Title: BiScope: AI-generated Text Detection by Checking Memorization of Preceding Tokens
Venue: NeurIPS 2024
Accepted: yes
Keywords: Large Language Models

AI-text Detection

Paraphrase

Trustworthy AI
Abstract: Detecting text generated by Large Language Models (LLMs) is a pressing need in
 order to identify and prevent misuse of these powerful models in a wide range of
 applications, which have highly undesirable consequences such as misinformation
 and academic dishonesty. Given a piece of subject text, many existing detection
 methods work by measuring the difficulty of LLM predicting the next token in
 the text from their prefix. In this paper, we make a critical observation that
 how well the current token’s output logits memorizes the closely preceding input
 tokens also provides strong evidence. Therefore, we propose a novel bi-directional
 calculation method that measures the cross-entropy losses between an output
 logits and the ground-truth token (forward) and between the output logits and
 the immediately preceding input token (backward). A classifier is trained to
 make the final prediction based on the statistics of these losses. We evaluate our
 system, named BISCOPE, on texts generated by five latest commercial LLMs
 across five heterogeneous datasets, including both natural language and code.
 BISCOPE demonstrates superior detection accuracy and robustness compared to six
 existing baseline methods, exceeding the state-of-the-art non-commercial methods’
 detection accuracy by over 0.30 F1 score, achieving over 0.95 detection F1 score
 on average. It also outperforms the best commercial tool GPTZero that is based on
 a commercial LLM trained with an enormous volume of data. Code is available at https://github.com/MarkGHX/BiScope.

BISCOPE: AI-generated Text Detection by Checking Memorization of Preceding Tokens

Abstract

Detecting text generated by Large Language Models (LLMs) is a pressing need in order to identify and prevent misuse of these powerful models in a wide range of applications, which have highly undesirable consequences such as misinformation and academic dishonesty. Given a piece of subject text, many existing detection methods work by measuring the difficulty of LLM predicting the next token in the text from their prefix. In this paper, we make a critical observation that how well the current token's output logits memorizes the closely preceding input tokens also provides strong evidence. Therefore, we propose a novel bi-directional calculation method that measures the cross-entropy losses between an output logits and the ground-truth token (forward) and between the output logits and the immediately preceding input token (backward). A classifier is trained to make the final prediction based on the statistics of these losses. We evaluate our system, named BISCOPE, on texts generated by five latest commercial LLMs across five heterogeneous datasets, including both natural language and code. BISCOPE demonstrates superior detection accuracy and robustness compared to nine existing baseline methods, exceeding the state-of-the-art non-commercial methods' detection accuracy by over 0 . 30 F1 score, achieving over 0 . 95 detection F1 score on average. It also outperforms the best commercial tool GPTZero that is based on a commercial LLM trained with an enormous volume of data. Code is available at https://github.com/MarkGHX/BiScope .

1 Introduction

Given the superior performance of Large Language Models (LLMs) in understanding and generating text, they have become an integral part of human society, assisting people with daily activities such as summarizing articles, polishing emails, and more. However, the widespread use of LLMs also raises concerns about the misuse of AI-generated text. For instance, students and academics may utilize LLMs to produce content for their assignments and research [10, 37, 30], compromising academic integrity. Adversarial individuals could leverage LLMs to efficiently create inflammatory and fraudulent content on social media [22]. Additionally, the development of LLMs themselves faces challenges related to the quality of existing datasets, which may be compromised by the significant

inclusion of AI-generated text [49, 27]. All of these issues underscore the urgent need to distinguish AI-generated text from human-written text [5, 14, 18, 50, 3, 12].

Despite this urgency, current AI-generated text detection techniques fall short as LLMs become increasingly diverse and advanced. Our experiments demonstrate that most of the existing approaches cannot achieve an F1 score exceeding 80% on the Yelp dataset [32] when using the latest LLMs (e.g., Claude-3-Opus) to generate content. A close examination of these approaches reveals inherent limitations by design. Specifically, there are three kinds of methods that do not need pre-training or additional information on the LLMs that generate the data ( e.g. , watermarking [7, 19, 44, 46, 20]). The first kind [5] directly prompts another LLM or NLP model to classify whether the subject text is AI-generated. While intuitive, the inevitable model hallucination [55, 26] consistently prevents it from achieving a high accuracy. The second kind of methods [28, 31, 9, 54] examines the linguistic features of the subject text, which are increasingly susceptible to deception as LLMs become more sophisticated and human-like in their responses. The third approach [11, 41, 17, 40, 16, 32, 35, 4, 53, 48] feeds partial or entire text to a surrogate model and checks how well the output text aligns with the surrogate model's preference via various metrics or downstream classifiers. While this method outperforms the first two approaches, it only examines the next token information in the output logits, representing just part of model behaviors, thereby naturally limiting its performance.

In this work, we explore the potential of leveraging internal model states to detect AI-generated text. Like existing methods, we hypothesize that since LLMs are trained on vast corpora of data from the Internet, their training data likely exhibit significant similarities, leading to similar behaviors across models. Therefore, we use a surrogate model to approximate the behaviors of the one used to generate the subject text. We also make a critical observation that, in causal language models ( e.g. , GPT), the current token's output logits encode information about both the next token ( i.e. , prediction) and its preceding input tokens ( i.e. , memorization), indicating a bidirectional relationship between the output logits and the input text. Specifically, when these causal language models encounter human data, they tend to memorize more preceding token information while predicting less next token information in their output logits.

