Title: RADAR: Robust AI-Text Detection via Adversarial Learning
Venue: NeurIPS 2023
Accepted: yes
Keywords: Large Language Models

Text Detection

Adversarial Learning

Paraphrase
Abstract: Recent advances in large language models (LLMs) and the intensifying popularity of ChatGPT-like applications have blurred the boundary of high-quality text generation between humans and machines. However, in addition to the anticipated revolutionary changes to our technology and society, the difficulty of distinguishing LLM-generated texts (AI-text) from human-generated texts poses new challenges of misuse and fairness, such as fake content generation, plagiarism, and false accusations of innocent writers. While existing works show that current AI-text detectors are not robust to LLM-based paraphrasing, this paper aims to bridge this gap by proposing a new framework called RADAR, which jointly trains a $\underline{r}$obust  $\underline{A}$I-text  $\underline{d}$etector via  $\underline{a}$dversarial lea$\underline{r}$ning. RADAR is based on adversarial training of a paraphraser and a detector. The paraphraser's goal is to generate realistic content to evade AI-text detection.
RADAR uses the feedback from the detector to update the paraphraser, and vice versa.
Evaluated with 8 different LLMs (Pythia, Dolly 2.0, Palmyra, Camel, GPT-J, Dolly 1.0, LLaMA, and Vicuna) across 4 datasets, experimental results show that RADAR significantly outperforms existing AI-text detection methods, especially when paraphrasing is in place. We also identify the strong transferability of RADAR from instruction-tuned LLMs to other LLMs, and evaluate the improved capability of RADAR via GPT-3.5-Turbo.

RADAR: Robust AI-Text Detection via Adversarial Learning

Abstract

Recent advances in large language models (LLMs) and the intensifying popularity of ChatGPT-like applications have blurred the boundary of high-quality text generation between humans and machines. However, in addition to the anticipated revolutionary changes to our technology and society, the difficulty of distinguishing LLM-generated texts (AI-text) from human-generated texts poses new challenges of misuse and fairness, such as fake content generation, plagiarism, and false accusations of innocent writers. While existing works show that current AI-text detectors are not robust to LLM-based paraphrasing, this paper aims to bridge this gap by proposing a new framework called RADAR, which jointly trains a robust AI-text detector via adversarial learning. RADAR is based on adversarial training of a paraphraser and a detector. The paraphraser's goal is to generate realistic content to evade AI-text detection. RADAR uses the feedback from the detector to update the paraphraser, and vice versa. Evaluated with 8 different LLMs (Pythia, Dolly 2.0, Palmyra, Camel, GPT-J, Dolly 1.0, LLaMA, and Vicuna) across 4 datasets, experimental results show that RADAR significantly outperforms existing AI-text detection methods, especially when paraphrasing is in place. We also identify the strong transferability of RADAR from instruction-tuned LLMs to other LLMs, and evaluate the improved capability of RADAR via GPT-3.5-Turbo.

Project Page and Demos: https://radar.vizhub.ai

IBM demo is developed by Hendrik Strobelt and Benjamin Hoover at IBM Research HuggingFace demo is developed by Xiaomeng Hu

1 Introduction

Large language models (LLMs) are high-capacity neural networks that are pretrained at web-scale datasets. They are foundation models achieving state-of-the-art performance in a wide range of natural language processing tasks (e.g. document completion, question answering, machine translation, and content creation with text prompts) with advanced capabilities such as in-context learning and reasoning (e.g. chain of thoughts). In particular, LLMs are the backbone of many ChatGPT-like conversational bots that enable text generation with high fluency and accuracy. However, while LLMs and their derived applications are expected to become ubiquitous in our future technology and society,

Frozen

Trainable

UpdateOwithPPOLoss

Human-text

Paraphrased Al-text

H

M

Go

p

Buffer B

Reward

TargetLanguageModel

Paraphraser

H

M

p

D中

0.98

0.02

0.15

InputSamples

Probability tobe Human-Text

Training

Detector

Testing

Human-text

Dp

0.98

0.01

InputSamplesTrainedDetectorProbabilitytobeHuman-Text

Thresholding

DetectionResults

new risks in failing to distinguish the so-called 'AI text' generated by LLMs have emerged and gained considerable attention due to various reasons. The problem of reliable AI-text detection is motivated by realistic socio-technological challenges such as fake content generation, AI plagiarism (e.g. using LLMs for writing tests), and false accusations of innocent writers. According to a report released by OpenAI 1 , their latest AI-text detector is admittedly not fully reliable. In the reported evaluation of some challenging cases for English texts, their classifier only correctly identifies 26% of AI-text (true positives) while incorrectly classifying 9% of human-written text (false positives). Moreover, a recent study [21] found that state-of-the-art AI-text detectors demonstrated severely degraded performance when encountering texts written by non-native English speakers.

What can be even more challenging in AI-text detection is that existing AI-text detectors are prone to be manipulated. The authors in [27, 17] showed that using LLMs as a paraphraser can easily evade several AI-text detection methods, even in the scenario when the original AI-text had been watermarked. These findings sparked a heated debate about whether and how we can successfully design a reliable AI-text detector. While [27] theoretically quantifies the best detector's performance with respect to the total variation distance between AI-text and human-text distributions and argues that AI-text is difficult to detect, another work [3] proves that it is possible to obtain a reliable AI-text detector unless the human-text distribution is exactly the same as the AI-text distribution, based on an information-theoretical analysis (i.e., the sample complexity of Chernoff information and likelihood-ratio-based detectors).

To improve AI-text detection, we propose RADAR , a framework for training a robust AI-text detector using adversarial learning. An overview of RADAR is illustrated in Figure 1. Our proposal draws inspiration from adversarial machine learning techniques that train a high-quality generator by introducing a discriminator to form a two-player game, such as generative adversarial networks (GANs) [10]. In RADAR, we introduce a paraphraser and a detector as two players with opposite objectives. The paraphraser's goal is to generate realistic content that can evade AI-text detection, while the detector's goal is to enhance AI-text detectability. In our framework, both the paraphraser and the detector are parametrized by separate LLMs. During training, the paraphraser learns to rewrite the text from a training corpus (generated by a target LLM from a human-text corpus) with the

w/o Paraphraser  RADAR-Unseen Paraphraser

0.9

0.8

0.7

DetectionAUROC

0.6

0.5

0.857

0.4

0.887

0.755

0.904

0.867

0.900

0.856

0.3

0.651

0.627

0.2

0.422

0.461

0.426

0.472

0.434

0.1

0

log p

rank

log rank

entropy

OpenAl (RoBERTa)

RADAR

DetectionMethod

aim of decreasing the likelihood of AI-text prediction by the detector, whereas the detector aims to enhance the detection performance by learning to compare human-text v.s. AI-text from the training data and the paraphraser's output. These two players iteratively update their model parameters until their respective validation loss becomes stable. Specifically, the paraphraser treats the prediction of the detector as a reward and uses Proximal Policy Optimization (PPO) [28] for updates. The detector updates its parameters based on a logistic loss function evaluated on the human-text and AI-text corpora (including the texts generated by the paraphraser). In the evaluation phase, the trained detector is deployed to predict the likelihood of AI-written content for any input instance. When compared with 6 existing detectors, our experimental results on 8 different LLMs and 4 datasets show that RADAR attains similar detection performance on the original AI-generated texts (a relatively easy task) and simultaneously improves the AI-text detectability when facing an 'unseen' paraphraser (i.e. this paraphraser is not used in RADAR). The result is summarized in Figure 2. When facing an unseen paraphraser (GPT-3.5-Turbo), the area under the receiver operating characteristic (AUROC) score of RADAR is improved by 31.64% compared to the best existing detector, suggesting a significant improvement and reliable AI-text detection power enabled by RADAR.

We summarize our main contributions as follows:

To the best of our knowledge, RADAR is the first study that leverages the idea of adversarial learning between a paraphraser and a detector for training a robust AI-text detector.

