this opens up new avenues for future research in the fields of text generation and in-context learning.
8 Ethics Statement
The intention of this paper is not to offer a potential method for evading Al-generated text detection systems. Instead, our aim is raise awareness within the broader community about the vulnerabilities of existing AT-generated text detection systems to such technology. As many LLMs are public available and free to use, many people can adjust their prompt and generate text that evades these detectors. Given the ease of evasion illustrated in this study, these detectors not robust yet. We hope the rescarch community stress test their detectors against text generated by carefully crafted prompl, and create more robust detectors in the future.
Besides presenting a potent attack technique, we also offer defensive methods against it. We believe future research will develop more sophisticated methods to enhance the robustness of Al detectors. To support the research this field, we make our codes and data publicly available.
Acknowledgments
This work was supported by the National Key Research and Development Program of China under Grant 2022YTA1004102, and the Guangdong Major Project of Basic and Applied Basic Research (Grant No. 2023B0303000010).
References
Sahar Abdelnabi and Mario Fritz. Adversarial watermarking transformer: Towards tracing text provenance with data hiding, In 42nd IEEE Symposium on Security and Privacy, SP 2021, San Francisco, CA, USA, 24-27 May 2021, pp. 121-140. IEEE, 2021. doi: 10.1109/SP40000 202.00000222200088.. URL htttp::/ddoi.rgge/ 1109/SP40001.1 2021.00222022222
David Ifeoluwa Adelani, Haotian Mai, Fuming Fang, Huy H. Nguyen, Junichi Yamagishi, and Isao Echizen. Generating sentiment-preservingg fake online reviews using neural language models and their human- and machino-based detection. In Leonard Barolli, Flora Amato, Francesco Moscato, Tomoya Enokido, and Makoto Takizawa (eds.), Advanced Information Networking and Applications Proceedings of the 34th International Conference on Advanced, Information Networking and Applications, A INA-2020, Caserta, Italy, 15-17 April, volume 1151 of Advances in Intelligent Systems and Computing, pp. 1341 1354. Springer, 2020. doi: 10.1007 10.1007/978-33
114. URL httph::t////tt oefooi.oorg/11 www/o0../1111.. 19000007777330 0-000-000----- 00000000044411111111100
Daria Beresneva. Computer-generater text detection using machine lcarning: A systematic review. In Elisabeth Métais, Farid Meziane, Mohamad Saraee, Vijayan Sugumaran, and Sunil Vadera (eds.), Natural Language Processing and Information Systems 21st International Conference on Applications of Natural Language Information Systems, NLDB 2016, Salford, UK, June 22-24, 2016, Proceedings, volume 9612 of Lecture Notes Computer Science pp. 421 421-422424 121.426..20 Springer, 2016. doi: 10.1007/978.. 3- 3-19-4----7-
URL
12

---

Published in Transactions on Machine Learning Research (05/2024)
Tom Brown, Benjamin Mann, Nick Ryder, Melanic Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. Language models are few-shot learners. Advances in neural information processing systems, 33:1877 1901,, 2020.
Wei-Lin Chiang, Zhuohan Li, Zi Lin, Ying Sheng, Zhanghao Wu, Hao Zhang, Lianmin Zheng, Siyuan Zhuang, Yonghao Zhuang, Joseph E Gonzalez, el al. Vicuna: An open-source chatbot impressing gpt-4 with 90%* chatgpt quality, 2023.
Aakanksha Chowdhery, Sharan Narang, Jacob Devlin, Maarten Bosma, Gaurav Mishra, Adam Roberts, Paul Barham, Hyung Won Chung, Charles Sutton, Scbastian Gchrmann, ct al. Palm: Scaling language modeling with pathways. Xir preprinl urXiv:2244.025 02311, 2022.
Qingxiu Dong, Lei Li, Damai Dai, Ce Zheng, Zhiyong Wu, Baobao Chang, Xu Sun, Jingjing Xu, and Zhifang Sui. A survey for in-context learning. arXiv preprint Xiw:233100002/ 2022.
Angela Fan, Yacine Jernite, Ethan Perez, David Grangier, Jason Weston, and Michael Auli. ELI5: question auswering. In Anna Korhonen, David R. Traum, and Lluís Märquez (eds.), Proceedings of the 57th Conference of the Association for Computational Linguistics, ACL 2019, Florence, Italy, July 28- August 2, 2019, Volume 1: Long Papers, pp. 3558 3567. Association for Computational Linguistics, 2019. doi: 1116633/11/119133/ CRL https: www.ddioooogg/00/ 11tp///11110000//111111111
long form
Sebastian Gehrmann, Hendrik Strobelt, and Alexander M. Rush. GLTR: statistical detection and visualization of generated text. In Marta R. Costa-jussà and Enrique Alfonseca (eds.), Proceedings of the 57th Conference of the Association for Computational Linguistics, ACL 2019, Florence, Italy, July 28 August 2, 2019, Volume 3: System Demonstrations, pp. 111 116. Association for Computational Linguistics, 2019. doi: 10.18653/v http///1/11/////11111 1999319. URL https: //aoi. http:///...orggo..../ /ttp:/10...6653/11111-911011
Hila Gonen, Srini lyer, Terra Blevins, Noah A. Smith, and Luke Zettlemoyer. Demystifying prompts in language models via perplexity estimation. CoRR, abs/2212.04037, 2022. doi:
URL httpp://doi. org/10 48550/arXiv. 2212.222222 04037
Yunhao Gou, Tom Ko, Hansi Yang, James T. Kwok, Yu Zhang, and Mingxuan Wang. Leveraging per image-token consistency for vision-language pre-training- CoRR, abs/ 225,11598,,,,, 2022. doi: 10.48550/
URL
2211 15398
Alexei Grinbaum and Laurynas Adomaitis. The ethical need for watermarks in machine- language. CoRR, abs/2200 hbs/2220.001188, 2022. doi: 10.48550/arXiv http://aaa....2.0311111 031880. URL httpss///ol..rr///00.8555////// 2209.03113 03118
Biyang Guo, Xin Zhang, Ziyuan Wang, Minqi Jiang, Jinran Nie, Yuxuan Ding, Jianwei Yue, and Yupeng Wu. How close is chatgpt to human experts? comparison corpus, evaluation, and detection. CoRR, hass/200..0559, 2023. doi: 0044550//rXiv.2201..o
org/oo. 11.10.4555/////// aar00//rxi..... 2301 2301 URL https://doi http::///ooooo//1/.//o
07597
Dirk Hovy. The enemy in your own camp: How well can we detect statistically- an adversarial study. In Proceedings of the 54th Annual Meeting of the Association for Computational Linguislics, ACL 2016, August 7-12, 2016, Berlin, Germany, Volume 2: Short Papers. The Association for (0/553/11/p1// /1/1///1/////....///// hRLpstts::///ot org/ 10. 11t1//..//113/////1101//
fake reviews -
Computer Linguistics, 2016. doi: 10. 10.18653/vv
Hyuhun Joon Kim, Hyunsoo Cho, Junyeob Kim, Taeuk Kim, Kang Min Yoo, and Sang-goo Lee. Self-generated in-context learning: Leveraging rnto-regressive language models as a demonstration generator. CoRR, http/2206.0000 2022. doi: 10.48550/ Xiv. www.Xiv...2...... 220620802. URL https:: httt::://doi.or/100 48550/arXiv. htt.://6......r/00...488555/.. 2206 08082
John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. A watermark for large language models. CoRR, abs 2320..26622, 2023. doi: 10.48550/arxXvv220000 2ww..Xxi.....12222 URL https ridoi.oog//0... 10. 48550/ arXiv 2301 10226
13