To reveal this relationship, we calculate two kinds of cross-entropy losses by feeding different portions of the subject text into the surrogate model. One is the forward information, calculated as the cross-entropy loss between the output logits and the expected next token in the subject text. The other is the backward information, calculated as the cross-entropy loss between the output logits and the most preceding input token. We then train a binary classifier on the collected statistical loss features to make the final prediction. We also introduce several novel improvements in the prototype, such as providing a summary of the subject text to better guide the surrogate model, thereby enhancing its practical effectiveness and robustness, and using parallel model inference to enhance efficiency. As such, we propose BISCOPE, an effective and efficient AI-generated text detector by harnessing both the prediction and memorization features of the LLM through its output logits.

Our contributions are as follows:

We propose a novel AI-generated text detection algorithm that exploits both the preceding token information ( i.e. , memorization) and the next token information ( i.e. , prediction) via an innovative bi-directional cross-entropy loss calculation method. Additionally, we are the first to utilize text summaries to guide the detection, further enhancing its effectiveness and robustness toward heterogeneous data.

We extend existing datasets and craft a large-scale public dataset for more challenging AI-generated texts, consisting of 25 distinct groups and more than 22 , 000 samples. The dataset is sourced from five different text domains (both natural language and code) and generated by the five latest commercial LLMs. This dataset presents more challenging scenarios compared to existing datasets, which are typically sourced from open-source LLMs with fewer parameters and capabilities. We also craft a paraphrased version of our dataset.

We develop a prototype named BISCOPE, a detection pipeline without any fine-tuning needed for the detection LLM. We evaluate it on our dataset and compare it with nine stateof-the-art baseline techniques. Our results show that BISCOPE can achieve an average F1 score of over 0 . 95 , taking less than 200 milliseconds to detect a sample (when the summary procedure is disabled), while the baseline techniques achieve only 0 . 70 -0 . 85 F1 scores and take up to 27 seconds per sample. BISCOPE also outperforms the best commercial tool,

GPTZero, in 72% of cases. Additionally, we conduct a comprehensive ablation study to verify the effectiveness and robustness of each component of BISCOPE.

2 Background and Related Work

In addition to various watermarking techniques [7, 19, 44, 46, 20, 24, 15, 52] that require fine-tuning or additional information about the LLMs generating the text, several efforts have been directed towards the detection of AI-generated texts with minimal prior knowledge about the generative models. These efforts broadly fall into three categories. As stated in § 1, the first two categories perform worse than the last category, hence we mainly focus on the methods in the third category that use a surrogate LLM in this paper. The methods in the third category can be further divided into two types: statistical methods and training-based methods.

Statistical Methods. These techniques [45, 34, 21, 33] primarily utilize pre-trained LLMs to simulate the generation process of the target generative AI, analyzing the statistical differences between AIgenerated texts and human-written ones. These methods commonly serve as zero-shot approaches, assigning scores to indicate the probability of texts being AI-generated. For example, Zero-shot Query [32, 48] prompts a pre-trained LLM to score the input text. LogRank [11, 35] calculates the average probability rank of each token in a text processed through a pre-trained LLM, where higher ranks suggest the text is AI-generated. LRR [41] improves on LogRank by incorporating token confidence. DetectGPT [35] involves masking parts of the text to see how an LLM reconstructs them, and Raidar [32] employs the LLM to rewrite the text. Both methods assume that AI-generated texts are more likely to be preserved accurately in the process. Binoculars [13] analyzes the cross-entropy between the output logits from two surrogate models with different fine-tuning configurations.

Training-based Methods. This type includes methods train an NLP model to distinguish between AI-generated and human-written texts. For example, OpenAI [40] uses a RoBERTa-based model for training an AI-text classifier. Such methods can be susceptible to adversarial attacks or paraphrasing. The state-of-the-art technique RADAR [16] leverages adversarial training to improve the robustness of the classifier. There are also commercial services for the detection of AI-generated texts. For example, GPTZero [43] employs a multi-step statistical detection process and utilizes a pre-trained commercial LLM to deliver the prediction.

Our approach, BISCOPE, is a statistical method that uniquely incorporates meticulous statistical feature extraction via a bi-directional calculation method to ensure its general effectiveness and robustness against paraphrasing across five text domains and five of the latest commercial LLMs. To evaluate BISCOPE, we compare it with nine existing detection methods, including Zero-shot Query [48, 32], LogRank [11], LRR [41], DetectGPT [35], RADAR [16], Raidar [32], OpenAI Detector [40], Binoculars [13], and GhostBuster [48], as well as with the most renowned commercial detection API, GPTZero . We surpass these baseline methods in both effectiveness and efficiency.

3 Methodology of BISCOPE

3.1 Design Motivation

Although existing AI-generated text detection methods have been proven to be robust against texts generated by various open-source LLMs, their performance degrades in more complex and real-world scenarios, especially when dealing with the latest commercial LLMs and heterogeneous text genres. The degradation can be attributed to the following two reasons: feature insufficiency and contextual heterogeneity .