The experiments on 8 different LLMs (Pythia, Dolly 2.0, Palmyra, Camel, GPT-J, Dolly 1.0, LLaMA, and Vicuna) and 4 datasets show that unlike the six existing supervised and unsupervised AI-text detection methods, RADAR is the only robust detector that attains consistently high detection performance. RADAR's detector is not weakened by paraphrasing, as shown in Figure 2.

We also find the strong transferability of RADAR's detection capability. The detectors of RADAR obtained from instruction-tuned first-class LLMs (e.g., Vicuna-7B) are also effective on other LLMs, suggesting the possibility of training a universal AI-text detector based on the state-of-the-art LLMs.

2 Related Work

AI-Text Detection. The research in AI-text detection can be divided into three approaches. (i) Statistical methods: some statistics such as entropy [19], n-gram frequency, and perplexity are used as a threshold to discern AI-text. A typical example is GLTR [8], which exploits entropy, probability, and probability rank for detection. A more recent work is DetectGPT [23], which assumes that the machine-generated text always lies in the negative curvature region of the log probability of the LLM of interest. Based on this hypothesis, DetectGPT perturbs the input text with a mask-filling language

model, such as T5 [25]. Then, AI-text detection is performed by comparing the log probability of the text and its infilled variants. (ii) Classification methods: AI-text detection is formulated as a binary classification task, and a classifier is trained for a target language model [37, 29, 26, 13]. For example, OpenAI trains its AI-text classifier with a RoBERTa-based model [29].

The developers collected samples from the WebText dataset 2 and labeled them as human-generated. Then, for each target GPT-2 model, they collected the generated samples and labeled them as machine-generated. Finally, they fine-tuned the pretrained RoBERTa-based model [29] for AI-text classification. More recently, with the appearance of CharGPT, OpenAI tuned a GPT model called AI-Classifier 1 using data from several sources. The human-written text comes from three sources: a new Wikipedia dataset, the WebText dataset collected in 2019, and a set of human demonstrations collected as part of training InstructGPT [24]. To collect machine-generated text, for the Wikipedia and WebText datasets, they truncated the articles sampled from the original corpus and used 34 models to generate article completion, pairing each generated text with the original article. For the demonstrations, they used a model to generate responses for each prompt and paired them with the corresponding human demonstrations. This detector was only accessible via a web interface since its release in January 2023, and it has been taken down since July 2023. (iii) Watermark methods: post-hoc watermarking techniques, such as rule-based methods [1, 15, 31] and deep-learning-based methods [6, 32], can be applied to an LLM. At inference time, [16] proposed a soft watermarking scheme to embed a watermark in each word of the generated sentence by dividing the vocabulary into different lists and sampling the next token in a differentiated manner. However, many existing AI-text detectors are shown to be significantly weakened by paraphrasing in [27].

Adversarial Learning for Natural Language Generation. The success of GAN [10] in the computer vision domain has motivated many studies in natural language generation. However, since text generation is a sequential sampling process that occurs in a discrete vocabulary space, it is difficult to directly train a text generator using back-propagation in an end-to-end manner [36, 7, 5, 35]. There are two common approaches to tackle this problem. The first one is to replace the discrete sampling operation with continuous approximation techniques [35, 5], such as Gumbel-Softmax [14, 22]. The second one is to view text generation as a decision-making process and cast the generator as a policy [36, 34, 7, 33]. A typical example is SeqGAN [36]. During generation, SeqGAN considers the generated tokens as the state and the next token to be generated as the action, and it adopts Monte Carlo search to collect reward signals from the discriminator. Instead of using a classifier as the discriminator, the Diversity-Promoting GAN [34] uses a unidirectional LSTM as the discriminator and combines both word-level and sentence-level rewards into training. TextGAIL [33] proposed an imitation learning paradigm in which the rewards of the human-written text are regarded as a constant value. Then, both the rewards from human-text and AI-text are used to optimize the generator with PPO. These works all used warm-up training for the generator with maximum likelihood estimation (MLE) on the probability of the generated text sequence. On the other hand, [7] trained a language GAN from scratch. Our proposed RADAR differs from these works in that we focus on training a robust AI-text detector with a tunable paraphraser. Another line of work, such as [20, 4], uses paraphrasing techniques to find adversarial examples for natural language processing tasks and for training a robust language model via adversarial training. Their focus is on the correctness of natural language understanding, which is beyond our scope of AI-text detection.

3 RADAR: Methodology and Algorithms

We start this section by giving an overview and mathematical notations of our proposed RADAR framework in Figure 1. Then, in Sections 3.1 and 3.2, we provide the details on the design and training of the paraphraser and detector, respectively. Finally, we will summarise the entire training process into an algorithmic procedure in Section 3.3.

High-Level Methodology. Our RADAR framework consists of three neural-network-based language models (LMs): the target LM T θ , the detector D ϕ and the paraphraser G σ , parameterized with θ , ϕ and σ , respectively. We note that T θ is frozen (no updates on θ ) in the entire process. We summarize RADAR into three key steps:

Step 1 (Data preparation): Before training, we build M , the corpus of AI-text, by applying document completion based on the prefix span of text in the human-text corpus H using T θ .

Step 2 (Paraphraser update): We collect AI-text samples x m from M and use G ϕ to do paraphrasing on x m to generate paraphrased AI-text x p to form a corpus P . Then, we use the reward of x p returned by the detector D θ to update the paraphraser G ϕ using PPO.

Step 3 (Dectector update): We use the human-text samples x h from H , the original AI-text samples x m from M , and the paraphrased AI-text samples x p from P in step 2 to update the detector D θ with a logistic loss function.

Step 4 (Performance Validation and Evaluation): During training, we use the test set of WebText as the validation dataset to estimate RADAR's performance. For evaluation, we use T θ to generate AI-text for the evaluation dataset and to calculate RADAR's detection AUROC.

Step 2 to Step 3 can be repeated until there is no improvement in the AUROC evaluated on the validation dataset. The nature of rivalry in adversarial learning and the introduced competition helps the detector to learn to be robust in detecting both original and paraphrased AI-text.

3.1 Training Paraphraser via Clipped PPO with Entropy Penalty

In RADAR, the goal of the paraphraser G σ is to paraphrase the input machine-generated text x m . We model the generation of paraphrased text as a decision-making process, taking x m as the state and the output text x p as the action. In particular, we optimize G σ using the reward feedback from the detector D ϕ with PPO. The output of D ϕ ( x p ) is the predicted likelihood of x p being Human-text. The reward returned by x p and the log probability of the text x p are defined in Eq. 1:

where x i p means the i -th token in the sentence x p of length N and x 1: i -1 p represents the first i -1 tokens in x p ( x 1:0 p means the default starting token).

We propose Clipped PPO with Entropy Penalty ( cppo-ep ) in RADAR to optimize G σ . Let clip ( · , a, b ) denote a value-clipping operation with a lower limit a and an upper limit b , r ( σ, x m , x p ) be the importance sampling ratio between a new policy G σ and an old policy G σ ′ , and ( x m , x p ) ∼ P G σ ′ be a state-action pair sampled from G σ ′ . The loss of cppo-ep is defined as:

where E denotes expectation, ϵ is a parameter used in clipping to avoid the importance ratio r from being too large, A ( x p , ϕ ) is the advantage item of the paraphrased text x p obtained by applying normalization to R ( x p , ϕ ) across the entire PPO sample buffer B . S ( σ ) = E ( x m ,x p ) ∼ P G σ ′ -P G σ ( x p | x m ) log P G σ ( x p | x m ) , which is an entropy term introduced to encourage G σ to explore more diverse generation policy. γ is a coefficient to control the ratio between L A and L E , in order to make a balance between advantage ( L A ) and diversity ( L E ) when paraphrasing.

