Training-free LLM-generated Text Detection by Mining Token Probability Sequences

Authors: Yihuai Xu, Yongwei Wang, Yifei Bi, Huangsen Cao, Zhouhan Lin, Yu Zhao, Fei Wu
Primary area: alignment, fairness, safety, privacy, and societal considerations
Keywords: Fake text detection, training-free, detection

Abstract:
Large language models (LLMs) have demonstrated remarkable capabilities in generating high-quality texts across diverse domains. However, the potential misuse of LLMs has raised significant concerns, underscoring the urgent need for reliable detection of LLM-generated texts. Conventional training-based detectors often struggle with generalization, particularly in cross-domain and cross-model scenarios. In contrast, training-free methods, which focus on inherent discrepancies through carefully designed statistical features, offer improved generalization and interpretability. Despite this, existing training-free detection methods typically rely on global text sequence statistics, neglecting the modeling of local discriminative features, thereby limiting their detection efficacy. In this work, we introduce a novel training-free detector, termed \textbf{Lastde}\footnote{The code and data are released at \url{https://github.com/TrustMedia-zju/Lastde_Detector}.} that synergizes local and global statistics for enhanced detection. For the first time, we introduce time series analysis to LLM-generated text detection, capturing the temporal dynamics of token probability sequences. By integrating these local statistics with global ones, our detector reveals significant disparities between human and LLM-generated texts. We also propose an efficient alternative, \textbf{Lastde++} to enable real-time detection. Extensive experiments on six datasets involving cross-domain, cross-model, and cross-lingual detection scenarios, under both white-box and black-box settings, demonstrated that our method consistently achieves state-of-the-art performance. Furthermore, our approach exhibits greater robustness against paraphrasing attacks compared to existing baseline methods.

Decision: accept (poster)
Reviewer scores: 6, 6, 6, 6

Reviews and discussion:
<thread>
creation date:
1730276157091

thread_type:
official_review

<thread_object>
creator: reviewer_luhl

<content>
summary:
This paper presents an AIGC detection method named Lastde. It is training free and can used both local and global statistics for
AIGC detection. An more efficient version named Lastde++ is also proposed for real-time detection.

strengths:
1. This paper presents an effective AIGC detection method, which can be very useful in the GenAI era.

2. The proposed method in sound and does not rely on training.

3. The experiments show promising results.

weaknesses:
1. It would be better if the paper writing can be improved. For example, figure 2 is not so easy to understand.

2. My biggest concern is that strong baselines are not included in experiments, such as GPTZero.

3. Can the proposed method work well in different domains?

4. Is the proposed method robust to some adaptive attacks like asking LLMs to mimic the human writing?

questions:
1. It would be better if the paper writing can be improved. For example, figure 2 is not so easy to understand.

2. My biggest concern is that strong baselines are not included in experiments, such as GPTZero.

3. Can the proposed method work well in different domains?

4. Is the proposed method robust to some adaptive attacks like asking LLMs to mimic the human writing?
</content>
</thread_object>

</thread>
<thread>
creation date:
1730668938683

thread_type:
official_review

<thread_object>
creator: reviewer_kqgm

<content>
summary:
The paper introduces a training-free method called Lastde for detecting LLM-generated text by analyzing TPS through a blend of local and global statistical features. Lastde incorporates temporal dynamics in TPS with diversity entropy to capture subtle distinctions between human and AI-generated text. An enhanced version, Lastde++, offers faster, real-time detection and outperforms existing methods across various scenarios. Extensive experiments demonstrate that Lastde++ provides superior robustness against paraphrasing attacks and cross-lingual challenges, establishing it as a powerful benchmark in LLM-generated text detection​.

strengths:
- The paper attempts to solve an important LLM-generated text detection problem without further training 

- The proposed method is straightforward and intuitive, and the experiments presented in the paper are comprehensive with solid results.

- The readers can easily understand the proposed method and follow the content of the paper.

weaknesses:
- I recommend including more evaluations on separate sets of LLM-generated text and human-written text ( i.e., evaluating the method on sets containing only LLM-generated text and only human-written text). This would provide valuable insights into how the proposed method works and whether the detection method performs better on LLM-generated text, or human-written text, or both.