---

Published in Transactions on Machine Learning Research (05/2024)
Kalpesh Krishna, Yixiao Song, Marzena Karpinska, John Wieting, and Mohit Iyyer. Paraphrasing evades detectors of ai-generated text, but retrieval is an effective defense. CoRR, abs/23033 13408, 2023. doi: URL httpp://ddo..oorg aat////0..05///xxi..... wwt.xxiii......... 13408
Thomas Lavergne, Tanguy Urvoy, and François Yvon. Detecting fake content with relative entropy scoring. Benno Stein, Efstathios Stamatatos, and Moshe Koppel (eds.), Proceedings of the ECAI'08 Workshop on Uncovering Plagiarism, Authorship and Social Software Misuse, Patras, Greece, July 22, 2008, volume 377 of wwtp://rr/o//o//////ppeee/ 377pppprr..pp..... pdf
CEUR Workshop Proceedings. CEUR O..R., 2008. URL hattps://ceur- org. /oog/Vol--aa wogg//oo-/3770 3771-377/ppe
Stephanie Lin, Jacob Hilton, and Owain Evans. Truthfulqa: Mcasuring how models mimic human falschoods. In Smaranda Muresan, Preslav Nakov, and Aline Villavicencio (eds.), Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), ACL 2022, Dublin, Ireland, May 22-27, 2022, pp. 3214 3252. Association for Computational Linguistics, 2022. doi: 10. 10.18653/ r1/2022.acl-long 229. URL https:
1tt////111111111//22222222 -long.. 229
Jiachang Liu, Dinghan Shen, Yizhe Zhang, Bill Dolan, Lawrence Carin, and Weizhu Chen. What makes good in-context examples for gpt-3? arXiv preprint arXiu:2101.06800 2021.
Yinhan Liu, Mylc Ott, Naman Goyal, Jingfei Du, Mandar Joshi, Danqi Chen, Omer Levy, Mike Lewis, Luke Zettlemoyer, and Veselin Stoyanov. Roberta: A robustly optimized BERT pretraining approach. CoRR, abs/1107.11066 2019. URL. http://arxiv...
wrg/ http::///aartvooo/aa//////////
11692
George A Miller. WordNet: An electronic lexical database. MIT press, 1998.
Fatemchsadat Mireshghallah, Justus Mattern, Sicun Gao, Reza Shokri, and Taylor Borg-Kirkpatrick, Smaller language models are better black-box machine-gennerated text detectors. CoRR, abs/ /2305099859 2023. doi: 11A8550/arXiv..20 230.iii..30008555 URL httt:s:///oo..or//00445550 0888
2305.09859
Eric Mitchell, Yoonho Lee, Alexander Khazatsky, Christopher D. Manning, and Chelsca Finn. Detectgpt: Zero-shot machine-generated text detection using probability curvature. CoRR,, abs/ /tep/2301.13300 2023. doi:
10.48550/arXiv 2301..1....001110... URL https:///oi. htt.://..r......0/////////////// 48550//rXii..222.. 2301. 11305
Niklas Muennighoff, Nouamane Tazi, Loie Magne, and Nils Reimers. MTEB: massive text embedding benchmark. In Andreas Vlachos and Isabelle Augenstein (eds.), Proceedings of the 17th Conference of the European Chapter of the Association for Computational Linguistics, EACL 2023, Dubrovnik; Croatia, May 2-6, 2023, pp. 2006 2029. Association for Computational Linguistics, 2023. URL URIphtts::// htttps://cclanthology org/ 2023. eacl manecmmmai....m 148
Jianmo Ni, Gustavo Hernández Ábrego, Noah Constant, Ji Ma, Keith B. Hall, Daniel Cer, and Yinfei Yang. Sentence-55:
Scalable sentence encoders from pre-trained text-to-text. models. In Smaranda Muresan, Preslav Nakov, and Aline Villavicencio (eds.), Findings of the Association for Computational Linguisties: ACL
2022, Dublin, Ireland, May 22-27, 2022, pp. 1864-1874. Association for Computational Linguistics, 2022. doi: 10. 10.18633/v1 w2t3://///222/mm/// /tt////22.22nnaaaaa... 144. URL
http://oo..orr///0000166/////// wtw.:/inn....nniinnnnin.. acl. 146
OP Chatgpt: Optimizing language models for dialogue. OpenAT, 2022.
OpenAl. Openai ai text classifier, January 2023. URL https://beta. cttpaaaiiccoomiitetteeeaeaeeeeee
Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, 1lya Sutskever, et al. Language models are unsupervised multitask learners. OpenAl blog, 1(8):9, 2019.
Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, and Peter J. Liu. Exploring the limits of transfer learning with a unified text-to-text transformer. Journal of Machine Learning Research, 1114))):1-67, 2020. URL http: //jmrr wttpppappss/v2222000r7
Pranav Rajpurkar, Jian Zhang, Konstantin Lopyrev, and Percy Liang. SQuAD: 100,000+ Questions for Machine Comprehension of Text. arXiv e-prints, art arXiv:1606.05255 052550 2016.
14