3.2 Training Detector via Reweighted Logistic Loss

In a typical GAN training process, the discriminator receives an equal amount of positive and negative samples in each step, assuring an in-batch sample balance. However, in RADAR, by construction, the number of AI-text samples is twice the number of human-text samples, because each x h from the human-text corpus H is paired with a sample x m from the original AI-text corpus M as well as a paraphrased sample x p generated by the paraphraser G ϕ . To handle this in-batch imbalance problem, we use a reweighted logistic loss function to optimize the detector D ϕ , as described in Eq. 3:

Recall that D ϕ ( x ) ∈ [0 , 1] is the predicted probability of an input instance x being Human-text. L H is the loss to improve the correctness of predicting x h ∼ H as human-written. L M = L 1 M + L 2 M , where L 1 M and L 2 M are used to avoid x m and x p from being predicted as human-text, respectively. λ is a coefficient ranging from 0 to 1. We introduce λ to adjust the proportion of AI-text components in the overall loss function to alleviate the effects of sample imbalance.

3.3 RADAR Algorithm

The entire training procedure of RADAR is summarized in Algorithm 1. For a given target LLM, RADAR returns a trained paraphraser and a trained detector through the designed training steps. In the evaluation phase, the detector is used to predict the likelihood of AI-text for any input instance.

Algorithm 1 RADAR: Robust AI-Text Detection via Adversarial Learning

1: Data initialization: 2: Collect human-written text to build human-text corpus H 3: Select a target language model T θ to perform document completion on H to build the corresponding AI-text corpus M 4: Build a replay buffer B to store samples temporarily collected for training 5: Build a validation dataset V from H and M 6: Model initialization: 7: Detector D ϕ ← ϕ pretrain (a pretrained language model) 8: Paraphraser G σ ← σ pretrain (a pretrained language model) 9: Model training: 10: for i = 1 : maximum step do 11: Sample x h and its corresponding x m from H and M respectively 12: Use G σ to paraphrase x m and generate x p 13: Collect reward R ( x p , ϕ ) as in Eq. 1 14: Normalize R ( x p , ϕ ) to compute the advantage function A ( x p , ϕ ) used in Eq. 2 15: Fill B with ( x h , x m , x p , A ( x p , ϕ )) 16: σ ′ ← σ # initialize the old policy σ ′ as the current policy σ 17: for ( x h , x m , x p , A ( x p , ϕ )) ∈ B do 18: Compute the log probability log P G σ ( x p | x m ) and log P G ′ σ ( x p | x m ) using Eq. 1 19: Update G σ using Eq. 2 20: end for 21: for ( x h , x m , x p , A ( x p , ϕ )) ∈ B do 22: Update D ϕ using Eq. 3 23: end for 24: Clear B 25: Evaluate AUROC of D ϕ on the validation dataset V 26: end for 27: Detector D ϕ ← ϕ best (the detector model with the best AUROC on the validation dataset) 28: Paraphraser G σ ← σ best (the paraphraser model which pairs with ϕ best ) 29: Return D ϕ and G σ

4 Experiments

4.1 Experimen Setup

Datasets and Metrics. For training, we sampled 160K documents from WebText [9] to build the human-text corpus H . Then, we build the original AI-text corpus M from H using a target language model T θ , which performs text completion using the first 30 tokens as the prompt and limits the sentence length to be 200 tokens. For evaluation, we select four human-text datasets covering different domains. Following [23], we use Xsum, SQuAD, and Reddit WritingPrompts (WP) to test a detector's ability to detect fake news, avoid academic fraud, and identify machine-generated literature innovation, respectively. In addition, we also use the non-native-authored TOEFL dataset (TOFEL) [21] to evaluate a detector's bias when encountering non-native-authored English text. Please see Appendix A for more details about the evaluation datasets. Following existing works, we report the area under the receiver operating characteristic curve (AUROC) score by varying the detector's threshold as the performance measure (higher is better), which captures the relationship between the true positive rate and the false positive rate.

Comparisons. We compare RADAR with various detection methods. These methods include the OpenAI (RoBERTa) model which is fine-tuned on WebText [9] and GPT-2 [2] generations, as well as the statistical approaches including log probability, rank, log rank, entropy, and DetectGPT [8, 19, 23].

Specifically, we implemented DetectGPT using the trained T5-large model as the mask-filling model and performed 10 perturbations for each sentence to be detected.

Large Language Models. For the target LLM T θ , we select 4 pairs of LLMs and summarize them in Table 1. Each pair contains an open-source LLM and its fine-tuned version via instruction-tuning.

Paraphrase Configurations. We consider two settings: without (w/o) paraphrasing and with paraphrasing . To prepare the machine-generated text for evaluation, for the w/o paraphrasing setting, we use the original AI-text corpus M generated by a target LLM based on an evaluation dataset. For the with paraphrasing setting, we define two types of paraphrasing: seen paraphraser and unseen paraphraser . The seen paraphraser refers to the paraphraser G σ returned by RADAR. The unseen paraphraser means a new paraphraser that has not participated in training the detector of RADAR. We used the OpenAI API service of GPT-3.5-Turbo as the default unseen paraphraser. The prompt we used for paraphrasing is 'Enhance word choices to make the sentence sound more like a human', as inspired by [21].

Implementation Details. We provide the detailed setups when implementing Algorithm 1. We build a PPO buffer B that can temporarily store 256 pairs of data for subsequent training. We use the pre-trained T5-large and RoBERTa-large models as the initialization of G σ and D ϕ respectively. During training, we set the batch size to 32 and train the models until the validation loss converges. We use AdamW as the optimizer with the initial learning rate set to 1e-5 and use linear decay for both G σ and D ϕ . We set λ = 0 . 5 for sample balancing in Eq. 3 and set γ = 0 . 01 in Eq. 2. We follow the same construction principle of the training dataset to create the 4 evaluation datasets based on Xsum, SQuAD, WP, and TOFEL. Experiments were run on 2 GPUS (NVIDIA Tesla V100 32GB).

4.2 Performance Evaluation and Comparison with Existing Methods

We run three groups of experiments (w/o paraphraser, seen paraphraser, and unseen paraphraser) and report the overall results of RADAR and the compared methods on all 4 datasets in Table 2. The reported AUROC scores are averaged over the 8 considered LLMs. In the relatively easy case of without paraphrasing, most detectors attain good AUROC scores. RADAR attains a comparable performance (0.856) to the best existing detector (log rank, 0.904). The slightly worse performance of RADAR can be explained by the tradeoff in enhancing AI-text detection against paraphrasing.

When facing paraphrasing, all existing methods except entropy show significant performance degradation. The drop in AUROC compared to the w/o paraphrasing case ranges from 10 . 4% to 81 . 7% . While entropy is shown to be more robust to paraphrasing, its AUROC score can be quite low. On the contrary, RADAR demonstrates robust and superior detection power, attaining the best performance on every dataset. As shown in Figure 2, the average AUROC score of RADAR (0.857) improves the best existing method (entropy, 0.651) by 31.64% against the unseen paraphraser. On average, RADAR is more robust to the seen paraphraser than the unseen paraphraser, because the seen paraphraser is what is used to train the detector in RADAR. More importantly, the detection performance of RADAR is stable across different paraphrasing schema, suggesting that RADAR can successfully mitigate the performance drop in AI-text detection.