Feature Insufficiency. Existing methods focus on analyzing the difficulty a surrogate LLM experiences in predicting the next token given the preceding input text. For example, these methods use the rank or the probability of the next token as a metric or compare the discrepancy between the input text and the surrogate model's generation. Figure 1(a) presents the detection F1 score of a toy example that uses the average next token rank from Llama-2-7B as the feature and a random forest model as the classification model on both human text (in blue) and GPT-4-Turbo's text (in orange). The detection F1 score only reaches 0.55, which is just slightly better than random guesses. This indicates the lack of a clear separation using only next token ranks. One may argue that the random forest may

Human Text

AI Text

Count

0

20

40

60

Rank

0

1000

2000

Count

0

10

20

30

Rank

0

5000

Last Token Rank

1k

2k

3k

4k

5k

Next Token Rank

0

1000

Count

0

20

40

Cross Entropy Loss

2

3

4

5

Count

0

20

40

Cross Entropy Loss

10

15

Human Text

AI Text

Last Token CE Loss

10

12

14

16

18

Next Token CE Loss

2

3

4

5

(a) Next Token Rank, F1=0.55

(b) Last Token Rank, F1=0.73

(c) Both Rank, F1=0.78

(d) Next Token CE, F1=0.63

(e) Last Token CE, F1=0.81

(f) Both CE, F1=0.85

Transformer

Network

Internal

States

Preceding

Token

Information

Next

Token

Information

Preceding

Tokens

Inference

Reflect

Encode

Contain

Existing

Methods

Our

Method

Embedding

Output

Logits

Next

Token

Plan

not be powerful enough. However, we will show later that using additional features proposed in the paper, the same random forest configuration could achieve much better results.

We observe that the internals of the surrogate LLM when used to predict the subject text have much richer information that can be used. Figure 2 illustrates how LLM encodes information. The arrows and texts in green illustrate the information related to the next token, while the arrows and texts in gray show the information related to the preceding tokens. In the auto-regressive generation mode, the LLM receives the tokens preceding to the current position as the input and outputs the logits that contains its prediction for the next token. During this procedure, its internal states encode the preceding tokens (i.e., memorization) [47] while implicitly 'planning' for the next token [51], namely, as observed by researchers in [51], the internal states show similarities to the encodings of future tokens. The output logits, which can be considered as a reduced representation of the model's internal states, also contains both the information to predict the next token and the information of preceding tokens. Existing methods focus only on the former by comparing the output logits with the expected next token. In this paper, we propose to consider the preceding token information as well. In particular, we hypothesize the following: for human-written text, the surrogate LLM has a poor prediction for the next token and a strong memory of the previous token, reflected in the output logits, whereas the behaviors for LLM-generated text are the opposite. Intuitively, it's like when we humans are unsure of what to say next, and the last word tends to stay in our minds.

To validate our hypothesis, we conducted an experiment in which we compared the current output logits with the preceding token for a piece of a given text, leveraging the same random forest as before. Figure 1(b) and (c) present the detection F1 score when only using the preceding token's rank and when using both the preceding and next tokens' ranks (to distinguish human and LLM texts), reaching 0.73 and 0.78 F1 scores, respectively, denoting a 0.2 F1 score improvement compared to using the next token information alone. Observe that in (d) for next token prediction, the AI texts (in orange) tend to have a smaller CE loss than human texts (in blue), indicating the LLM has a better prediction for the AI texts. In (e) for previous token memorization, the human texts tend to have a smaller loss than the AI texts, indicating the LLM has poorer memory for AI texts. Figures (a) and (b) and an additional example in Appendix B show a similar trend. These support our hypothesis.

Thus, in BISCOPE, we design a novel bi-directional cross-entropy loss computation method that computes the cross-entropy losses between the output logits and the expected next token, and between the output logits and the preceding token. Figure 1(d)-(f) illustrate the F1 scores when using the cross-entropy losses for next token, previous token, and both. Observe they achieve better results compared to using plain ranks, due to the more wealthy information encoded. An additional example using GPT-Neo-2.7B in Appendix B shows a similar trend.

Contextual Heterogeneity. In addition to insufficient feature utilization, we also observe that contextual heterogeneity significantly influences detection accuracy. Existing methods directly use surrogate LLMs to generate the given text in an auto-regressive manner, without incorporating any

<latexi sh

1_b

64="

m+

0

A

MyN

SB

9RK3

HGrJU

>

c

VDL

F

2p

f

Zdu ovgq

T

W

X

w

5

C

O

P

n

/

Y

z

I

j

Q

E

8

<latexi sh

1_b

64="L3PEvonRUQy

CJ

W

2TI

>A

B9H

c

VD

N

F

pr

f

Zdu

q

+G

X

w

m0

K

M5

O

/

Y

z

8

j

Multi-Point

Splitting

mean

min

std

Cross

Entropy

Losses

mean

min

std

mean

min

std

1

2

3

4

Bi-directional

Cross-Entropy

Losses

Computation

Completion Prompt

Generation

Loss Computation

In Text Completion

Statistical

Feature Extraction

Feature

Classification

Given the summary:

Complete the text:

Write a title for the text:

Input

Text

Binary

Classification

Human

Text

AI

Text

Feature

Concatenation

FCE

BCE

additional information of the context (for the text). As such, given a prefix part of the text, the LLM may have a diverse set of possible completions, limiting the ability to separate human and LLM texts.

To alleviate this problem, we formalize our detection as a guided completion task, using a surrogate LLM to first summarize the entire input text. These text summaries are then used to guide the completion, providing complementary contextual information and making the features more robust.

3.2 Overview of BISCOPE

The entire workflow of BISCOPE can be summarized in four key steps, shown in Figure 3.