---

Published in Transactions on Machine Learning Research (05/2024)
Vinu Sankar Sadasivan, Aounon Kumar, Sriram Balasubramanian, Wenxiao Wang, and Soheil Feizi. Can ai-generated text be reliably detected? CoRR, abs/ hbss/2333.11166 2023. doi: 10.48550/ar (0.48650/axxiv.233311111 URL https://doi. /1t/////.850///xx........ 13003.1156
Trene Solaiman, Miles Brundage, Jack Clark, Amanda Askell, Ariel Herbert- Voss, Jeff Wu, Alec Radford, and Jasmine Wang. Release strategics and the social impacts of language modcls. CoRR, abs/1908.099200 0900,, 2019.
http://a http:pp//aaaii..rrg/aa//////////
StackOverflow. Temporary policy: Chatgpt is banned, 2023. URL httpps:/heeae.staakvvvorrll.o. quaatiooo////11/////aaaaaryaoaaa
Chris Blokel-Walken, Ai bot chalgpt writes smart essays-should academics worry? Nature, 2022.
Edward Tian. Gptzero: an ai detector, 2023. URL https:///ppzerro.ne me/
Kristina Toutanova, Dan Klein, Christopher D. Manning, and Yoram Singer. Feature-rich part-of-speech lagging with a cyclic dependency network. In Marti A. Hearst and Mari Ostendorf (eds.), Human Language Technology Conference of the North American Chapter of the Association for Computational Lánguistics, HLT-NAACL 2003, Edmonton, Canada, May 27 June 1, 2003. The Association for Computational org/N03-1033/
Linguistics, 2003. httpt:::/aclaatttooooeo
Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Aune Lachaux, Timothée Lacroix, Baptiste Rozière, Naman Goyal, Eric Hambro, Faisal Azhar, Aurelien Rodriguez, Armand Joulin, Edouard Grave, and Guillaume Lample. Llama: Open and efficient foundation language models. arXiv preprint arXiv:2302.1391 2023.
Youtube Uploader. Chatgpt pass detection 100% human written with this prompt, 2023. URL https: ;
7/www. 7/www youtube wwwptuube..o/waaaeeeeeee comm//atciiv Accessed on June, 2023.
Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, Ed Chi, Quoe Le, and Denny Zhou, Chain of thought prompting elicits reasoning in large language models. arXiv preprint 2rX1v:2201.11900 2022.
Yanbin Wei, Qiushi Huang, Yu Zhang, and James Kwok. Kicgpt: Large language model with knowledge in
context for knowledge graph completion. In Findings of the Association for Compulational Långuisties: EMNLP 2023, pp. 8667 8683, 2023.
Yanbin Wei, Shuai Fu, Weisen Jiang, James T Kwok, and Yu Zhang. Rendering graphs for graph reasoning in multimodal large language models. arXiv preprint ar arXiv:2402.00 02130, 2024.
Can Xu, Qingfeng Sun, Kai Zheng, Xiubo Geng, Pu Zhao, Jiazhan Feng, Chongyang Tao, and Daxin Jiang. Wizardlm: Empowering large language models to follow complex instructions. CoRR, abs/230 12244, 2023. doi: 10.48550/ ARXIV .2344. 12244. URL httph::ttt//oo .opoii..o. .oo.orgg///// 10. 48550/ar5ii1 2304. 12244
Rowan Zellers, Ari Holtzman, Hannah Rashkin, Yonatan Bisk, Ali Farhadi, Franziska Roesner, and Yejin Choi. Defending against neural fake news. In Hanna M. Wallach, Hugo Larochelle, Alina Beygelzimer, Florence d' d'Alcé-BB Emily B. Fox, and Roman Garnett (ods.). Advances in Neural Information Processing Systems
32: Annuua Conference on Newral Information Processing Systems 2019, NewrIPS 2019, December 8- 8-14, 2019, Vancouver, BC, Canada, pp. 90621 2019. URL
2019 200/hhaa//B800002222244433332112
html
Xiang Zhang, Junbo Jake Zhao, and Yann LeCun. Character-level convolutional networks for text classification. In Corinna Cortes, Neil D. Lawrence, Daniel D. Lee, Masashi Sugiyama, and Roman Garnett (eds.), Advances in Newral Informalion Processing Systems 28: Annual Conference on Newral Information Processing Systems 2015, December 7-12, 2015, Montreal, Quebec, Canada, pp. 649 657, 2015. URL https: htw.:eaddiin..eurrpp......ppappp hwt.:///////eeeottttttttssaaaaaa -bssaaaasatttaaaaaaaattaata..a..
Abstract html
Zhuosheng Zhang, Aston Zhang, Mu Li, and Alex Smola. Automatic chain of thought prompting in large language models. arXiv preprint ar arXiv:2210. 10.03493,0 2022.
15

---

Published in Transactions on Machine Learning Research (05/2024)
A
Implementation Details
A.1
SICO
A.1.1
Feature extraction
In feature extraction step, we instruct LLM to extract 5 fealures and calculate the utility score U of prompts encompassing each of these features. Then we select the feature with the highest utility for further steps. The goal of this step is to find a good feature to accelerate process, and make the whole process stable. Because sometimes LLM cannot extract useful features evade detectors. The pseudo-code illustrating this selection process is outlined in Algorithm B Table presents the prompt template used for feature extraction. Here, K text pairs generated by Al and Human are positioned within their respective positions. Table 21 shows the examples for feature extracted by LLM.
Algorithm Feature selections
Require: list of features Teetture prompt utility function u((-)
1: Initialize feature +
Initialize Umaz -00
for each feature Lteature,i in feature do Construct prompt P; +- leature, i Prask
5: if U(p+)) Umar then
6:
Goazure & teeaturo.i
7: Umar + U(p))
end if
end for
10:
return leeature
Table 8: Prompt for feature extraction.
Here are the writings from AT and human:
Al writing: <Al-generated text> Human writing: <human-written text>>
What is the key distinct feature of human's writings?
[LLM complete]
LLM consistently extract useful features. To test if LLM can reliably extract useful features, we conducted three separated experiments by running three feature extractions on different sets human-written text and Al-generated text. We use three different extracted features to guide LLM generation and test the AUC drop after adopting 3 different features compared with the originally generated text on the Writing task. Table g shows the results, indicating that LLM consistently extracts useful features for detector evasion from different examples.
Table 9: AUC drop of different features extracted based different human-written and Al-generated text.
Orig.
Feature
Feature 2
Feature 3
0.908
-0.288
-0.261
-0.142
16

---

Published in Transactions on Machine Learning Research (05/2024)
A.1.2 Task instructions
Table 10 shows the actual task instruction Prask we used in SICO. As mentioned in Section 3 feature text featuue at first step will be inserted before these task instructions, The "Paraphrase" instruction is Ppara used in paraphrase generation for substitution (Line 6 of Algorithm 1
A.1.3 Word Substitution
We employ WordNet synsets derive synonyms for given words. During optimization of in-context examples, only substitute content words, namely nouns, verbs, adjectives, and adverbs. Furthermore, we part-of- speech (POS) tag of the synonym to ensure it aligns with the original word. For POS tagging, utilize the Stanford POS Tagger (Toutanova et al.) 2003). Additionally, to maintain fluency in the modified text after substitution, we employed a pretrained mask language model to exclude synonyms with low likelihood. In experiment we use RoBERTa-bae model [Liu et al., 2019
Table 10: Task instructions of cach task.
Task
Task instruction Prask
Based the description, complete academic paragraph in human style writings:
Writing
Prompt: < lask inpul
Human: [LLM complete]
Based on the description, answer questions in human style writings:
QA
Q: < task input >
Human: [LLM complete]
Based on the description, write a human review about the given object and keywords, with a specified sentiment:
Review
Object, Keywords, Sentiment: task inpul
Human:
[LLM complete]
Based on the description, rewrite this in human-style writings:
Paraphrase
Origin: < original A T-generated text >
Human: [LLM complete]
A.2 Baselines
A.2.1 DIPPER
We choose the best evasion performance parameter setting from the original paper (Krishna et al. 2023 which is 60 for lexical diversity and 60 for re-ordering. And we set sampling temperature to 0.75, following the original implementation.
A.2.2 Human prompt
We carefully design a paraphrase prompt based on the detection idea of GPTzero Tian 2023 and prompt shared online (Uploader 2023), which distinguish the Al-gencrated content from Human-writton by perplerity and burstiness, stated by its creatof Perplexity is the concept raised in NLP field, which measures how well language model predicts a text sample. A text with a lower perplexity score indicates that the language model is better at calculating the next word that is likely to occur in given sequence. On the other hand, burliness basically measures the variation between sentences, including sentence length and structures. The lower the values for these two factors, the more likely it is that a text was produced by an AI. Table 11 shows the prompt we designed.
http:///h.coooottooooo/e//mtctee wwrttiitn-----iiitt-------eee wewpeeeeeeetad--eeeeeeettee-eeee 199774
17