Vicuna-7B

Dolly-V1-6B

Camel-5B

Dolly-V2-3B

LLaMA-7B

GPT-J-6B

Palmyra-base

Pythia-2.8B

Vicuna-7B

Dolly-V1-6B

Camel-5B

Dolly-V2-3B

LLaMA-7B

GPT-J-6B

Palmyra-base

Pythia-2.8B

1.000

1.025

0.959

1.033

0.950

0.935

0.897

0.942

0.907

1.000

0.960

0.946

0.949

0.897

0.891

0.921

0.826

0.845

1.000

0.835

0.662

0.626

0.633

0.624

0.754

0.893

0.831

1.000

0.884

0.887

0.883

0.912

0.682

0.712

0.599

0.852

1.000

0.903

0.940

0.998

0.567

0.780

0.570

0.923

0.972

1.000

0.988

1.043

0.584

0.807

0.632

0.952

0.962

0.987

1.000

1.051

0.588

0.741

0.601

0.868

0.920

0.918

0.950

1.000

0 1 2 3 4 5 6 7 8 9

7.742

7.471

6.051

7.045

6.687

6.843

6.975

6.587

(a) w/o paraphraser

Vicuna-7B

Dolly-V1-6B

Camel-5B

Dolly-V2-3B

LLaMA-7B

GPT-J-6B

Palmyra-base

Pythia-2.8B

Vicuna-7B

Dolly-V1-6B

Camel-5B

Dolly-V2-3B

LLaMA-7B

GPT-J-6B

Palmyra-base

Pythia-2.8B

1.000

0.949

0.883

0.926

1.170

1.114

1.006

0.983

1.001

1.000

0.941

0.983

1.228

1.179

1.064

1.046

1.082

1.039

1.000

1.067

1.317

1.243

1.102

1.083

0.934

0.955

0.869

1.000

1.188

1.171

1.057

1.039

0.715

0.666

0.620

0.749

1.000

0.917

0.893

0.876

0.714

0.721

0.610

0.803

1.012

1.000

0.951

0.938

0.758

0.766

0.658

0.864

1.063

1.051

1.000

0.982

0.853

0.833

0.737

0.895

1.125

1.083

1.018

1.000

0 1 2 3 4 5 6 7 8 9

8.032

8.442

8.933

8.212

6.435

6.750

7.141

7.543

(b) GPT-3.5-Turbo paraphraser

4.3 AI-Text Detection Transferability of RADAR

We explore the AI-text detection transferability of RADAR between the 8 LLMs and report the ratio F(A,B)=AUROC(A,B)/AUROC(B,B) for each LLM pair (A,B), where AUROC(A,B) means using the RADAR's detector trained on model A to evaluate the AI-text generated by model B. A larger ratio means better transferability from A to B. Figure 3 shows the matrix of pairwise detection transferability and the bar chart of the holistic detection transferability to all the 8 LLMs in the without and unseen paraphrasing settings. We highlight two key observations as follows.

(I) Instruction-tuned models have better detection transferability. Partitioning the LLMs into two groups, we can find that the detector targeting an instruction-tuned LLM (top 4 rows) generally transfers better than the detector targeting the corresponding LLM without instruction-tuning (bottom 4 rows). Take the pair (Vicuna-7B, LLaMA-7B) as an example, we can see that without paraphrasing, F(Vicuna-7B,LLaMA) can reach up to 95 . 0% . On the other hand, F(LLaMA-7B,Vicuna-7B) can only

account for 68 . 2% . Sorting the detectors according to the holistic detection transferalbility (which is presented in the bar chart), we can see the top-3 detectors are all trained with the instruction-tuned LLMs. A similar conclusion can be made for the with paraphrasing setting. Moreover, there is no obvious trend between the target LLM size and the resulting detection performance. The effect of instruction tuning on transferability is more prominent than model size.

(II) RADAR achieves better detection transferability against paraphrasing. Another interesting finding is that RADAR's transferability is generally improved when paraphrasing is in place. Comparing the two bar charts in Fig. 3a and Fig. 3b, the average holistic detection transferability (over all LLMs) is increased by 11 . 6% . Except for LLaMA-7B (3.8% drop) and GPT-J-6B (1.4% drop), all other LLMs' holistic transferability scores are improved from 2.4% (Palmyra-base) to 47.6% (Camel-5B).

Transfer detection on AI-text generated by GPT-4. We also test RADAR detectors on the texts generated by GPT-4. The results show that 5 out of 8 RADAR models can outperform the OpenAI (RoBERTa), and three of them can achieve more than 0.8 detection AUROC. For example, RADAR trained on Camel-5B can achieve 0.915 detection AUROC on GPT-4 generations. The results show that the RADAR can achieve good transfer detection for GPT-4. The details are given in Appendix K.

Ensemble detection. We also explored whether and how ensemble learning benefits detection by combining the outputs of detectors. The results show that the detection performance can be lifted by carefully tuning the ensemble ratio and the model to be combined. Please see Appendix G for the exact experiment results.

To sum up, we believe our findings suggest promising results for training a universal robust AI-text detector by leveraging state-of-the-art LLMs, and RADAR can use a smaller-sized and weaker LLM to achieve good detection performance on texts generated from top-notching LLMs (such as GPT-4).

4.4 Variants of Paraphrasing

In addition to paraphrasing the original LLM-generated texts, we also evaluate the detection performance when paraphrasing human texts (the output is labeled as AI-text). We also allow paraphrasing multiple times in our analysis. We conduct our experiments on the Xsum dataset using the detector trained with Camel-5B. The paraphraser for evaluation is GPT-3.5-Turbo. As shown in Figure 4a, we find that RADAR is the only detector robust to multi-round paraphrasing. On paraphrased AI-text, all existing methods suffer from a notable performance drop. On paraphrased human-text, RADAR remains effective, along with two existing methods (OpenAI (RoBERTa) and entropy). In general, multi-round paraphrasing does not seem to increase the difficulty of AI-text detection. We also find RADAR is robust to Dipper [18], another paraphrase model. Please see Appendix I for details.

←logp

rank

logrank

entropy

米

+RADAR

0.9

Detection AUROC

0.8

0.7

0.6

54

0.3

0.2

0.1

0

Z

3

Paraphrase Times

(a) Paraphrased AI-text

logp

rank

logrank

Xentropy

米

+RADAR

0.9

Detection AUROC

0.8

0.7

0.6

0.5

0.3

0.2

0.1

0

2

E

Paraphrase Times

(b) Paraphrased human-text

4.5 Evaluation on RADAR's Paraphraser

Although our focus is on training a robust AI-text detector via RADAR, as a by-product, we expect to obtain a better paraphraser through adversarial learning. To verify this hypothesis, we compare the quality of the initial paraphraser (a pretrained LLM) and the final paraphraser returned by RADAR

using GPT-3.5-Turbo's response. We select 100 documents from WebText [9] and use 4 different paraphrasers from RADAR to paraphrase the documents. Then, we ask GPT-3.5-Turbo to rate sentences generated by these paraphrasers versus their initial version (T5-large). Figure 5a shows that RADAR also improves the quality of paraphrasing. Figure 5b shows that the RADAR's paraphraser can score higher if it is trained with a larger target LLM with instruction tuning. Following [11, 12], we also evaluate RADAR's paraphrasers on Quora Question Pairs (QQP 8 ) and use iBLEU ( α = 0 . 8 ) [30] as the metric (higher is better). Figure 5c shows that the paraphrasing performance can be improved via RADAR as all the RADAR-paraphrasers can achieve a larger iBLEU score than T5-large.