Step 1 ⃝ : Completion Prompt Generation. In the first step, we initialize the detection as a guided text completion task. We use a surrogate LLM to summarize the input text and generate a text summary as a guidance. We then divide the input text into two segments. The first segment, along with a completion request, is utilized to construct a text completion request. The text summary guidance and the text completion request form a completion prompt. Details are presented in § 3.3.

Step 2 ⃝ : Loss Computation In Text Completion. Given the completion prompt and the second segment of the input text from Step 1 ⃝ , we then calculate our novel bi-directional cross-entropy losses for the tokens in the second text segment using multiple open-source LLMs in parallel. Details are presented in § 3.4. The use of multiple LLMs is to reduce the uncertainty.

Step 3 ⃝ : Statistical Feature Extraction. We vary the separation of the two segments at different positions of the subject text (e.g., one-fourth, half, and three-fourth of the whole length). For each setup, we collect the statistics of the bi-directional cross-entropy loss values. The statistics are concatenated to form a feature vector. More details and justifications are presented in § 3.5.

Step 4 ⃝ : Feature Classification. In the final step, we use the concatenated feature vector to train a binary classifier, which determines whether the input text is human-generated or AI-generated. Further details are presented in § 3.6.

3.3 Completion Prompt Generation

In BISCOPE, we calculate the bi-directional cross-entropy losses within a guided text completion scenario. This scenario involves providing a text summary guidance and a short sub-string of the input text to force LLMs to generate the remainder of the text. Specifically, to alleviate the impact of contextual heterogeneity during text generation, we first utilize a surrogate LLM to summarize the entire input text and obtain a summary as guidance. We then divide the input text into two segments (e.g., the first 10% and the remaining 90%). The first segment, referred to as Input Text Segment 1 , serves as the sub-string in a text completion request, while the second segment, referred to as Input Text Segment 2 , is used as the completion ground-truth in § 3.4. By appending the text completion request after the summary guidance, we construct a completion prompt shown as follows:

The text in black indicates the text completion request, while the text in brown indicates the guidance, which is summarized using the following prompt:

The summary contains the aggregated contextual information of the entire text, providing complementary guidance to the LLM completion, in addition to the first segment. To balance the detection accuracy and efficiency, BISCOPE can also disable this text summary procedure to achieve faster AI-generated text detection with satisfactory accuracy.

3.4 Loss Computation In Text Completion

After crafting the completion prompt, we then feed it into multiple open-source LLMs in parallel to obtain multiple output logits that correspond to the Input Text Segment 2 from § 3.3 using the teacher forcing pattern [25], which feeds the ground-truth token prefixes ( Input Text Segment 2 ) to compute the output logits at each token position. These output logits can be used to measure how likely the LLMs predict the next token given its prefix in the subject text and how well the LLMs memorize the preceding token, according to our discussion in § 3.1. We hence propose a bi-directional cross-entropy calculation method in BISCOPE, which consists of both forward and backward cross-entropy calculations. The forward cross-entropy ( FCE ) calculation is identical to the commonly used cross-entropy in most LLM training processes, utilizing the output logits and the next ground-truth token to capture the output logits' next-token-related information. In contrast, the backward cross-entropy ( BCE ) is calculated between the output logits and the immediate preceding input token, capturing how much the logits memorizes the preceding token. The detailed FCE and BCE calculations at token position i with LLM M are shown in Equation 1:

where V indicates the vocabulary of the LLM, P i denotes the soft-maxed output logits from M at position i of the generated text (when given the preceding tokens from the completion prompt). ˜ P i indicates the ground-truth token encoding at the same position.

3.5 Statistical Feature Extraction

The aforementioned bi-directional cross-entropy loss values may have different characteristics when the text is partitioned at different positions. Intuitively, when the text is partitioned at a ratio of 1:9, meaning that we use the first 10% of the text to perform the completion, there tends to be a lot more uncertainty compared to a partition of 9:1. A naive design is to fix a partition ratio. However, finding the most effective partition is difficult. Another design is to use the loss values computed at all positions. However, it can hardly deal with length variations of input texts. Therefore, our design is to partition the whole text into n segments ( n = 10 in our implementation). For each segment, we collect the bidirectional loss value statistics over all the positions with the segment, including the mean , maximum , minimum , and standard deviation values. This allows us to align texts of various lengths and leverage the later classification to figure out the best partition positions (through learning). Additionally, this multi-segment analysis requires only a one-time inference of the input text, as the loss calculation at each position is independent of the others via teacher forcing. This allows BISCOPE to obtain various and sufficient features with high efficiency.

3.6 Feature Classification

In the final step, we concatenate all the statistical features of both the FCE and BCE vectors from all the detection LLMs into a one-dimensional feature vector, which is then used to train a binary classifier to perform the classification. Due to the generality of these features, the binary classifier can be directly used to detect unseen data, whether from unknown LLMs or unfamiliar text domains.