---

Published in Transactions on Machine Learning Research (05/2024)
Table 11: Human-designed prompt to evade Al-generated text detection.
When it comes to writing content, two factors are crucial, 'perplexity' and 'burstiness'. Perplexity measures the complexity of text. Separately, burstiness compares the variations sentences. Humans tend to write with grealer burstiness, for example, with some longer or complex sentences alongside shorter ones. AT sentences tend be more uniform.
Paraphrase the following Al sentence to be human-like, with a good amount of perplexity and burstiness: Orig: orignal Al- Al-generated teat >
New: [LLM complete]
B Extra Experiments
B.1 Semantic preserving
We measure semantic similarity using t5- 35-based sentence encoder Ni al. 2022 which leads in semantic text similarity task of MTEB benchmark (Muennighoff al. 2023 Table 12 reports a comparison of the cosine similarity of text before and after paraphrasing by different methods. Our methods successfully preserves the
Table 12:
Cosine similarity between original AT-generated text and their respective paraphrased versions using different methods. The best scores in each task are highlighted in bold.
Method
Writing
QA
Review
Parrot
0.964
0.961
0.966
DIPPER
0.956
0.941
0.940
GPT-Para
0.986
0.982
0.987
Human Prompt
0.979
0.968
0.978
SICO-Para 0.976
0.964
0.971
semantic meaning during paraphrasing, and beats the other specifically trained paraphraser. Paraphrasing directly using GPT-3.5 yields the most promising results.
B.2 Stability of SICO
SICO is able to consistently construct effective detection evasion prompts, irrespective of the diversity the initial Al-human lext pairs and randomized samples drawn from the LLMs. This demonstrates the effectiveness of SICO in various initial conditions and settings, highlighting its applicability to diverse scenarios. Figure 3 presents the detection evasion performance of the best prompt at each step, denoted as U(p²) in Equation where higher value means higher evasion performance. The prompt is evaluated by 50 validation examples. We run three distinct experiment for each task to draw the plot. SICO successfully optimizes the initial prompt (at step 0) and achieves high level evasion performance across all three tasks, with different in-context examples.
D
B.3 SICO performs better against more capable detectors
We use the detectors' performance on the original Al-generated text to represent their base capability. The STCO advancing performance measured by the AUC difference between best SICO-Para or SICO-Gen and the perforerf paraphraser baselines. The statistical Pearson correlation is 0.47 with p-value of 0.048, indicating moderate positive correlation.
B.4 SICO with different LLMs
To examine the effectiveness of SICO employing different LLMs, we adopted an additional experiment which employs STCO-Para on three different. LLMss: Wix3rdI.M-33B Xu et al. (2023), GPT-335-turbo-0000, and
18

---

Published in Transactions on Machine Learning Research (05/2024)
1.0
0.8
0.6
Writing
0.4
QA
0.2
Review
0.0
0
1
2
6
Training Step n
Figure 3: The trajectory of the U(p²) during prompt optimization. This plot is derived from three distinct training runs on three tasks.
GPT-4-0613 OpenAl 2022). We employ Chal-D as proxy delector. The results in Table SICO with different LLMs maintains a high degree of detection evasion performance.
13 indicate that
Table 13: The AUC scores of SICO using different LLMs. indicates the performance without applying any evasion method. Symbol represents that SICO uses GPT3-D as the proxy detector for prompt construction.
Dataset
LLM
GPT3-D*
GPT2-D
DetectGPT
Log-Rank
0.908
0.848
0.834
0.914
Wi
0.571
0.582
0.510
0.481
Writing
GPT-3.5
0.239
0.332
0.149
0.147
GPT-4
0.157
0.260
0.263
0.277
0.981
0.906
0.876
0.956
WizardLM
0.721
0.467
0.561
0.404
QA
GPT-3.5
0.402
0.566
0.178
0.183
GPT-4
0.414
0.369
0.344
0.287
0.925
0.952
0.808
0.982
WizardLM
0.707
0.402
0.570
0.542
Review
GPT-3.5
0.465
0.264
0.270
0.300
GPT-4
0.408
0.307
0.427
0.382
C
Detectors
In this section, we introduce the mechanism and settings of the detectors in our experiments.
C.1 GPT-3.5 Detector
GPT-3.5 detector trained on Human ChatGPT Comparison Corpus (HC3) dataset (Guo et al. 2023). which including answers generated by ChatGPT and human. English-version of HC3 dataset contains five splits: reddit-eli5, OpenQA, Wikipedia, medicine and finance. The base model RoBERTa DasseTa-base and we use the model that only take answers input.
19

---

Published in Transactions on Machine Learning Research (05/2024)
C.2 GPT2 Detector
GPT-2 detector is obtained by fine-tuning a RoBERTa model with the outputs of the 1.5B-parameler GPT-2 model. The detector and the GPTT- output dataset are both provided by OpenAL. Although it is trained on GPT-2 outputs, our experiments shows that it can effectively detect text from GPT-3.5.
C.3 DetectGPT
Det identifies if text is generated by a model by observing unique characteristic: Al-generated text tends to be in areas where the language model's log probability function has negative curve. Here's how it works: It first perturbs the input text and constructs multiple perturbations input text. The perturb step is completed by a mask language model. Then checks the log probability of these variations against the original text by a inner language model. Finally, the text is considered A AT-generated if the log probability of the original input text is significantly higher than the log probability of perturbations.
We z-score implementation of DetectGPT and set sample mumber to 100 and replacement ratio to 0.3. The inner language model is GPT2-mediun and the mask language model is 15-large (Raffel el al. 2020).
C.4 Log-Rank
Log- Log-Rank method employs the mean prediction rank of each token a text. Specifically, for each word in text, given its previous context, it can calculate the absolute rank of this word by an inner language model. Then, for a given lext, we compute the score of the text by averaging the rank value of each word. Note that a smaller score denotes the text is more likely to be machine-gente geeeraeegeeerated. In experiment, we use GPT2-medium to calculate the rank of tokens to align with the implementation of DetectGPT.
C.5 GPTzero
GPTzero is recently proposed commercial detector, employed by many users and oragnizations. As claimed in its websites 13 GPTzero can be used to detect the outputs from detect ChatGPT, GPT4, Bard, LLaMa, and other AT models. GPTZero is the leading AT detector for checking whether a document was written by a large language model such as ChatGPT, GPTZero detects Al on sentence, paragraph, and document level. GPTzero was trained on a large, diverse corpus of writtnwwiltten and Al-generated lext, with a focus on English prose. GPTZero has served over 2.5 million users around the world, and works with over 100 organizations in education, hiring, publishing, legal, and more.
C.6 OpenAl Detector
OpenAl detector is officially provided by OpenAl after the release of ChatGPT, Although it only offers a web interface, we adopted the API implementation from (Krishna et al., 2023), which uses "model-detect-v22 in the OpenAT APT. Through reverse engineering of the website, determined that the web interfaces indeed call this model.
On July 20, 2023, OpenAl discontinued this detector, "due to its low rate of accuracy: Considering the discontinuation the OpenAT detector aligns with our findings, we choose to present the results of it in our paper, though it is out of date.
D Human Evaluation Details
For each lext, we show two questions for the human annotator. In terms of readability, we present the human annotator five options, with the scale of 1 to 5. The higher the value, the more readable of the presented texts. The question is identical for three tasks. The actual question and options are presented in Table [4] For task completion rate, we design three task-sp questions, as show in Table 13 Figure shows the
Shttps://gptzeroo.met hhttps: htttps://openai.com/ htwp:/aaaaiiooomm///oeeeeeeeeeee htwp:///wwwoooooeeewaiaiiieeeeee atger//iieeeeeeeeeoooiiiiiiiiiie wrrite---ett
20