- Paraphrasing attacks pose a significant threat in the context of LLM-generated text detection. It is highly recommended to use a more powerful LLM paraphraser, which could better highlight the proposed method’s ability to protect against such attacks.

- How did you predetermine the detection threshold, especially when the method is training-free and there is no prior knowledge about the LLM-generated text for the detector? The paper does not discuss the details of how the threshold was chosen but only provides a specific value used in a certain scenario. The threshold is a key component that leads to good detection performance no matter how good the proposed scores are extracted.

- Generally speaking, when we attempt to detect whether a given text is generated by LLMs, we usually do not know which specific models malicious users have employed to produce the text. It would be interesting to see a further experiment conducted on a mixed set of LLM-generated text created from various sources LLMs. The evaluation of detection abilities in the above experimental settings more closely matches real-world scenarios.

questions:
Please refer to the weakness.
</content>
</thread_object>

</thread>
<thread>
creation date:
1730754527643

thread_type:
official_review

<thread_object>
creator: reviewer_wrsh

<content>
summary:
The paper presents a training-free detector for LLM-generated text by analyzing token probability sequences. The proposed Lastde method combines both global and local statistics, using diversity entropy to capture temporal dynamics, thus achieving improved cross-domain detection and robustness against paraphrasing attacks. Evaluations on 6 datasets show that Lastde outperforms existing detectors.

strengths:
- The method is highly effective across cross-domain and cross-model scenarios without needing retraining.
- Lastde++ enables real-time detection with minimal computational cost, outperforming many established methods.
- Exhibits strong resistance to paraphrasing attacks, maintaining accuracy in varied textual manipulations.

weaknesses:
- The detection accuracy depends significantly on the chosen proxy model, especially in black-box settings, affecting usability across model types.
- The choice of proxy model in black-box scenarios is still unclear, and the use of GPT-j need more justification.
- Performance drops with shorter texts, which limits applicability in scenarios like social media or short Q&A responses.

questions:
How does Lastde handle highly stylized human-written text that might mimic AI-generated patterns?
Can Lastde be adapted or optimized for human-LLM co-authored text (e.g., LLM-revised text)?
Would a hybrid approach combining Lastde with a lightweight training-based model further enhance detection accuracy?
</content>
</thread_object>

</thread>
<thread>
creation date:
1730864661526

thread_type:
official_review

<thread_object>
creator: reviewer_sbpp

<content>
summary:
This paper introduces a novel training-free detector, termed Lastde that synergizes local and global statistics for enhanced detection. They introduce time series analysis to LLM-generated text detection, capturing the temporal dynamics of token probability
sequences. By integrating these local statistics with global ones, their detector reveals significant disparities between human and LLM-generated texts. They also propose an efficient alternative, Lastde++ to enable real-time detection. Extensive experiments on six datasets involving cross-domain, cross-model, and cross-lingual detection scenarios, under both white-box and black-box settings, demonstrated
that their method consistently achieves state-of-the-art performance. Furthermore, their approach exhibits greater robustness against paraphrasing attacks compared to existing baseline methods.

strengths:
originality: treating text detection as time series analysis is novel and the approach seems promising, though previous work SeqXGPT already did this. 

quality: I like the solid experiments from this paper since it compared with many previous baselines on a bunch of models and datasets. From all the experimental results, we can see the great potential of this method. 

clarity: This paper is well-written and easy to follow. The tables and figures and clear.

significance: This provides a new method for detection and potentially useful for detection.

weaknesses:
AUROC is not a very good measure for real-world use because FPR in real life is very important for this task, especially for students. I would like to know the TPR rate at 1% FPR.

In my opinion, treating the detection as a time series analysis is not entirely new. For example, your cited another work SeqXGPT also treats the token logits as waves, though your approach is different. Also, there is no comparison with SeqXGPT.

There are many hyperparameters in this algorithm to tune, weakening its potential practical usage.