TPR

0

0.5

1.0

FPR

0

0.5

1.0

TPR

0

0.5

1.0

FPR

0

0.5

1.0

TPR

0

0.5

1.0

FPR

0

0.5

1.0

TPR

0

0.5

1.0

FPR

0

0.5

1.0

TPR

0

0.5

1.0

FPR

0

0.5

1.0

(a) GPT-3.5-Turbo

(b) GPT-4-Turbo

(c) Claude-3-Sonnet

(d) Claude-3-Opus

(e) Gemini-1.0-Pro

BiScope

BiScope*

LRR

RADAR

Raidar

OpenAI Detector

Binoculars

GhostBuster

4 Evaluation Results

4.1 Experimental Setup

We use five datasets in our evaluation, including two short natural language datasets (Arxiv [32] and Yelp [32]), two long natural language datasets (Creative [48] and Essay [48]), and one code dataset [8]. For all datasets, we reuse their human-generated data and craft AI-generated text using five of the latest commercial LLMs. More details are presented in Appendix C. To the best of our knowledge, we are the first to craft a comprehensive AI-generated text dataset using five of the latest commercial LLMs from three leading AI corporations. For the metrics, we use two metrics in our evaluation. To assess the effectiveness of the detection, we use a 5-fold cross-validation F1 score. To evaluate the efficiency of the detection, we use the time cost per sample as the metric. We present more hyper-parameter settings in Appendix A.

4.2 Detection Performance Comparison with Existing Baselines

We first evaluate BISCOPE (with and without the text summary guidance) and nine detection methods on the normal dataset under both in-distribution and out-of-distribution (OOD) settings. Under the in-distribution setting, the test data and training data are from the same source. While under the OOD setting, the test data is from an unknown source. The results are presented in Table 1. Our BISCOPE outperforms existing AI-generated text detection methods, achieving a 0 . 25 average detection F1 score increase on the normal dataset under in-distribution setting. In the OOD setting, our BISCOPE still surpasses existing detection methods with over a 0 . 16 average detection F1 score increase. Detailed analysis is shown as follows.

In-Distribution Results. For the in-distribution setting, we report a 5-fold cross-validation F1 score using one piece of human data and one piece of AI-generated data from the five latest commercial LLMs, as shown in Table 1. BISCOPE ∗ indicates our method with text summary guidance, while BISCOPE represents our method without it. Our method outperforms all nine baselines across all five datasets generated by the latest LLMs. Specifically, our method achieves a 0 . 29 average F1 score increase on the two short natural language datasets, where existing methods' best F1 score is around 0 . 90 , while BISCOPE reaches over 0 . 95 in most cases. On the two long natural language datasets, existing methods reach up to 0 . 97 , while BISCOPE achieves over 0 . 99 in all cases, resulting in a 0 . 23 average improvement. On the code dataset, existing methods achieve a 0 . 60 -0 . 70 average, whereas BISCOPE reaches 0 . 84 , achieving a 0 . 21 average increase. We further present the TPR-FPR (ROC) curves of BISCOPE and 8 baselines in Figure 4 on the Yelp dataset. We observe that our BISCOPE reaches over 0.8 detection TPR on average when the FPR is only 0.01, outperforming all the baselines on all the five generative models' data.

Out-of-Distribution Results. We use two out-of-distribution (OOD) evaluation settings on the normal dataset, cross-model (CM) and cross-dataset (CD), based on previous studies [48, 32]. In CM setting, we assess detection performance on AI-generated data from unknown LLMs within the same text domain by training classifiers on human data and one piece of AI-generated data, then testing on four others from the same dataset. In CD setting, we evaluate detection transferability across text domains by training on data from one dataset and testing on data from four others, all generated by the same LLM. Results across five LLMs are reported in Table 1. In the CM setting, the highest baseline F1 score is 0 . 84 (average 0 . 77 ), while our BISCOPE achieves 0 . 93 , showing a 0 . 16 average increase. This indicates superior generality of BISCOPE in detecting unseen LLM-generated texts. In the CD setting, BISCOPE's average F1 score is 0 . 05 lower than RADAR that utilizes a model

pre-trained on multiple datasets. However, compared to the other four baselines, BISCOPE still shows a 0 . 12 average improvement. Detailed OOD results are in Appendix D.

4.3 Robustness against Intentional Paraphrasing

Existing studies [23, 39] show that intentional paraphrasing can effectively evade AI-generated text detection. To verify the robustness of BISCOPE against paraphrasing, we utilize five of the latest commercial LLMs to paraphrase their own data using the paraphrasing prompt from previous work [16], and compare BISCOPE with nine baselines on this paraphrased dataset under both indistribution and out-of-distribution settings, as shown in Table 1. Under the in-distribution setting, we test all the methods using the same configuration as on the normal dataset, exploring whether paraphrasing reduces the discriminative power of existing methods. BISCOPE outperforms existing