---

Published in Transactions on Machine Learning Research (05/2024)
interface of our annotation platform. We estimated that the evaluation time of each text ranges from 60 to 90 seconds. For the imperceptibility experiment, we present the annotators with text and question to determine if ChatGPT generates the text. All annotators in the experiment used ChatGPT before.
Table 14: Question and options designed for readability.
Question
On scale of 1-5, how would you rate the readability of the given text?
Very difficult to read and understand.
2: Difficult to read, need extra time to understand.
Options
3: Neutral.
4: Easy to read.
5: Very clear and easy to read.
Table 15: Question and options designed for task completion.
Writing
Question
Is this academic essay correctly written (No errors and in academic style)?
No, it has obvious errors not in academic format.
Options
Yes, it is correctly written.
QA
Question
Does the answer relate the question?
(regardless of correctness)
No, not relative.
Options
Yes, it is relative.
Review
Question
Does this review impact your decision to choose this service?
No influence.
Options
Yes, it provides useful information.
Human evaluation on Parrot. As Parrot method performs better than DIPPER the Writing task, we conducted a small experiment to evaluate the usability of text generated text, similar to Table 2 We randomly sampled 120 examples (40 for Parrot, SICO-Para and SICO-Gen) from the writing task and asked two human annotators to evaluate them. The experiment result in Table 16 shows that SICO still outperforms Parrot by large margin.
Table 16: Human evaluation results of Parrot and SICO.
Method
Readablity
Task Compelction Rate
Parrot
3.35
70.0
SICO-Para
3.80
82.5
SICO-Gen
3.90
85.0
E
Datasets
Table 17 presents the prompts we employed create the initial AT-generated text MAI- For academic writing,
we sample Wikipedia paragraphs from SQuAD dataset. Then we give GPT-3.5 the first 30 words of these paragraphs and ask GPT-3.5 to complete the rest.
21

---

Published in Transactions on Machine Learning Research (05/2024)
For open-ended question answering, sample questions from Eli5 dataset and ask GPT-3.5 to generate answers.
For fake review generation, we first instruct GPT-3.5 to extract the business name and five keywords from Human-written reviews from Yelp dataset, and then generate fake reviews based on the extracted information with specified sentiment.
Table 17: Prompt for dataset creation.
Task
Prompt
Writing
Complete academic paragraph with prompt: < first 30 words of paragraph >
QA
Answer questions: < question >
< huuman-urilleet review > Show the review's object and 5 key words:
Review:
Rev-Ext
Write review about given object and key words, with specified sentiment: output of Rev-Eat >
Rev-Gen
Review:
The statistics of three datasets are shown in Table 1
Table 18: Average character length of human-writteng text and the original Al-generated text.
SQuAD
Eli5
Yelp
Human
770.3 796.5
794.7
834.3
AI
580.9
505.1
F Evade Watermarking Detection
SICO-Para can also be utilized to evade watermark detection, similarly to paraphrase approach. The watermarking algorithm we applied was introduced by Kirchenbaner et al. (2023), which only requires access to the LLM's logits at each time step to add watermarks. This algorithm operates three steps:
Mark random subset of the vocabulary as "green tokens" using the hash of the previously generated token random seed.
2. Increase the logit value for every green token by a constant, which denotes the watermark strength.
Sample sequences using decoding algorithms.
Verification of this watermark is achievable with blackbox access to the LM and knowledge of the hash function, achieved by tokenizing the text, calculating the standard normal score (z-score) through a hypothesis test, and comparing the observed proportion of green tokens to the expected proportion.
In our experiments, we used the text generated by a watermarked GPT-2, provided by Krishna et al. (2023). We employed the GPT-3.5 detector as proxy detector for training. The AUC and and the detection accuracy associated with various paraphrasing methods are presented in Table 19 where the threshold is set to 2.2 for accuracy measurement.
The results reveal that SICO-Para significantly outperforms other paraphrase techniques in evading watermark detection. Notably, both the AUC score and detection accuracy of SICO-Para are lower than that of other methods.
As we mentioned in Section 2 our work is focused on the vulnerability of training- based and statistical detectors. Therefore, designed STCO to generate human-like text aimed at fooling these two types
22

---

Published in Transactions on Machine Learning Research (05/2024)
Table 19: Performance paraphrase methods on watermarking detection.
Method
AUC
Accuracy
AI 0.998
99.0%
Parrot
0.980
88.5%
DIPPER 0.844
33.0%
GPT-Para 0.753
18.0%
SICO-Para 0.669
14.0%
Human
1.0%
of detectors, which differentiate between human and Al-generated text based on language characteristies. However, as discussed in the previous section, watermarking methods distinguish human and AT-generated text by adding unnoticeable mathematical character in Al-generated text. Theoretically, any paraphrasing method that can significantly rewrite the original text. will remove the watermark, thus evading the detector. For example, even the simplest baseline model, "GPT-Para", proved to be effective at evading the watermark detection, reducing accuracy from 99% to 18%. Based on the aforementioned reasons, put the watermark results in the appendix, though SICO-para can also help evade watermark detectors.
G
Evasion Performance
G.1
ROC Curves
Figure 2 shows ROC curves of different detectors presented with text generated by different methods, on open-ended question answering and fake review generation task. SICO curves lic below other basclines.
G.2 Detection Accuracy
Given that detection rates highly depend on the selected detection threshold, establish two thresholds for each detector. The high threshold fixes the false positive rate (FPR) at low level of 0.05, which means only 5% of human-written text will be classified as Al-generated. The low threshold fixes the true positive rate (TPR) at a high level of 0.9, based on the original Al-gencrated text. In this case, 90% of original Al-generated text will correctly classified. Table 20 shows the detection accuracy on three lask. In comparison with other paraphrasing methods, SICO yields the lowest detection rates in most cases.
H Examples of Text Generated by SICO
The examples of text generated by SICO across three tasks are presented Tabel
24
23