Many tables rely on results on very small models like GPT-2 Neo-2.7 OPT-2.7, which makes it less significant.

questions:
1. I have one question. I understand that this is a training-free method. But it seems it includes various ingenious designs such as multiscale log-probability sequence, sliding-segmentation and diversity entropy and etc. And I would assume this can not be designed at the first glance. So thinking from the first principle, given the token logits, if the token logtis can be a good indicator through another function f(), then what's the best f()? perhaps we can directly a network to find the f()?

2. It is unclear to me whether the used models like llama are the base model or chat model because instruction-tuned models are more difficult to detect and base models are easy.

3. Do you need to know the prompt and question used for generating the text for detection? in reality, we do not know this.
</content>
</thread_object>

</thread>
<thread>
creation date:
1732353487800

thread_type:
official_comment

<thread_object>
creator: authors

<content>
title:
General Responses : Part II (2/2)

comment:
**3) Detecting LLM/human mixted texts:** We econsidered three different types of mixed texts, i.e., a) LLM-LLM mixture text, b) Human-LLM co-authored text, and c) LLM-revised text, and reported our results below.

**a) LLM-LLM mixture text** Using WritingPrompts as an example, we constructed datasets with text generated by multiple different LLMs. Specifically:

We experimented on detecting mixed texts from two LLM models and four LLM models, respectively. In the two-model mixture experiments, we evaluated on two different mixture ratios, i.e.,  50%+50% (Llama2-13B,OPT-13B) and 80%+20% (BLOOM-7B,Falcon-7B), respectively. In the four-model mixture experimenet, we used 25% texts from each of the four LLM models (Llama2-13B,OPT-13B,BLOOM-7B,Falcon-7B). We employed a simple "truncate-concatenate" approach to generate the mixed data. For example, taking 50% of characters from the first source model's text and concatenating with 50% from the second model's text. While this may lose some contextual information, we believe it's sufficient and efficient for demonstration purposes. The experimental results are as follows:

Table R4: Experimental results on LLM-LLM mixture text (AUROC metric)
| Mixing ratio | SourceModels | Likelihood | LogRank | DetectLRR | **Lastde** | Fast-DetectGPT | **Lastde++** |
| --- | --- | --- | --- | --- | --- | --- | --- |
| 50%+50%  | (Llama2-13B,OPT-13B) | 81.48 | 84.81 | 87.99 | 91.88 | 85.21 | **92.48** |
|  | (BLOOM-7B,Falcon-7B) | 78.80 | 82.56 | 87.47 | 94.95 | 88.59 | **95.65** |
| 80%+20%  | (Llama2-13B,OPT-13B) | 80.44 | 82.97 | 85.41 | 90.69 | 86.73 | **92.64** |
|  | (BLOOM-7B,Falcon-7B) | 76.98 | 81.52 | 52.91 | 96.38 | 92.05 | **96.57** |
| 25% each | (Llama2-13B,OPT-13B,BLOOM-7B,Falcon-7B) | 82.33 | 86.34 | 88.02 | **94.44** | 86.02 | 93.32 |

Table R5: Experimental results on LLM-LLM mixture text (TPR at 5% FPR metric)
| Mixing ratio | SourceModels | Likelihood | LogRank | DetectLRR | **Lastde** | Fast-DetectGPT | **Lastde++** |
| --- | --- | --- | --- | --- | --- | --- | --- |
| 50%+50%  | (Llama2-13B,OPT-13B) | 29.33 | 36.00 | 40.00 | 65.33 | 46.67 | **68.00** |
|  | (BLOOM-7B,Falcon-7B) | 16.00 | 30.00 | 34.67 | **76.00** | 39.33 | 70.67 |
| 80%+20%  | (Llama2-13B,OPT-13B) | 24.67 | 28.67 | 38.67 | 58.67 | 41.33 | **69.33** |
|  | (BLOOM-7B,Falcon-7B) | 16.67 | 22.67 | 44.67 | 80.67 | 59.33 | **83.33** |
| 25% each | (Llama2-13B,OPT-13B,BLOOM-7B,Falcon-7B) | 22.00 | 40.67 | 46.00 | **81.33** | 40.67 | 73.33 |