Arxiv

Yelp

Creative

Essay

Code

0.2

0.4

0.6

0.8

1

Arxiv

Yelp

Creative

Essay

Code

0.2

0.4

0.6

0.8

1

Arxiv

Yelp

Creative

Essay

Code

0.2

0.4

0.6

0.8

1

Arxiv

Yelp

Creative

Essay

Code

0.2

0.4

0.6

0.8

1

Arxiv

Yelp

Creative

Essay

Code

0.2

0.4

0.6

0.8

1

(a) GPT-3.5-Turbo

(b) GPT-4-Turbo

(c) Claude-3-Sonnet

(d) Claude-3-Opus

(e) Gemini-1.0-Pro

GPTZero

BiScope

BiScope*

15.95

27.42

1.35

Time (s) / Sample

0.32

0.05

0.10

0.01

0.03

0.19

0.37

0.14

Zero-shot

LogRank

LRR

RADAR

Raidar

Binoculars

BiScope

OpenAI Detector

GhostBuster

BiScope*

0

0.2

0.4

10

20

30

Detection Method

Detection F1 Score

0.05

0.14

0.04

0.03 0.03

0.05

0.14

1.22

1.31

1.21 1.21 1.21

1.25

1.35

0.8

0.9

1.0

BiScope Time

BiScop* Time

BiScope F1

BiScope* F1

Time (s) / Sample

0

0.5

1.0

1.5

Gemma-2B

Gemma-7B

Llama-2-7B

Mistral-7B

Llama-3-8B

Llama-2-13B

Ensemble

FCE Only

BCE Only

BCE+FCE

Detection F1 Score

0.6

0.8

1.0

Arxiv

Yelp

Creative

Essay

Code

baselines with a 0 . 29 average F1 score increase. Additionally, existing baselines experience an overall 0 . 03 F1 detection score drop compared to their performance on the normal dataset. In contrast, our BISCOPE performs even better on the paraphrased dataset, with an overall 0 . 02 average F1 score increase. Under the out-of-distribution setting, we train the classifiers for all the methods on the normal dataset, while testing them on the paraphrased dataset, exploring the generality of the detection against unseen paraphrased data. Our BISCOPE outperforms existing baselines with an average 0 . 29 F1 detection score increase.

4.4 Comparison with The Latest Commercial Detection Method

We also compare BISCOPE with the latest version ( 2024-01-09 ) of the most renowned commercial AI-generated text detection API, GPTZero [43], across all five datasets, as shown in Figure 5. BISCOPE outperforms GPTZero in 72% of the cases. Specifically, BISCOPE achieves a 0 . 02 , 0 . 01 , and 0 . 01 average F1 detection score increase on the Arxiv, Essay, and Creative datasets, respectively. On the Yelp dataset, BISCOPE's F1 detection score is 0 . 04 lower than GPTZero's. However, on the code dataset, BISCOPE performs significantly better than GPTZero, achieving a 0 . 19 average F1 score improvement, demonstrating BISCOPE's superior generality from natural language to code. Note that GPTZero's detection model is pre-trained on millions of data points, while our BISCOPE's classifier is trained on at most 4 , 000 test samples for each case.

4.5 Efficiency Analysis

To address real-world challenges, efficiency is crucial for detection methods. We compared BISCOPE with nine baselines across five datasets, detailing average processing times for a single sample in Figure 6. RADAR is the fastest at 0 . 01 s per sample, while its adversarial training overhead may be considerable. Processing times for the other baselines are as follows: zero-shot query at 0 . 32 s, LogRank at 0 . 05 s, LRR at 0 . 10 s, DetectGPT at 15 . 95 s, Raidar at 27 . 42 s, OpenAI Detector at 0 . 03 s, Binoculars at 0 . 19 s, and GhostBuster at 0 . 37 s. Zero-shot query, LogRank, LRR, and OpenAI Detector are much quicker than DetectGPT, Raidar, Binoculars, and GhostBuster but offer lower detection performance and robustness. Our BISCOPE processes a sample in 0 . 14 s without summary guidance, matching the real-time levels of zero-shot query, LogRank, and LRR, while improving detection F1 score by over 0 . 30 . With summary guidance, BISCOPE's processing time increases to 1 . 35 s per

sample, still 12 to 20 times faster than DetectGPT and Raidar, and achieves the highest detection score.

4.6 Ablation Study

We further evaluate the importance of each component in BISCOPE with two categories of ablation experiments. Since BISCOPE utilizes six open-source LLMs in parallel and ensemble their features, we first investigate the contribution of each LLM's feature in Figure 7 individually. Then, we further explore the contribution of BISCOPE's FCE and BCE losses respectively, compared with their aggregated performance, shown as Figure 8. More detailed results are shown in Appendix E. We also present more detailed ablation study on the impact of different segmentation strategies in multi-point splitting (Appendix E.3), and the impact of the completion prompt (Appendix E.4), in Appendix E.

BISCOPE's Performance with Different Base Models. We individually test all the detection base models in BISCOPE both with and without the summary procedure, including Gemma-2B, Gemma7B, Llama-2-7B, Mistral-7B, Llama-3-8B, and Llama-2-13B. All the detection models help BISCOPE achieve over a 0 . 84 overall F1 detection score across all five datasets, demonstrating high consistency across different detection base models. As the size of the detection base model increases, BISCOPE performs progressively better, with F1 scores improving from 0 . 84 to 0 . 95 .

Importance of FCE and BCE in BISCOPE's Detection. To demonstrate the rationality of the proposed bi-directional cross-entropy losses, we also evaluate BISCOPE by only using either FCE or BCE losses, and using both of them with the Llama-2-7B model, as shown in Figure 8. When using both the FCE and BCE losses, BISCOPE achieves the best average F1 detection score across the five datasets, which is 0 . 94 , highlighting the necessity of combining both FCE and BCE loss features. When only using FCE or BCE , BISCOPE reaches 0 . 86 and 0 . 93 average F1 detection scores, respectively, indicating that BCE is more discriminative than FCE .

5 Limitations and Future Work

Our BISCOPE can achieve over a 0 . 95 F1 detection score across five datasets generated by the five latest commercial LLMs, both with and without intentional paraphrasing, illustrating the importance of the preceding token information in the output logits. However, in the OOD cross-dataset setting, there is a noticeable > 0 . 10 detection F1 score drop, highlighting the challenges in this setting. Thus, there is still room for future research to achieve more effective and robust detection in few-shot and cross-dataset settings, where the training set contains fewer samples and the test set comes from different text domains. Additionally, exploring ways to further exploit preceding token information and combine it with next token information should also be a future direction in the field of AIgenerated text detection.