---

Published in Transactions on Machine Learning Research (05/2024)
Table 20: Detection accuracy on three tasks. "AI" refers to the detection rate on the original AI Al-generated text. The lowest score each detector is indicated in bold, and second-lowest is underlined.
Writing
High Threshold
Tareholi
Method
GPT3-D
GPT22D
GPTeer
OpenAI-D
DetectGPT
Log Rank
GPT3-D
GPT22D
GPTeev
OpenAI-D
Dete:GGPT
Log Rank
71.0%
6.5%
33.5%
32.0%%
62.0%%
90.0%
86.5%
90.0%
90.0%
90.0%
Parrot
25.0%
26.0%
0.5%
12.5%
2.5%
16.0%
53.5%
77.0%
46.5%
93.0%%
33.3%
36.13
DIPPER
28.5%
74.5%
2.5%
33.07%
1.0%
14.07%
62.5%
95.0%
64.5%
82.0%
44.0%
51.0%
GPT Para
58.5%
95.09%
5.0%
14.5%
5.0%
14.0%%
85.5%
73.0%
51.0%
81.0%
18.0%%
56. 58.5%
Humnan Pronupt
49.0%
26.5%
10.5%
15.5%
10.5%
18.0%
81.0%
63.5%
10.0%
76.0%
61.0%
67.0%
1.0O-Parm
1.0%
12.8%
0.0%
11.5%
0.0%
0.0%
5.8%
40.5%
1.0%
36.5%%
3.5%
2.0%
SICO-Gen
0.5%
2.5%
1.5%
2.056
3.0%
1.0%
6.0%
12.0%
3.5%
$2.0%
27.5%
5.5%
Human
5.0%
5.0%
4.0%
5.0%
5.0%
5.0%
30.5%
64.8%
31.3%
61.0%
38.5%
28.
Q4
High Threshold
Low Tareshold
Method
GPT3-D
GPT2-D
GPTaeo
OpenAI-D
DeteciGPT
Log Rank
GPT3-D D
GPT2-D
GPTecc
OpenAI-D
DetecsGITT
Log Rank
A1
91.0%
70.0%
70.0%
30.5%
40.3%
78.5%
90.0%
90.0%%
89.5%
90.0%
90.0%%
90.0%
Parrot
62.0%
49.0%
12.5%
13.5%
7.0%
34.5%
58.0%
78.0%
75.0%
85.5%
62.5%
52. 5%5
DIPPER
43.5%
88.5%
53.0%
22.0%
7.5%
27.5%
38.5%
96.5%
82.0%%
81.0%
06.5%
38. 5%.
CPT-Pau
75.5%
46.6%
12.0%
14.0%
7.0%%
32.5%
73.0%
77.5%
61.0%
86.5%
45.05%
Humnan Prompt
56.0%
32.07%
42.5%
12.5%
10.3%
31.0%
51.0%
36.5%
61.07%
83.0%
57.07%
47.
S100-Pacx
0.056
27.0%
0.5%
12.5%
0.0%
0.0%
0.0%%
51.0%
6.5%
63.5%
1.0%
0.0%
SICO-Gen
10.5%
24.5%
21.0%
12.5%
20.05
26.051
17.0%
47.5%
36.00%
61.0%
45.3%
37.05
5.0%%
5.0%
5.0%%
5.0%
5.0%
4.85%
29.0%
24.0%
61.5%
Reviow
High Threshold
Low Threboll
Method
GPT3-D
GPT2DD
Tieno
OpenAI-D)
DetectGPP
Log-Ronk
GPT3DD
GPT2D
GP Taero
OpenAI-D
DeteesGPP
Log-Rank
A1
35.0%
86.0%
76.3%
84.5%
25.3%
90.55%
9000%
901.0%
87.5%
900.0%
90.0%
90.05
Parrot
34.0%
78.0%
50.5%
47.0%
7.0%
64.0%
79.0%
85.5%
79.0%
60.0%%
70.5%
DIPPER
37.0%
96.5%
56-3%
36.1%%
3.5%
45.5%
82.5%
98.0%
73.5%
62.00%
45.0F%
44.0%
CPT-Para
T1.5%
62.0%%
79.5%
Human: Prompt
52.0%%
40.0%%
51.0%
47.5%
10.0%
47.0%
69.07%
43.0%
60.5%
62.0%
63.0%
45.5%
SICO- Parza
3.5%
9.0%
12.5%
0%
StOO-Gen
11.0%
39.89%
0.3%
16.0%%
11.3%
19.098
28.0%%
42.5%
0.3%
20.07%
47.0%
19.0%
5.09
5.0%
20.0%
12.0%
Table 21: Examples of features generated by LLM.
Task
Feature
Writing
Human tend to provide more specific details and facts, often including dates, numbers, and names. They also tend to use more complex sentence structures, including semicolons and parenthetical phrases, to convey additional information. However, their writing remains clear and concise, and they avoid unnecessary repetition or wordiness.
QA Human's writing style is characterized by the provision of specific and technical information. They delve into the science behind topic the details of process. They also challenges adds maance to the information, providing alternative explanations or clarifying misconceptions.
Review
Human writings are generally shorter and more to-the-point. They often use bullet points or numbered lists to convey their thoughts. They tend to be more critical and focused their personal experiences. They also use informal language and occasionally include personal ancedotes or opinions.
24

---

Published in Transactions on Machine Learning Research (05/2024)
Table 22: Text generated by SICO for open-ended question answering task.
Why does changing screen resolution (more specifically, custom resolution) will harm PAI your computer?
Question:
Changing the screen resolution, including a custom resolution, will not harm your computer. Tt 0.99 may result in display issues or reduced image quality if the resolution is not compatible with your monitor's capabilities. However, this can be resolved by simply reverting to the previous resolution or finding a suitable one.
AI:
Don't worry, changing your screen resolution won't harm your computer, even you 0.00 decide to go custom. The only trouble is that it may not work well with your monitor and cause image problems or lesser quality. Easy solution though just go back to the old resolution find matching one.
SICO-Para:
Using custom screen resolutions places a greater burden on system processing units, potentially leading increased strain and overheating. Moreover, setting a resolution to unsupported display dimensions put undue strain on graphics hardware, possibly causing irreparable damage. Adjusting to custom resolutions might, therefore, jeopardize the computer, leading to hardware malfunctions, degraded display output quality, and issues with other essential system components.
SICO-Gen:
0.00
Question: How do they calculate how much calories you've burned after an exerciso?
PAI
The number of calories burned during exercise is calculated by various factors such as body weight, the intensity of the exercise, the duration of the activity, and the person's 's metabolic rate. Some popular fitness trackers and machines use algorithms and formulas based on those factors to estimate the number calories burned. However, these numbers are only estimates and can vary depending on individual factors such as muscle mass, fitness level, and metabolic rate.
AI:
0.99
SICO-Para: If you wanna know how many calories you burn during excrciso, there are few 0.05 things to keep in mind. Your weight, the intensity of your workout, and how long you' 'e doing it for all come into play, as does your metabolic rate. Popular fitness trackers and machines usse fancy calculations based on all these factors give you an estimate of how many cals you burned. But, listen up, folks- these are only estimates! Your muscle mass, fitness, and metabolism are gonna differ from person person, results will vary. Clear?
The calculation calorie consumption requires assessment parameters such as exercise type, duration, and intensity, as well as the individual's body measurements. Several formulas exist to compute the total number of calories burned, including the Henedict equation, which computes resting metabolic rate and establishes parameters for calorie expenditure. Modern heart rate monitors and wearable fitness trackers utilise the latest algorithms to compute calorie consumption by laking into account the heart rate, age, and weight of the user.
SICO-Gen:
0.00
25

---

Published in Transactions on Machine Learning Research (05/2024)
Table 23: Text generated by SICO for fake review generation task.
Object: hotel in Las Vegas Keywords: Penthouse, staff, casino, restaurants, excellent experience. Sentiment: Positive
PAI
AI: had an amazing experience staying penthouse in Las Vegas! The staff was incredibly friendly and accommodating, always going above and beyond to make my stay comfortable and enjoyable. The casino also great addition, providing endless entertainment and excitement. And when it came to dining options, the variety of restaurants available was impressive. Overall, staying at this hotel was an excellent experience that won't forget anytime soon. highly recommend it to anyone looking for a luxurious and unforgettable Las Vegas getaway.
0.75
SICO-Para: Had an amazing stay at penthouse in Las Vegas. The staff were incredibly friendly and made my stay comfortable and enjoyable. Casino provided endless entertainment and variety of restaurants impressive. Overall, excellent experience and highly recommend for luxurious and unforgetiable Las Vegas getaway.
0.03
SICO-Gen: had the most incredible experience staying at luxurious penthouse in Las Vegas hotel. The staff was exceptional and provided top service. The casino and restaurants on the premises were outstanding, making my stay all the more enjoyable. Overall, I highly recommend this hotel for an excellent experience in sin city.
0.06
Object: Tia Rosa restaurant Keywords: Mexican food, spicy, bland taste, sweet syrup, lacos. PAI Sentiment: Negative
AI: recently visited Tia Rosa restaurant hoping to enjoy some authentic Mexican food. Unfor- 0.84 tunately, my experience was far from satisfactory. The food was overly spicy, the point where it overwhelmed any other flavors that may have been present. On the other hand, the tacos were disappointingly bland and lacked any real taste. To add insult to injury, the sweet syrup that was served with my meal just didn't pair well with the savory dishes. Overall, visit to Tia Rosa left. me feeling disappointed and unsatisfied.
SICO-Para: Recently went to Tia Rosa restaurant looking for authentic Mexican food. However, 0.02 experience unsatisfactory. Food was overly spicy, overpowering other flavours. Tacos lacked taste. Sweet syrup served with meal did not complement savoury dishes. Overall left feeling unsatisfied and disappointed.
My visit to Tia Rosa restaurant was complete letdown. was expecting some spicy and flavorful Mexican food, but unfortunately, the dishes were quite bland. Even the tacos, which are usually a safe bet, were disappointment. The only thing worthy of praise is the sweet syrup, but this alone cannot make up for the overall taste. I won't be returning to Tia Rosa anytime soon.
SICO-Gen:
0.04
26