Table R6: Experimental results on LLM-LLM mixture text (Accuracy at 5% FPR)
| Mixing ratio | SourceModels | Likelihood | LogRank | DetectLRR | **Lastde** | Fast-DetectGPT | **Lastde++** |
| --- | --- | --- | --- | --- | --- | --- | --- |
| 50%+50%  | (Llama2-13B,OPT-13B) | 62.17 | 65.50 | 67.50 | 80.17 | 70.83 | **81.50** |
|  | (BLOOM-7B,Falcon-7B) | 55.55 | 62.50 | 64.83 | 85.50 | 67.17 | **82.83** |
| 80%+20%  | (Llama2-13B,OPT-13B) | 59.83 | 61.83 | 66.83 | 76.83 | 68.17 | **82.17** |
|  | (BLOOM-7B,Falcon-7B) | 55.83 | 58.83 | 69.83 | 87.83 | 77.17 | **89.17** |
| 25% each | (Llama2-13B,OPT-13B,BLOOM-7B,Falcon-7B) | 58.50 | 67.83 | 70.50 | **88.17** | 67.83 | 84.17 |

 The results show that even with texts mixed from different source models and different ratios, Lastde and Lastde++ still achieve good detection performance. In all three metrics across all datasets, Lastde or Lastde++ reach SOTA, especially with TPR (at 5% FPR) exceeding Fast-DetectGPT, the prior SOTA, by at least 20%. 

**b) Human-LLM co-authored text**：Many studies (Fast-DetectGPT [1] , DNA-GPT [2] (ICLR2024), DetectGPT [3] (ICML2023)) use the T5 model to simulate human modifications of text. Since the T5_Paraphraser used in the main text only attacked LLM-generated text, the resulting text can be considered as co-authored by human (T5 mimic) and LLM. We provided the complete detection results in Table 3 on page 9 of the main text, and here is a summary of the results:
| **Methods** | Xsum(Paraphrased) | WritingPrompts(Paraphrased) | Reddit(Paraphrased) |
| --- | --- | --- | --- |
| Fast-DetectGPT | 67.17 | 83.82 | 83.04 |
| Lastde++ | **73.43** | **88.54** | **87.90** |

Compared to Fast-DetectGPT, Lastde++ shows higher detection performance on Human-LLM co-authored text (post-attack text), indicating its greater robustness.

**c) LLM-revised text:**  For LLM-revised text experiment, we used a powerful paraphraser to attack both human-written text and LLM-generated text simultaneously, and the results are shown in Table R3. We believe that the post-attack text falls under one scenario of LLM-revised text. Table R3 shows that Lastde++ is more adaptable to LLM-revised text compared to Fast-DetectGPT, indicating its stronger robustness.

[1] Efficient Zero-Shot Detection of Machine-Generated Text via Conditional Probability Curvature.

[2] Divergent N-Gram Analysis for Training-Free Detection of GPT-Generated Text.

[3] Zero-Shot Machine-Generated Text Detection using Probability Curvature.
</content>
</thread_object>

</thread>
<thread>
creation date:
1732353729599

thread_type:
official_comment

<thread_object>
creator: authors

<content>
title:
General Responses : Part II (1/2)

comment:
**Concern II** More experiments on evaluating the robustness of our method.

**Response to Concern II** In this part, we address another three research questions, including: capability in detecting LLM-generated texts that mimic human writing styles, showing robustness against more powerful paraphrasers, superior performance in detecting LLM-LLM mixed text, Human-LLM co-authored text, and LLM-revised text.