√

(a) GPT-3.5 assessment

(b) GPT-3.5 score

(c) iBLEU on QQP

360

1.6

1.48

1.44

Paraphraser's Target Model

Vicuna-7B

57

16

27

GPT-3.5-Turbo Score

350

349

1.4

1.23

1.28

340

1.2

332

333

Dolly-V1-6B

43

27

30

330

3

321

iBLE

0.8

320

313

0.6

Camel-5B

42

29

29

310

0.4

0.42

300

0.2

Dolly-V2-3B

32

34

34

290

0

T5-large

Dolly-v2-3B

Camel-5B

Dolly-V1-6B

Vicuna-7B

T5-large

Dolly-v2-3B

Camel-5B

Dolly-V1-6B

Vicuna-7B

win  tie  lose

Paraphraser's Target Model

Paraphraser's Target Model

4.6 Balancing the Detection Performance in the with and without Paraphrasing Settings

From Figure 2, we can observe that though RADAR can achieve robust detection under paraphrasing, it is (slightly) worse than some of the existing baselines when AI-text data are unperturbed (i.e., w/o paraphrasing). We run a trade-off analysis on the weight coefficient λ in Equation (3) to study whether RADAR can be further tuned to achieve competitive performance on unperturbed data while still being robust to paraphrasing. We use Vicuna-7B as the target model to train 10 RADAR detectors by varying λ from 0.1 to 1.0 with 0.1 increment, and then evaluate these detectors as well as other detection baselines on the evaluation datasets. The results in Appendix J show that we can promote RADAR's performance on unperturbed data while still preserving high detection AUROC on paraphrased data. Take λ = 0 . 6 as an example. When we change λ from 0 . 5 (the default value of λ ) to 0 . 6 , the AUROC of w/o paraphrasing increases from 0 . 906 to 0 . 937 , while the AUROC of unseenparaphrasing also increases from 0 . 892 to 0 . 920 . The result suggests that the detection performance of RADAR in the with and without paraphrasing settings can be simultaneously improved or better balanced with careful tuning of the hyperparameter λ during training.

5 Conclusion

In this paper, we presented a robust AI-text detector training framework called RADAR, which adopts adversarial learning to jointly train a detector and a paraphraser. RADAR addresses the shortcoming of existing detectors when facing LLM-paraphrased texts. Our extensive experiments on 8 LLMs and 4 datasets validated the effectiveness of RADAR and demonstrated its strong transferability across LLMs. We believe our results shed new light on improving AI-text detection.

6 Limitations and Ethical Considerations

While RADAR is more robust to paraphrasing than existing baselines measured on 4 datasets, sometimes it may show degraded detection performance against native LLM-generated texts (without paraphrasing) when compared to the best existing detection method. Moreover, like every existing AI-text detector, we acknowledge that our detector is not perfect and will likely give incorrect predictions in some cases. In terms of ethical considerations, we suggest users use our tool to assist with identifying AI-written content at scale and with discretion. If the detection result is to be used as evidence, further validation steps are necessary as RADAR cannot always make correct predictions.

References

Jack Brassil, Steven H. Low, Nicholas F. Maxemchuk, and Lawrence O'Gorman. Electronic marking and identification techniques to discourage document copying. IEEE J. Sel. Areas Commun. , 13(8):1495-1504, 1995.

Tom B. Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, Sandhini Agarwal, Ariel Herbert-Voss, Gretchen Krueger, Tom Henighan, Rewon Child, Aditya Ramesh, Daniel M. Ziegler, Jeffrey Wu, Clemens Winter, Christopher Hesse, Mark Chen, Eric Sigler, Mateusz Litwin, Scott Gray, Benjamin Chess, Jack Clark, Christopher Berner, Sam McCandlish, Alec Radford, Ilya Sutskever, and Dario Amodei. Language models are few-shot learners. In NeurIPS , 2020.

Souradip Chakraborty, Amrit Singh Bedi, Sicheng Zhu, Bang An, Dinesh Manocha, and Furong Huang. On the possibilities of ai-generated text detection. CoRR , abs/2304.04736, 2023.

Minhao Cheng, Jinfeng Yi, Pin-Yu Chen, Huan Zhang, and Cho-Jui Hsieh. Seq2sick: Evaluating the robustness of sequence-to-sequence models with adversarial examples. In Proceedings of the AAAI conference on artificial intelligence , volume 34, pages 3601-3608, 2020.

Pedro Colon-Hernandez, Henry Lieberman, Yida Xin, Claire Yin, Cynthia Breazeal, and Peter Chin. Adversarial transformer language models for contextual commonsense inference. CoRR , abs/2302.05406, 2023.

Long Dai, Jiarong Mao, Xuefeng Fan, and Xiaoyi Zhou. Deephider: A multi-module and invisibility watermarking scheme for language model. CoRR , abs/2208.04676, 2022.

Cyprien de Masson d'Autume, Shakir Mohamed, Mihaela Rosca, and Jack W. Rae. Training language gans from scratch. In NeurIPS , pages 4302-4313, 2019.

Sebastian Gehrmann, Hendrik Strobelt, and Alexander M. Rush. GLTR: statistical detection and visualization of generated text. In ACL , pages 111-116, 2019.

Aaron Gokaslan, Vanya Cohen, Ellie Pavlick, and Stefanie Tellex. Openwebtext corpus. http://Skylion007.github.io/OpenWebTextCorpus , 2019.

Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial networks. Communications of the ACM , 63(11):139-144, 2020.

Tom Hosking and Mirella Lapata. Factorising meaning and form for intent-preserving paraphrasing. In ACL/IJCNLP , pages 1405-1418, 2021.

Tom Hosking, Hao Tang, and Mirella Lapata. Hierarchical sketch induction for paraphrase generation. In ACL , pages 2489-2501, 2022.

Daphne Ippolito, Daniel Duckworth, Chris Callison-Burch, and Douglas Eck. Automatic detection of generated text is easiest when humans are fooled. In ACL , pages 1808-1822, 2020.

Eric Jang, Shixiang Gu, and Ben Poole. Categorical reparameterization with gumbel-softmax. In ICLR , 2017.

Mohan S. Kankanhalli and K. F. Hau. Watermarking of electronic text documents. Electron. Commer. Res. , 2(1-2):169-187, 2002.

John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. A watermark for large language models. CoRR , abs/2301.10226, 2023.

Kalpesh Krishna, Yixiao Song, Marzena Karpinska, John Wieting, and Mohit Iyyer. Paraphrasing evades detectors of ai-generated text, but retrieval is an effective defense. CoRR , abs/2303.13408, 2023.

Kalpesh Krishna, Yixiao Song, Marzena Karpinska, John Wieting, and Mohit Iyyer. Paraphrasing evades detectors of ai-generated text, but retrieval is an effective defense. CoRR , abs/2303.13408, 2023.

Thomas Lavergne, Tanguy Urvoy, and François Yvon. Detecting fake content with relative entropy scoring. In Proceedings of the ECAI'08 Workshop on Uncovering Plagiarism, Authorship and Social Software Misuse, Patras, Greece, July 22, 2008 , volume 377 of CEUR Workshop Proceedings , 2008.

Qi Lei, Lingfei Wu, Pin-Yu Chen, Alex Dimakis, Inderjit S Dhillon, and Michael J Witbrock. Discrete adversarial attacks and submodular optimization with applications to text classification. Proceedings of Machine Learning and Systems , 1:146-165, 2019.

Weixin Liang, Mert Yüksekgönül, Yining Mao, Eric Wu, and James Zou. GPT detectors are biased against non-native english writers. CoRR , abs/2304.02819, 2023.

Chris J. Maddison, Andriy Mnih, and Yee Whye Teh. The concrete distribution: A continuous relaxation of discrete random variables. In ICLR , 2017.

Eric Mitchell, Yoonho Lee, Alexander Khazatsky, Christopher D. Manning, and Chelsea Finn. Detectgpt: Zero-shot machine-generated text detection using probability curvature. CoRR , abs/2301.11305, 2023.

Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll L. Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, John Schulman, Jacob Hilton, Fraser Kelton, Luke Miller, Maddie Simens, Amanda Askell, Peter Welinder, Paul F. Christiano, Jan Leike, and Ryan Lowe. Training language models to follow instructions with human feedback. In NeurIPS , 2022.

Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, and Peter J. Liu. Exploring the limits of transfer learning with a unified text-to-text transformer. JMLR , 2020.

Juan Rodriguez, Todd Hay, David Gros, Zain Shamsi, and Ravi Srinivasan. Cross-domain detection of gpt-2-generated technical text. In NAACL , pages 1213-1233, 2022.

Vinu Sankar Sadasivan, Aounon Kumar, Sriram Balasubramanian, Wenxiao Wang, and Soheil Feizi. Can ai-generated text be reliably detected? CoRR , abs/2303.11156, 2023.