---

Published in Transactions on Machine Learning Research (05/2024)
Table 24: Text generated by SICO for academic writing task.
Writing Start: The code itself was patterned so that most control codes were together, and all graphic codes were togother, for ease of identification. The first two columns (32 positions) were reserved
Pa
AI: The code itself patterned that most control codes were together, and all graphic codes
together, for 0.99
of ideutification. The first two columns (32 positions) were reserved for control codes, while the remaining 91 columna (91 positions) were designated
graphic codes. This pattern allowed for efficient processing and recognition of the different types of codes. Additionally, the code was designed to be casily modifiable, with the ability to add or remove codes as needed. These features made the code a practical and versatile tool for programming and data processing tasks.
The code's layout was systematically arranged for user convenience, with the primary objective of arranging the control and graphic codes within proximal access to facilitate swift identification. The layout allotted the first two columns, constituting total of 32 positions, sokely for control codes, while the remaining 94 columns [94 positions) were allocated for graphic eodes, promoting seamless reengnition and expediting processing operations. Furthermore, the code's malleability was considered& a parsmount attribute- the code was designed to be effortlessly modified, accommodating the addition and deletion of codes as per necessity. These inherent characteristics reudered the code au extremely pragmatic and adaptable tool for wide range of programming and data processing applications.
SICO-Para:
0.00
In order facilitate easy and efficient use, the code was structured in manner wherein control codes and graphic codes were distinctly grouped together, allowing for streamlined identification. This design allowed the first two columns (equivalent to 32 positions) to be exclusively reserved for control codes, ensuring that they were easily and rapidly located. The following columus, including columns three seven, to incorporate them in a comprehensive manner. By distributing codes systematically and allocating ample space for each grouping, the code structure its practical and logistical utility, while its unique design contributes to its widely accepted success and usage in various computer systems. The contextual background supplied enriches the readers' understanding of the code structure's 's siguificance and its potential impact on a system's 's proficlency.
SICO-Gen:
0.02
allocated for graphic codes providing ample space
organized for optimal and readability. The officiency of this coding scheme underscores
Writing Start: Germany has comprehensive school known the Gesantschule. While some German schools such the PAi Gymnasium and the Realschule have rather strict entrance requirements, the Gesamtschule does not have
A1: Germany has a comprehensive school known as the Gesantschule. While some German schools such as the Gymnasium and the Reslschule have rather strict entrance requirements, the Gesamtschule does not have any such requiremente. The Gesantschule is type of school that caters students with varying academic abilities and backgrounds, and provides them with an equal opportunity for education. This school system aims to promote social integration and reduce educational inequality by offering broad curriculum and flexible educational pathways. In addition, the Gesamtschule promotes the development of students" individual streugths and talents through its inclusive and cooperative learning env myvrroment. Overall, Gesamtschule represents a unique approach to education that prioritizes equal access and opportunity for students.
0.99
Germany boasts a comprehensive educational institution known as the Geeamtschule. Unlike typical German schools such as the Cymnasium and Realschule, which impose striet entry prerequisites, the Gesamtschule embraces inclusive admission criterion, ensuring equal education opportunities for students of diverse academic abilities and background. The Gesantschule represeuts collaboration between pupils with different skill sets paired with extensive and elastic curriculun, thereby striving to promote social homoggencity and curb academic inequalities. Furthermore, the Gesantscchle's 's inclusive and enoperative learning environment snols stimulate cultivation of student strengths while encouraging teamwork. Altogether, the Gesamtachule epitomizes an innovative educational frontier that prioritizes equality and accessbiility for all students.
SICO-Para:
0.01
An outstanding feature of the German education system is the Gesantschule, which is a holistic or comprehensive school. In comparison Gymnasium or Realschule where students are subject strict requirements gain admission, entrence to the Gesamtachule is less rigorous. This practice makes the school system more inclusive and allows students from diverse backgrounds to have access to quality education, fostering social unity. At Gesamtschule, students have the between different academic tracks based their demonstrated skills and interests, hence having personalized education experience. A blended curriculum is used; it includes theoretical and practical activities intended to propare students for their future careers or academic pursuits. The Gosamtsehule is pioneering framework in the German schooling system because it promotes equal opportunities in education, educational diversity, and at the same time equips the students with skill sets vital their future endeavors. The contextual backgrouad information provides clear insight the working of the Gesamtschule and underscores the importance of creating such models in fostering more equitable and inclusive society.
SICO-Gen:
0.00
liberty
27

---

Published in Transactions on Machine Learning Research (05/2024)
Orig
DIPPER
Humen Prompt
SICD gen
SICO-para
ChatGPT Detector
GPT2 Detector
GPTzero
0.8
True Positive Rate
0.6
0.4
0.2
0.2
0.4
0.8
0.0
0.4
OpenAl
DelectGPT
Log-Rank
1.0
0.0
True Positive Rate
0.6
0.4
0.0
02
0.4
0.6
0.8
0.0
0.2
0.4
0.6
0.8
1.0
0.0
0.2
0.4
0.6
0.8
1.0
False Positive Rate
False Positive Rate
False Positive Rate
(a) ROC curves review generation lask.
numan-Prompt
Parrot
GPT-Para
SICO-Para
random
ChatGPT Detector
GPT2 Detector
GPTzero
1.0
True Positive Rate
0.6
0.4
0.0
0.0
0.2
0.6
0.8
1.0
0.0
0.2
0.4
0.8
1.0
0.0
0.4
0.6
0.8
1.0
OpenAl Detector
DetectGPT
Log-Rank
0.8
True Positive Rate
0.6
0.2
0.2
0.6
0.4
0.8
0.4
False Positive Rate
False Positive
False Positive
(b) ROC curves on open-ended question answering task.
Figure 4: ROC curves.
28

---

Published in Transactions on Machine Learning Research (05/2024)
Here for question:
Quastion:
Why do we recognize cartain sounds (such gentle "hey wake up"), but not others when we sleep, given that they are the volume?
Answer:
When we sleep, our brain is still processing sounds and other sersory information, but it does at different level possible that we may recognize they have a particular significance. Additionally, the brain may be more likely to filter out certain sounds that determines aren't important relevant refreshed upon waking.
sounds more easily others because they are familiar to
of This flttering process important part how sleep helps us
feel
[172-1] Does the answer relate to the question? (regardless of correctness)
No, relative.
Yes, it relative.
[172-2] On scale of 1-5,how would you rate the readability of the given text?
1: Very difficult read and understand.
2: Difficult read, need extra time to understand.
3: Neutral.
4: Easy to read.
5: Very dear and easy read.
Figure 5: The interface of the annotation platform used in our experiment.
29