**1) Detecting human-style texts:** Using the WritingPrompts dataset as an example, we created two new datasets using gpt-4-turbo-04-09 and gpt4o-08-06. Unlike before, we designed the prompt as: "Please mimic the human writer an article with about 200 words starting exactly with: <prefix>", explicitly requiring human-style mimicry. We used the settings from Appendix D Table 8 of our paper, with Lastde++ directly using expstd. The following Table R2 show results for three metrics:

Table R2: The average of WritingPrompts (gpt-4-turbo-0409) and WritingPrompts (gpt4o-08-06)
|                        | Likelihood | LogRank | DetectLRR | **Lastde** | Fast-DetectGPT | **Lastde++** |
| ---------------------- | ---------- | ------- | --------- | ---------- | -------------- | ------------ |
| **AUROC**              | 87.37      | 85.60   | 74.94     | 87.68      | **96.49**      | **96.49**    |
| **TPR at 5% FPR**      | 30.00      | 30.67   | 24.34     | 29.33      | 82.67          | **85.36**    |
| **Accuracy at 5% FPR** | 62.50      | 62.83   | 59.67     | 63.34      | 88.84          | **90.17**    |

For both human-style mimicking datasets, Lastde++ shows comparable or better results across all three metrics compared to Fast-DetectGPT [1] (ICLR2024), demonstrating its effectiveness in detecting LLM text that mimics human writing style.

**2) More powerful paraphraser:**  The T5_Paraphraser used in our paper is an 800M parameter model (consistent with Fast-DetectGPT). To further demonstrate our method's robustness, we explored the most downloaded paraphraser on HuggingFace specifically designed for text attacks. Since Dipper's model exceeds 50G, we couldn't run it on our hardware. Instead, we chose another popular ~3G model: t5-large-paraphraser-diverse-high-quality (https://huggingface.co/ramsrigouthamg/t5-large-paraphraser-diverse-high-quality). Below are the detection results (AUROC) on WritingPrompts (Llama2-13B) and WritingPrompts (OPT-13B) before and after attacking with the new paraphraser:

Table R3: Experimental results on more powerful paraphrasing attack
| **Scenarios** | **Methods/Datasets** | **Llama2-13B(Original)** | **Llama2-13B(Paraphrased)** | **OPT-13B(Original)** | **OPT-13B(Paraphrased)** |
| --- | --- | --- | --- | --- | --- |
| **White-box** | Fast-DetectGPT | 98.04 | 88.59(-9.45) | **99.40** | 89.42(-9.98) |
|  | Lastde++ | **99.41** | **93.41(-6.00)** | **99.40** | **90.81(-8.59)** |
| **Black-box** | Fast-DetectGPT | 86.44 | 78.79(-7.65) | 89.64 | 84.00(-5.64) |
|  | Lastde++ | **93.05** | **85.86(-7.19)** | **95.25** | **90.86(-4.39)** |

Analysis: Even under attacks from a more powerful paraphraser, Lastde++ shows smaller performance degradation compared to Fast-DetectGPT in both white-box and black-box scenarios, indicating its superior robustness against paraphrasing attacks.
</content>
</thread_object>

</thread>
<thread>
creation date:
1732353766402

thread_type:
official_comment

<thread_object>
creator: authors

<content>
title:
General Responses : Part I

comment:
We would like to sincerely thank all reviewers for their time and constructive comments. After carefully considering all comments, we have categorized common suggestions into two main groups, and addressed all concerns accordingly in a point-by-point manner. We summarize our response and revisions below.

**Concern I** Comparisons with stronger baselines and source models, and exploring the possibility with some recent plug-and-play detection methods.

**Response to Concern I**. In this part, we address four research questions, including: verifying the superior performance of our method on more datasets with stronger source models (e.g. chat/instruct model), invloving more powerful baselines (e.g. GPTZero), improved performance by integrating with learning-based detectors, and hyperparameter tuning. Below are our detailed responses.

**1) Including more datasets:** We conducted experiments on multiple datasets recently released by ReMoDetect [1] (NeurIPS2024) and Fast-DetectGPT [2] (ICLR2024). These datasets cover four domains: Xsum, SQuAD, WritingPrompts, PubMedQA, and six chat/instruct type or large-parameter (≥20B) source models: NeoX-20B, Llama3-70B, GPT-3.5-Turbo, GPT-4, GPT-4-Turbo, Claude3. The dataset links are as follows (for Fast-DetectGPT, we only use data generated by NeoX-20B): 
- ReMoDetect (Llama3-70B、GPT-3.5-Turbo、GPT-4、GPT-4-Turbo、Claude3) : https://github.com/hyunseoklee-ai/ReMoDetect/tree/main/exp/data
-  Fast-DetectGPT(NeoX-20B) : https://github.com/baoguangsheng/fast-detect-gpt/tree/main/exp_main/data