John Schulman, Filip Wolski, Prafulla Dhariwal, Alec Radford, and Oleg Klimov. Proximal policy optimization algorithms. CoRR , abs/1707.06347, 2017.

Irene Solaiman, Miles Brundage, Jack Clark, Amanda Askell, Ariel Herbert-Voss, Jeff Wu, Alec Radford, Gretchen Krueger, Jong Wook Kim, Sarah Kreps, et al. Release strategies and the social impacts of language models. arXiv preprint arXiv:1908.09203 , 2019.

Hong Sun and Ming Zhou. Joint learning of a dual SMT system for paraphrase generation. In ACL , pages 38-42, 2012.

Umut Topkara, Mercan Topkara, and Mikhail J. Atallah. The hiding virtues of ambiguity: quantifiably resilient watermarking of natural language text through synonym substitutions. In MM&Sec , pages 164-174, 2006.

Honai Ueoka, Yugo Murawaki, and Sadao Kurohashi. Frustratingly easy edit-based linguistic steganography with a masked language model. In NAACL , pages 5486-5492, 2021.

Qingyang Wu, Lei Li, and Zhou Yu. Textgail: Generative adversarial imitation learning for text generation. In AAAI , pages 14067-14075, 2021.

Jingjing Xu, Xuancheng Ren, Junyang Lin, and Xu Sun. Diversity-promoting GAN: A crossentropy based generative adversarial network for diversified text generation. In EMNLP , pages 3940-3949, 2018.

Zichao Yang, Zhiting Hu, Chris Dyer, Eric P. Xing, and Taylor Berg-Kirkpatrick. Unsupervised text style transfer using language models as discriminators. In NeurIPS , pages 7298-7309, 2018.

Lantao Yu, Weinan Zhang, Jun Wang, and Yong Yu. Seqgan: Sequence generative adversarial nets with policy gradient. In AAAI , pages 2852-2858, 2017.

Rowan Zellers, Ari Holtzman, Hannah Rashkin, Yonatan Bisk, Ali Farhadi, Franziska Roesner, and Yejin Choi. Defending against neural fake news. In NeurIPS , pages 9051-9062, 2019.

Appendix

A Human-text Corpora

We summarize the human-text corpora we used in RADAR's training, validation, and evaluation phases in Table A1. It shows the usage of these corpora, the source where they come from, and the number of samples we select from them for evaluation.

B Details of Existing Detectors

Every detector assigns a score to the given text and determines whether the text is generated by AI based on the score. We introduce the scores used in existing detectors in the following.

Unsupervised Methods. In this paper, we leverage log-p, rank, log-rank, and entropy as the baselines. They are all unsupervised methods. They depend on statistical metrics of the given text to determine if it is an AI-text. Specifically, they input the given text to the target language model T θ , and sniff statistics from T θ 's output. We use M log-p , M rank , M log-rank, and M entropy to represent the score for them respectively. These scores are calculated as below:

where N is the length of the input sentence x , C is the size of the vocabulary, x i means the i -th token in x and x 1: i -1 represents the first i -1 tokens in x , sort( a ) is a sorting operation which inputs a list a and returns a new list in descending order, index( a , b ) is a indexing operation which inputs a list a with an element b and outputs the position of b in a .

DetectGPT is also an unsupervised detection method we compare with in this paper. It introduces another language model (denoted as G σ ), which is used to do perturbations on the given text. DetectGPT uses the perturbation discrepancy as the score assigned to the text (denoted as M DetectGPT), which is shown below:

where ˜ u = 1 k ∑ k i =1 log P T θ (˜ x i ) , ˜ σ 2 x = 1 k -1 ∑ k i =1 (log P T θ (˜ x i ) -˜ u ) 2 , ˜ x i ∼ P G σ ( ·| x i ) , and k is the number of perturbations applied on each text.

Supervised Methods. RADAR, as well as OpenAI (RoBERTa), are both supervised detection methods. Let D denote the OpenAI (RoBERTa) or RADAR's detector. The score M D that they assigned to the input text x is defined below:

where f D ( x ) means D 's [CLS] token's logits over the whole label set. Softmax ( f D ( x ))[0] means the prediction probability of AI-text, and Softmax ( f D ( x ))[1] means the prediction probability of human-text. Since there are only two labels (AI-text vs human-text) in the label set, the detection is equivalent to a logistic regression task with a scalar output.

C RADAR Loss Visualization

We visualize RADAR's training process by presenting the training loss and validation performance below. We take the Camel-5B language model as an example.

(a) Detector Loss

(b) Paraphraser Loss

(c) Validation Detection AUROC

1.6

1.0

1.4

1.2

1.0

Validation Detection AUROC

0.9

Detector Loss

1.0

Paraphraser Loss

0.8

0.8

0.5

0.7

0.6

>

0.4

0.0

0.6

0.2

0.5

0.5

0.0

0

200

400

Training Steps

600

800

1000

0

200

400

Training Steps

600

800

1000

0

20

40

Buffer Epochs

60

80

100

From Figure A1a and Figure A1b we can see that the loss for both the Detector and the Paraphraser converge. From Figure A1c we can conclude that RADAR's detection capacity on the validation dataset is promoted to a stable state as the training loss of the detector and the paraphraser converge.

D Paraphrase Settings

When using a RADAR-seen paraphraser, the input is: Paraphrase: [s] , Where [s] is the slot for the input AI-text. The paraphraser adopts top-k sampling and nucleus sampling strategy to decode a new word. Top-k sampling only focuses on the k highest-probability tokens. Nucleus sampling sorts the sampling distribution in descending order and selects top-n tokens from the sorted distribution until their cumulative probability exceeds p , and then samples the next token from the top-n candidates. In our experiment, we set k to 50 and p to 0.95.

When using GPT-3.5-Turbo's API service as another paraphrasing tool (RADAR-Unseen paraphraser) to paraphrase the AI-texts, the instruction we input is Enhance the word choices in the sentence to sound more like that of a human . When paraphrasing the human-texts, the instruction is Worsen the word choices in the sentence to sound less like that of a human .

Multi-round paraphrasing can be easily achieved by using the paraphrased text as input text and using the paraphraser to re-paraphrase it.

E Complete Experimental Results

We show all the evaluation results in Table A2 (without paraphraser), Table A3 (with RADAR-Unseen paraphraser) and Table A4 (with RADAR-Seen paraphraser).

F Case Study for RADAR

Sample Selection . For each evaluation dataset (Xsum, SQuAD, WP, and TOFEL), we randomly select one sample from the human-text corpora and use 8 instruction-tuned LLMs (Vicuna-7B,

Dolly-V1-6B, Camel-5B, Dolly-V2-3B, LLaMA-7B, GPT-J-6B, Palmyra-base, Pythia-2.8B) to generate completions for each text, then use GPT-3.5-Turbo API service to perform paraphrase to all completions. Thus, we get 64 AI-texts in total (32 completions, 32 paraphrases).

Case Selection . Each AI-text has a source model, for the detection of one given text, we use the RADAR-detector trained for its source model. Then, we collect the one with the largest confidence to be machine-generated (most likely to be correctly detected) and the one with the smallest confidence to be machine-generated (mostly likely to evade detection) for the following case study.

Analysis . We show two detection cases in Table A5. One with a higher probability (0.9999) is an easy-to-detect case, and another with a lower probability (0.0031) is a difficult-to-detect case. Specifically, the latter can only be detected when our detection threshold drops below 0.0031. From the table, we can see that the misclassification has a good explanation, because the AI-text is nearly identical to the original Human-text, except for the inclusion of several additional words. In fact, the AI-text can be seen as the Human-text with a suffix composed of several words appended to it.