6 Conclusion

Existing methods to differentiate AI-generated texts from human-generated texts often analyze the difficulty for a surrogate LLM to generate the next token based on previous tokens from the text. We propose a more discriminative approach via a novel bi-directional cross-entropy calculation method, leveraging both the preceding token information and the next token information in the output logits. We integrate this method into a four-step detection pipeline, BISCOPE, which consists of Completion Prompt Generation, Loss Computation in Text Completion, Statistical Feature Extraction, and Feature Classification. We evaluate BISCOPE on five datasets, including both natural language and code, against six existing detection methods. BISCOPE surpasses all these methods, improving the average F1 detection score by 0 . 30 and also outperforming the well-known commercial API - GPTZero in 72% cases, while maintaining a real-time processing speed of less than 200ms per sample.

Acknowledgments and Disclosure of Funding

We are grateful to the Center for AI Safety for providing computational resources. This work was funded in part by the National Science Foundation (NSF) Awards SHF-1901242, SHF-1910300, Proto-OKN 2333736, IIS-2416835, DARPA VSPELLS - HR001120S0058, IARPA TrojAI W911NF19-S0012, ONR N000141712045, N000141410468 and N000141712947. Any opinions, findings and conclusions or recommendations expressed in this material are those of the authors and do not necessarily reflect the views of the sponsors.

References

Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. Gpt-4 technical report. arXiv preprint arXiv:2303.08774 , 2023.

Anthropic. Claude 3 api. https://www.anthropic.com/news/claude-3-family , 2023.

Anton Bakhtin, Sam Gross, Myle Ott, Yuntian Deng, Marc'Aurelio Ranzato, and Arthur Szlam. Real or fake? learning to discriminate machine from human generated text. arXiv preprint arXiv:1906.03351 , 2019.

Guangsheng Bao, Yanbin Zhao, Zhiyang Teng, Linyi Yang, and Yue Zhang. Fast-detectgpt: Efficient zero-shot detection of machine-generated text via conditional probability curvature. In International Conference on Learning Representations (ICLR) , 2024.

Amrita Bhattacharjee and Huan Liu. Fighting fire with fire: can chatgpt detect ai-generated text? ACM SIGKDD Explorations Newsletter , 25(2):14-21, 2024.

Sid Black, Leo Gao, Phil Wang, Connor Leahy, and Stella Biderman. GPT-Neo: Large Scale Autoregressive Language Modeling with Mesh-Tensorflow, 2021.

Jack T Brassil, Steven Low, Nicholas F Maxemchuk, and Lawrence O'Gorman. Electronic marking and identification techniques to discourage document copying. IEEE Journal on Selected Areas in Communications (JSAC) , 13(8):1495-1504, 1995.

Mark Chen, Jerry Tworek, Heewoo Jun, Qiming Yuan, Henrique Ponde de Oliveira Pinto, Jared Kaplan, Harri Edwards, Yuri Burda, Nicholas Joseph, Greg Brockman, et al. Evaluating large language models trained on code. arXiv preprint arXiv:2107.03374 , 2021.

Xiuyuan Cheng and Alexander Cloninger. Classification logit two-sample testing by neural networks for differentiating near manifold densities. IEEE Transactions on Information Theory , 68(10):6631-6662, 2022.

Debby RE Cotton, Peter A Cotton, and J Reuben Shipway. Chatting and cheating: Ensuring academic integrity in the era of chatgpt. Innovations in Education and Teaching International , 61(2):228-239, 2024.

Sebastian Gehrmann, Hendrik Strobelt, and Alexander Rush. GLTR: Statistical detection and visualization of generated text. In Annual Meeting of the Association for Computational Linguistics: System Demonstrations (ACL) , 2019.

Biyang Guo, Xin Zhang, Ziyuan Wang, Minqi Jiang, Jinran Nie, Yuxuan Ding, Jianwei Yue, and Yupeng Wu. How close is chatgpt to human experts? comparison corpus, evaluation, and detection. arXiv preprint arXiv:2301.07597 , 2023.

Abhimanyu Hans, Avi Schwarzschild, Valeriia Cherepanova, Hamid Kazemi, Aniruddha Saha, Micah Goldblum, Jonas Geiping, and Tom Goldstein. Spotting llms with binoculars: Zero-shot detection of machine-generated text. In International Conference on Machine Learning (ICML) , 2024.

Xinlei He, Xinyue Shen, Zeyuan Chen, Michael Backes, and Yang Zhang. Mgtbench: Benchmarking machine-generated text detection. arXiv preprint arXiv:2303.14822 , 2023.

Abe Hou, Jingyu Zhang, Tianxing He, Yichen Wang, Yung-Sung Chuang, Hongwei Wang, Lingfeng Shen, Benjamin Van Durme, Daniel Khashabi, and Yulia Tsvetkov. Semstamp: A semantic watermark with paraphrastic robustness for text generation. In Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (NAACL) , 2024.

Xiaomeng Hu, Pin-Yu Chen, and Tsung-Yi Ho. Radar: Robust ai-text detection via adversarial learning. Advances in Neural Information Processing Systems (NeurIPS) , 2023.

Daphne Ippolito, Daniel Duckworth, Chris Callison-Burch, and Douglas Eck. Automatic detection of generated text is easiest when humans are fooled. In Annual Meeting of the Association for Computational Linguistics: System Demonstrations (ACL) , 2020.