Reviews:
[{"review_id": "2SNa26YTOG", "reviewer": "Reviewer_8CXt", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n1. The proposed method is well-motivated. The authors try their best to give an explanation for each design.\n2. Most of the experimental settings are convincing. And the results of SICO are promising.\n3. The ablation study is thorough.\n\n\nWeaknesses:\n1. The method section, i.e. the 3rd section, is not easy to follow. It's better to give more detailed examples for each design and highlight the key factors. \n2. The human evaluation in the wild is not convincing. Response with high likes and discussions could only demonstrate the usefulness of the response instead of showing whether the response is generated by humans or AI.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "Finetuned classifiers and statistical methods are conventional methods used to distinguish whether the response is generated by humans or AI. This paper focuses on evaluating the vulnerability of these detectors. In this paper, the authors propose a novel Substitution-based In-Context example Optimization method (SICO) to automatically construct prompts for evading the detectors. Specifically, SICO iteratively rephrases the in-context examples to offer representative demonstrations for LLMs to generate undetectable text. Notably, the rephrasing procedure is directed by a proxy detector.\n\nThe main contributions of this paper are:\n1. Compared to conventional methods that apply external paraphrase, SICO takes advantage of LLM, and constructs prompts to evade detectors.\n2. The authors assess SICO across various tasks, including academic essay writing, question answering and fake review generation. The results demonstrate the strength of SICO, leading to a significant decrease in AUC for existing detectors, revealing the vulnerability of current methods. \n3. Lastly, human evaluation in the wild is also included to validate the effectiveness of SICO.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "Overall, I recommend an acceptance of this paper, since most claims are well supported. However, there are still two more requested changes:\n1. Rewriting of the method section, including more examples/figures to highlight the key factors;\n2. A better human evaluation setting or the author can convince me that the current setting is desired. This is the key factor for the acceptance.", "broader_impact_concerns": "The authors have well explained the impact in the paper, especially the negative impact of the human evaluation experiment. \n\nThere is one ethical issue in Section 4.5 about the real-life experiments. I personally encourage removing this part, because:\n1. It doesn't add much evidence to the paper, the number of \"Dislike\", \"Like\" or \"Comment\" doesn't necessarily show whether the text is generated more like a human's. It might only be about the usefulness.\n2. This evaluation is harmful to the community, even though all AI-generated responses on Reddit have been deleted. If the followers do similar evaluation in the future, it might hurt the platform.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "F8ri0YoLxW", "reviewer": "Reviewer_XdS7", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n\n- Comprehensive experiments against many baselines and realistic tasks. \n- Nice ablations of components of SICO (Table 4)\n- Method illustrates how futile generation detection methods are. \n\nWeaknesses:\n\n- Why is human evaluation on compared against DIPPER vs other methods? \n- Word-level substitution via WordNet seems less powerful than letting an LLM do it's own substitution?", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper presents a paraphrase-based method for evading generative text detectors called SICO. The proposed methods requires a small training dataset (40 human-written examples). SICO is evaluated on 3 tasks and against 6 current detection models/methods. The method reports good performance in fooling current text detection methods. The authors also evaluate the quality of the modified text to assess the impact of SICO on human preferences, where they find readability + task completion rate performs competitively against human-written text and outperforms", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "The following points could be elaborated on and would improve my scoring of the manuscript\n\n- The other methods seem to be trained models or simple prompts. SICO provides a method to iteratively improvement of the prompt. \n\n- Any reason you don't include the watermarking result in the main text vs. the suppliment? SICO seems to help here as well, though not as strongly as the other evasion categories\n\n- Some discussion on the \"arms race\" aspect of detection models. How long do we expect this method to continue working? It seems like having a method that relies on some known asset like WordNet is something that future detectors can easily incorporate into training future detectors.\n\n- Misc Clarifications: \n\"We restrict substitutions to content words that carry meanings and ensure that the substitution would not change the part-of-speech tags.\" What is meant by content words that carry meanings? Is this something specific to WordNet, noun phrases, etc?", "broader_impact_concerns": "- Deploying the AI text to reddit to collect human feedback on SICO-generated responses seems a bit fraught ethically. A cleaner, less problematic experiment here would be been do a more controlled experiment, e.g., presenting message threads on mechanical turk and having annotators vote/score responses. Technically can a bot even post to Reddit without direct solicitation (see https://www.reddit.com/wiki/bottiquette/) Some discussion of this would be appreciated.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "Cdsgel1Muf", "reviewer": "Reviewer_m6ge", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n  - New idea for prompting where SICO systematically perturbs the exemplars within a prompt to produce diversity and variation in its output.  \n  - Apply an LLM to write natural language descriptions of what makes text human-like vs machine-like.  Then uses these features to construct a better exemplars for the downstream LLM.\n  - A proxy is employed during \"training\" to iteratively find better examples for the Constructed Prompt.\n  - Showcases the strong ability of LLMs to perform well in few shot learning scenarios (~40 examples) and careful prompt engineering.\n\nWeaknesses:\n  - The SICO technique is inherently based on prompting and thus is highly unstable due to the brittle nature of prompt engineering.  The authors run their experiment with one run, and fail to show that the method generalizes across multiple trials.\n  - Detecting AI generated text to avoid spam or misinformation is a worthwhile task, and despite talking about the problem extensively, the introduced method does *not* address the issue.  Instead, they actually make the problem worse by teaching others how to avoid the existing detection methods. \n  - Requires access to a proxy detector and then greedily makes substitutions.  This ends up as a brute force method rather than anything particularly insightful.\n  - Requires many examples of human demonstrations to work. This defeats the whole purpose of the task because suppose I want to write fake product reviews.  If I have already written so many for demonstration, then my task of \"tricking people to buy my product\" is already accomplished.  \n  - Only tested with GPT 3.5 and Vicuna rather than GPT 4 or GPT 4 Turbo, or Claude, or Mixtral, or many of the other open source options. This also calls into question the generality of results.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The authors train LLMs to avoid being detected as AI text generators through a technique they call Substitution-based In-Context example Optimization (SICO) as a fancy form of prompt engineering. The core idea is to systematically perturbs the exemplars within a prompt to produce diversity and variation in its output. This substitution procedure is guided by a \"proxy detector\", acting similar to a discriminator in a GAN.  They then test on three tasks: (a) essay writing (b) open domain QA and (c) review generation. Compared to paraphrasing baselines, SICO decreases AUC by 0.5 on average, while still maintaining high naturalness.  This is validated through human evaluation and experimentation on Reddit.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "The paper would be greatly improved if a novel method was introduced that was able to out-smart SICO and all the other paraphrase baselines.  As things currently stand, the ideas introduced only make the situation worse for AI dishonesty.\nAlso run across many more variations and trials to show that any technique is stable, which is often not the case for prompt based methods.", "broader_impact_concerns": "The authors mention that their \"aim is to raise awareness within the broader community about the vulnerabilities of existing AI-generated text detection systems\", but many people are already raising the alarm on the danger of AI. There are entire \"Safety Departments\" concerned about alignment at all major AI research labs. Without an improved method for detecting AI-text (such as improved watermarking), the work seems to only make the problem worse.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: The paper has improved following the reviewer suggestions, including additional experiments that strengthen the work. An earlier version included an experiment that did not bring much to the paper but also raised ethical concerns; that section has been removed.
Decision: Accept (poster)