G Effectiveness of Ensembling Detectors from RADAR

We study the ensembling detection performance by combining two RADAR-detectors' prediction probability and report the detection AUROC calculated using the combined prediction probability. The combined prediction probability E ( A,B,β,x ) = (1 -β ) D A ϕ ( x ) + β D B ϕ ( x ) is a weighted sum of the prediction probability of the base model A and the augmented model B . The detection performances are shown in Table A6. We explore various ensembling ratios and ensembling models. Ensembling with the base model itself and setting the ensembling ratio to 0 both mean no ensembling. Setting the ensembling ratio to 1 is another extreme case, which refers to the transfer detection scheme mentioned in Section 4.3. From the results, we can see that the ensembling detection's effectiveness can be influenced by both the ensemble model and the ensemble ratio.

0.9

0.9

0.8

0.8

AUROC

0.7

AUROC

0.7

0.6

0.6

Detection

0.5

Detection

0.5

0.4

0.4

0.3

0.3

0.2

0.2

0.1

0.1

0

0

20%

40%

60%

80%

100%

20%

40%

60%

80%

100%

Text LengthRelativePosition

TextLengthRelativePosition

(a) w/o paraphraser

(b) RADAR-Unseen paraphraser

H Text Detection Towards Different Lengths

We study RADAR's effects on AI-generated texts with different lengths. We grouped the evaluation dataset into 5 subsets according to the length of the AI-text. The results are shown in Figure A2. We summarize our observations below:

For the group {log probability, rank, log rank, DetectGPT}, without paraphrasing, these methods are not really sensitive to the length of the text. When facing paraphrasing, however, their performance increases with a longer text length.

For the group {entropy, OpenAI (RoBERTa), RADAR}, without paraphrasing, these methods have a better detection performance for longer texts. On the contrary, their performance degrades when facing longer paraphrased AI-text (even though RADAR seems much better for short-text detection, it still outperforms other methods by a large margin, see Figure A2b).

I Detection on Dipper Paraphrasing

We also explore the use of RADAR to detect other advanced paraphrasers. We use Dipper proposed in [18] (L60-O60 version) to paraphrase the evaluation dataset following the same setup of RADARUnseen paraphrasing and RADAR-Seen paraphrasing. The results are shown in Figure A3. We can see from the results that the green bars are much higher than the red bars except for DetectGPT, which means in general, Dipper is less destructive than GPT-3.5-Turbo to these detectors. RADAR's detection AUROC on Dipper reaches 0 . 9 . One thing to be noted is that though the OpenAI (RoBERTa) can perform well under Dipper paraphrasing, it still cannot be regarded as robust because it can be bypassed by other paraphrasers (RADAR-Seen and RADAR-Unseen).

1

0.9

0.8

0.7

DetectionAUROC

0.6

0.5

0.966

0.4

0.887

0.904

0.867

0.900

0.856

0.755

0.705

0.3

0.2

0.422

0.571

0.461

0.553

0.426

0.572

0.472

0.651

0.434

0.402

0.627

0.1

0

log p

rank

log rank

entropy

OpenAl (RoBERTa)

RADAR

DetectionMethod

J Sensitivity Analysis of RADAR on the Hyperparameter λ

Please refer to our discussion in Section 4.6.

入=0.8

入=0.4

入=0.6

入=0.5

GPT-3.5-Turbo Paraphrase Detection AUROC

0.9

G

入=0.1

入=0.9

入=1.0

入=0.7

0.8

入=0.2

入=0.3

0.7

log p

0.6

OpenAl (RobBERTa)

0.5

rank

log rank

0.4

0.65

0.7

0.75

0.8

0.85

0.9

0.95

W/O Paraphrase Detection AUROC

?

K Detection on GPT-4 Generated Texts

Figure A5 shows RADAR's transfer detection for GPT-4. We use RADAR detectors trained on weaker LLMs (Vicuna-7B, Camel-5B, etc.) to detect the generation of GPT-4. We prompted GPT-4 with the instruction: You are a helpful assistant to complete given text: , to generate texts based on the same evaluation datasets (Xsum, SQuAD, WP and TOFEL) used when evaluating other LLMs. The detection performance have been discussed in Section 4.3.

RADAR

OpenAl (RoBERTa)

0.9

0.8

0.7

0.6

0.5

0.915

0.4

0.828

0.813

0.348

0.3

0.653

0.2

0.384

0.325

0.291

0.3

0.1

vicuna_7b

Ilama_7b

dolly_v1_6b

gpt_j_6b

camel_5b

palmyra_base

dolly_v2_3b

Pythia_2.8b

RADAR Source Model

L Use GPT-3.5 to Assess RADAR-paraphrasers

After RADAR training, we not only get a detector but also a paraphraser. We use GPT-3.5-Turbo to assign a score to these paraphrasers' generation to assess the language generation capability of these paraphrasers and compare with their initial version (T5-large) to see how adversarial training benefits them. We compare these paraphrasers on a WebText subset with 100 samples. For each sentence in this subset, we first use GPT-2-XL to generate one sentence, and then use the 5 paraphrasers (T5-large and 4 paraphrasers trained on 4 instruction-tuned models' generation) to paraphrase this sentence respectively. Then we input these 5 paraphrased sentences combining an instruction to GPT-3.5-Turbo. Our instruction is You are given an array of five sentences. Please rate these sentences and reply with an array of scores assigned to these sentences. Each score is on a scale from 1 to 10, the higher the score, the sentence is written more like a human. Your reply example: [2,2,2,2,2] . Then we sniff the score for each sentence from the returned answer and make the comparison. The results have been discussed in Section 4.5.

Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper proposes a framework called RADAR for training a robust AI-text detector using adversarial learning. The framework consists of a paraphraser and a detector, both based on large language models (LLMs). The paraphraser aims to generate realistic contents to evade AI-text detection, while the detector aims to enhance AI-text detectability. The two players iteratively update their model parameters until their respective validation loss becomes stable. Experimental results show that RADAR outperforms existing AI-text detection methods, especially when paraphrasing is involved. The paper also highlights the transferability of RADAR's detection capability to other LLMs.\n\nSTRENGTHS:\n+ The paper brings back the success of adversarial learning. The idea of employing an adversarial AI text paraphraser is simple but reasonable.\n+ The experiments conducted on 8 different LLMs and 4 datasets demonstrate the effectiveness of RADAR in achieving consistently high detection performance. \n+ The proposed method is not only effective with the seen paraphraser but also generalizable across different unseen paraphrser.\n\nWEAKNESSES:\n+ The generation quality after post-processed by the AI paraphraser is my major concern. Since the paraphrase model is inferior (T5 in your case) to the generation model, I suspect that the machine-generated text degrades in quality after paraphrasing. Meanwhile, we do not know whether the paraphrased text keeps its semantics unchanged. Therefore, I suggest the authors add an experiment comparing the text before and after being paraphrased. \n+ The parameter scale of studied language models in the experiment is at most 7b.  I am curious to see the performance on larger models like GPT3.5 or GPT4. I understand that the cost of open AI API is one of the barriers to conducting such experiments. If this is the case, you may perform experiments on a sampled subset from the datasets to save the budget.\n+ In line 268 you claim that all existing methods suffer from a notable performance drop on paraphrased AI text. However, from Figure 4(a) and Figure 2, we could observe that the entropy method actually becomes better.\n\nQUESTIONS:\n+ Have you ever tried the paraphraser trained by [1]?  I want to see whether your proposed RADAR could be spoofed by this paraphraser.\n\n\n\n[1]Paraphrasing evades detectors of AI-generated text, but retrieval is an effective defense\n\nLIMITATIONS:\nThe limitations are adequately discussed.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 4, "DATE": "2023-06-30"}

comments: SUMMARY:
The paper introduces a new framework called RADAR, which aims to address the gap in existing AI-text detection methods. RADAR utilizes adversarial learning to jointly train a robust AI-text detector. The framework consists of a paraphraser and a detector, both trained through adversarial training. The paraphraser's objective is to generate realistic content that can evade AI-text detection. RADAR continuously updates the paraphraser and the detector based on the feedback received from each other. The framework is evaluated using eight different language models (Pythia, Dolly 2.0, Palmyra, Camel, GPT-J, Dolly 1.0, LLaMA, and Vicuna) across four datasets. The experimental results demonstrate that RADAR outperforms existing AI-text detection methods, particularly when paraphrasing techniques are employed.