**2) Including more baselines:** To make the experiments more complelling, we have added another two strong baselines: Binoculars [3] (ICML2024), GPTZero (commercial, 2024-11-11 base version). For Binoculars, we adopted its default settings from the original paper. For GPTZero, we first replicated the detection results provided in the ReMoDetect paper [1] (NeurIPS2024), then performed detection experiments on the Fast-DetectGPT (NeoX-20B) related datasets.

**3) Combining with plug-and-play detector:** We explored the feasibility of integrating our method with recent plug-and-play detectors (plugins), e.g. TOCSIN [4] (EMNLP2024). Specifically, in the rebuttal, we combined TOCSIN with Lastde and Lastde++ (the same approach was applied to other baselines), and reported the detection results (AUROC values) on the aforementioned multiple datasets. 

**4) Unified hyperparameters:** We unified the hyperparameters of Lastde and Lastde++ to $s=3,\varepsilon=10,\tau^{\prime}=5$, as the parameters used here (not the best parameters in our datasets).  For other baseline methods, we kept their sampling and scoring models as GPT-J. 

**5) Our new results:** We conducted experiments following the above settings, and reported our new results in Table R1, which includes before and after integrating with TOCSIN. Table R1 shows the average AUROC across all datasets, and the complete results have been added to Appendix of our revised paper and highlighted in red font. 


Table R1: Comparisons with more datasets and more baselines.
|                | Likelihood | LogRank | DetectLRR | Fast-DetectGPT | Binoculars | GPTZero | **Lastde** | **Lastde++** |
| -------------- | ---------- | ------- | --------- | -------------- | ---------- | ------- | ---------- | ------------ |
| without TOCSIN | 87.0       | 87.2   | 82.2      | 93.7           | 87.5      | 88.6    | 89.6       | **94.2**     |
| with TOCSIN    | 92.4       | 92.4    | 85.5      | 94.3           | 87.5       | 88.6    | 93.3   | **95.3**         |
| improvement    | 5.4       | 5.2    | 3.3      | 0.6            | -          | -       | 3.7       | 1.1          |

Analysis: Table R1 shows that our method can still achieve SOTA even if we did not run Lastde++ (Distribution-based) under the optimal hyperparameter setting. This conclusion holds true even when compared to the two newly added baselines: Binoculars, GPTZero. Meanwhile, Lastde also performed best among Sample-based methods. Finally, all detection methods showed performance improvements when combined with TOCSIN, a lightweight plug-and-play detection module, with our method showing more significant gains (compared with Fast-DetegtGPT). With more datasets and more powerful baselines, we believe that Lastde and Lastde++ are highly effective detectors.

[1] ReMoDetect: Reward Models Recognize Aligned LLM’s Generations, NeurIPS 2024

[2] Fast-DetectGPT: Efficient Zero-Shot Detection of Machine-Generated Text via Conditional Probability Curvature, ICLR 2024

[3] Binoculars: Spotting LLMs With Binoculars: Zero-Shot Detection of Machine-Generated Text, ICML 2024

[4] TOCSIN: Zero-Shot Detection of LLM-Generated Text using Token Cohesiveness, EMNLP 2024
</content>
</thread_object>

</thread>


Metareview:
metareview:
- Scientific Claims and Findings:
    - The paper introduces a training-free approach for detecting text generated by LLMs. It leverages time series analysis to mine token probability sequences, effectively combining local and global statistics for improved detection accuracy.

- Strengths:
   - The proposed method is new and sound.
   - It is effective across cross-domain and cross-model scenarios without requiring retraining, and it is robust against paraphrasing attacks and various textual manipulations.

- Weaknesses:
    - The method may be somewhat complex due to the many hyperparameters that need tuning.

- Most Important Reasons for Decision:
     - Based on the identified strengths.