STRENGTHS:
1. The detection of ChatGPT generated texts is an interesting and important research problem.

2. The proposed method is reasonable.

3. Experimental results seem promising.

WEAKNESSES:
1. It is not clear whether the proposed method can achieve good result if the LLM for text generation (usually black-box) is much power than the paraphraser used in the proposed method (open-sourced).

2. The proposed method is not tested on the texts generated by powerful LLMs like GPT-4.

3. The experimental settings are a little confusing.

QUESTIONS:
1. The experimental settings are a little confusing. What are the training data? Why is the test data constructed in such a naive way as "for the w/o paraphrasing setting, we use the original AI-text corpus M generated by a target LLM". Why not construct some domain and task-specific AI texts?

2. Why not do experiments on SOTA LLMs like GPT-4 and ChatGPT?

LIMITATIONS:
The authors have addressed the limitations.
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 3
DATE: 2023-07-04

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes an adversarial learning framework, called RADAR,\nfor improving the robustness of AI-text detector.  Given a target\nlarge language model (LLM) that generates AI-text, the framework\ntrains a detector model and a paraphraser model both are also based on\nan LLM simultaneously.  The performance of RADAR on AI-text detection\nis evaluated through eight LLMs and four datasets.  The results show\nthat RADAR can achieve the best classification accuracy measured by\nAUROC, when paraphraser is introduced to illude classification.  The\nauthors further clarified the relatively high versatility of detectors\ntrained through RADAR, especially when using LLMs fine-tuned through\ninstruction tuning.\n\nSTRENGTHS:\n- The paper presents a straightforward but effective way of training a\n  robust AI-text detector, which is backed up by the empirical\n  experiments.\n\n- The authors also demonstrate that the detector trained by the\n  proposed method can perform well also for AI-texts generated by\n  another LLM, measuring the \"transferability\" across eight publicly\n  available LLM, revealing an advantage of instruction tuning for LLM.\n\nWEAKNESSES:\n- One critical point is in line 11 of Algorithm 1: $x_{h}$ and $x_{m}$\n  are sampled from $\\mathcal{H}$ and $\\mathcal{M}$ respectively, which\n  means that there are arbitrary pairs of $(x_{h}, x_{m})$ drawn from\n  $\\mathcal{H}\\times\\mathcal{M}$.  I suspect this could be wrong and\n  $x_{h}$ and $x_{m}$ must be corresponding, since $x_{p}$ is\n  generated from $x_{m}$ in l.12 and the tuple of $x_{h}$, $x_{m}$,\n  and $x_{p}$ is saved together in the batch in l.15, enabling an\n  indirect contrastive learning.\n\n- ll.165-166: What is the purpose of the normalization function $A$\n  and how is it actually implemented?  $R(x_{p},\\phi)$ is already\n  between 0 and 1 according to Equation 1.\n\n- It is nice to evaluate paraphrasers in Section 4.5, but what is the\n  justification to choose this method?  Paraphrase generation methods\n  are in general evaluated on paraphrase generation tasks, such as\n  Quora.  Human evaluation is a possible alternative.  On the other\n  hand, the process of using GPT-3.5 Turbo for rating is not clearly\n  explained, and anyways it will not draw reliable results and\n  consequent conclusions.\n\nQUESTIONS:\n- The numbers in Figures 2, 3, 4, and 5 are too small to read on US\n  letter papers.\n\n- Bars in Figure 2 should also have error bars, because the bars\n  except for RADAR are the average of the AUROC for the four test\n  sets.  The results for RADAR are also averaging eight LLMs (or 64\n  combinations of training/testing LLMs) and four task results.\n  The authors have some space to also show the worst and best models.\n\n- The rows should be grouped by \"Evaluation Schema\" and the first two\n  columns should be swapped.  This makes direct comparisons of\n  different methods easier, also avoiding the colors for the schema,\n  which are difficult to distinguish by people with achromatic vision.\n\n- Coloring scheme for the two heat-maps in Figure 3 should be shared,\n  in order to avoid misunderstanding based on the colors only.  Text\n  color for dark cell should also be reconsidered.\n\n- The paper has some language problems, such as present tense in\n  Section 4, \"pair\" -> \"paired\" in l.101, and \"did not participate\" ->\n  \"has not participated\" in l.211.\n\nLIMITATIONS:\nAlthough the authors indicated Section 4.2, the limitations of this\nwork is rather discussed in Section 4.3 through a discussion on\ntransferability.  The high values for transferability suggest the\nproposed method and resulting AI-text detectors are versatile.\nHowever, it does not necessarily stop a kind of arms race between LLM\nand detector, as evidenced in Figure 3: detectors trained on weaker\nLLMs perform much worse for test data generated by stronger LLM.\n\nThere is no discussion on the potential societal impact, but according\nto the above note on the arms race, the results of AI-text detector at\nsome point would mislead users, potentially causing severe issues.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-06"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes RADAR, a detection method for AI-generated text that is based on adversarial learning. Inspired by the conceptual idea of generative adversarial networks, RADAR consists of a paraphraser and a detector module. The former aims to generate textual content that evades an AI content detection system, while the latter aims to detect AI-generated text. Both modules are based on LLMs and trained end-to-end. Once trained, only the detector is then used for evaluation. \nThe authors conduct experiments with 8 LLMs (incl. Pythia-2.8B, GPT-J-6B, LLaMA-7B) across 4 datasets (Xsum, SQuAD, Reddit WritingPrompts, TOEFL-dataset). RADAR is compared against a range of detection baselines in multiple settings (with and without paraphrasing of test set texts). Experimental results demonstrate that RADAR attains a slightly lower performance on tasks without paraphrasing as compared to baselines, but outperforms all existing works when the texts are paraphrased. The authors provide more extensive results on evaluating RADAR detection performance across all possible pairings of the 8 LLMs when one of the models is used for paraphrasing during training and the other one during testing. Interestingly, the paper also shows that RADAR is robust against paraphrasing a sequence multiple times (in contrast to the baselines).\n\nSTRENGTHS:\n* The paper is very well-written, and the technical aspects are well-explained. The analysis of RADAR is thorough, and the experimental results are mostly promising.\n* The proposed algorithm is novel and the idea of adversarial learning in the context of AI-generated text is interesting.\n* Overall, I think that this method and work represent a solid contribution to the field.\n\nWEAKNESSES:\n* In terms of model performance, RADAR shows to be outperformed by existing baselines on original (i.e., unperturbed) data to a notable extent. While this is not necessarily problematic, it might be good to show some additional analyses further investigating how this tradeoff can be mitigated. For example, how does adjusting the weight coefficients in Equation 3 impact the detection results? Is there a way to better optimize these parameters, to ensure that model accuracy on unperturbed data remains competitive with baselines?\n* Missing discussion and limitations: The paper does not list any possible limitations, nor does it have a discussion section to contextualize the findings better into the existing literature. Since detecting AI-generated text has a direct application in more practical settings, it would have been helpful to address how well RADAR can be employed by users and practitioners, and which challenges remain. Moreover, the authors do not discuss potential ethical considerations arising from their work.\n\nQUESTIONS:\n* Can you elaborate on the dataset sizes and splits that you used to evaluate RADAR? This is a technical detail, but it would be helpful to get an estimate of test set sizes to better interpret the results in Table 2.\n* Did you run any additional experiments analyzing the model tradeoff between performance on paraphrased vs non-paraphrased data?\n\nLIMITATIONS:\nThe authors neither discuss the limitations of their work nor do they mention ethical considerations arising from these results. I strongly encourage the authors to address these two missing points.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-06"}