Ganesh Jawahar, Muhammad Abdul Mageed, and VS Laks Lakshmanan. Automatic detection of machine generated text: A critical survey. In International Conference on Computational Linguistics (COLING) , 2020.

Mohan S Kankanhalli and KF Hau. Watermarking of electronic text documents. Electronic Commerce Research , 2:169-187, 2002.

John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. A watermark for large language models. In International Conference on Machine Learning (ICML) , 2023.

Ryuto Koike, Masahiro Kaneko, and Naoaki Okazaki. Outfox: Llm-generated essay detection through in-context learning with adversarially generated examples. In AAAI Conference on Artificial Intelligence (AAAI) , 2024.

Sarah Kreps, R Miles McCain, and Miles Brundage. All the news that's fit to fabricate: Ai-generated text as a tool of media misinformation. Journal of Experimental Political Science , 9(1):104-117, 2022.

Kalpesh Krishna, Yixiao Song, Marzena Karpinska, John Wieting, and Mohit Iyyer. Paraphrasing evades detectors of ai-generated text, but retrieval is an effective defense. Advances in Neural Information Processing Systems (NeurIPS) , 2023.

Rohith Kuditipudi, John Thickstun, Tatsunori Hashimoto, and Percy Liang. Robust distortion-free watermarks for language models. arXiv preprint arXiv:2307.15593 , 2023.

Alex M Lamb, Anirudh Goyal ALIAS PARTH GOYAL, Ying Zhang, Saizheng Zhang, Aaron C Courville, and Yoshua Bengio. Professor forcing: A new algorithm for training recurrent networks. Advances in Neural Information Processing Systems (NeurIPS) , 2016.

Junyi Li, Xiaoxue Cheng, Wayne Xin Zhao, Jian-Yun Nie, and Ji-Rong Wen. Halueval: A large-scale hallucination evaluation benchmark for large language models. In Conference on Empirical Methods in Natural Language Processing (EMNLP) , 2023.

Jiayi Liang, Xi Zhang, Yuming Shang, Sanchuan Guo, and Chaozhuo Li. Clean-label poisoning attack against fake news detection models. In IEEE International Conference on Big Data (BigData) , 2023.

Feng Liu, Wenkai Xu, Jie Lu, Guangquan Zhang, Arthur Gretton, and Danica J Sutherland. Learning deep kernels for non-parametric two-sample tests. In International Conference on Machine Learning (ICML) , 2020.

Yinhan Liu, Myle Ott, Naman Goyal, Jingfei Du, Mandar Joshi, Danqi Chen, Omer Levy, Mike Lewis, Luke Zettlemoyer, and Veselin Stoyanov. Roberta: A robustly optimized bert pretraining approach. arXiv preprint arXiv:1907.11692 , 2019.

Chung Kwan Lo. What is the impact of chatgpt on education? a rapid review of the literature. Education Sciences , 13(4):410, 2023.

David Lopez-Paz and Maxime Oquab. Revisiting classifier two-sample tests. In International Conference on Learning Representations (ICLR) , 2016.

Chengzhi Mao, Carl Vondrick, Hao Wang, and Junfeng Yang. Raidar: generative ai detection via rewriting. International Conference on Learning Representations (ICLR) , 2024.

Hope McGovern, Rickard Stureborg, Yoshi Suhara, and Dimitris Alikaniotis. Your large language models are leaving fingerprints. arXiv preprint arXiv:2405.14057 , 2024.

Niloofar Mireshghallah, Justus Mattern, Sicun Gao, Reza Shokri, and Taylor Berg-Kirkpatrick. Smaller language models are better zero-shot machine-generated text detectors. In Conference of the European Chapter of the Association for Computational Linguistics (EACL) , 2024.

Eric Mitchell, Yoonho Lee, Alexander Khazatsky, Christopher D Manning, and Chelsea Finn. Detectgpt: Zero-shot machine-generated text detection using probability curvature. In International Conference on Machine Learning (ICML) , 2023.

OpenAI. Gpt-3.5 turbo api. https://platform.openai.com/docs/models/gpt-3-5-turbo , 2023.

Mike Perkins. Academic integrity considerations of ai large language models in the post-pandemic era: Chatgpt and beyond. Journal of University Teaching & Learning Practice , 20(2):07, 2023.

Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, and Peter J. Liu. Exploring the limits of transfer learning with a unified text-to-text transformer. Journal of Machine Learning Research (JMLR) , 21(140):1-67, 2020.

Vinu Sankar Sadasivan, Aounon Kumar, Sriram Balasubramanian, Wenxiao Wang, and Soheil Feizi. Can ai-generated text be reliably detected? arXiv preprint arXiv:2303.11156 , 2023.

Irene Solaiman, Miles Brundage, Jack Clark, Amanda Askell, Ariel Herbert-Voss, Jeff Wu, Alec Radford, Gretchen Krueger, Jong Wook Kim, Sarah Kreps, et al. Release strategies and the social impacts of language models. arXiv preprint arXiv:1908.09203 , 2019.

Jinyan Su, Terry Yue Zhuo, Di Wang, and Preslav Nakov. Detectllm: Leveraging log rank information for zero-shot detection of machine-generated text. Conference on Empirical Methods in Natural Language Processing (EMNLP) , 2023.

Gemini Team, Rohan Anil, Sebastian Borgeaud, Yonghui Wu, Jean-Baptiste Alayrac, Jiahui Yu, Radu Soricut, Johan Schalkwyk, Andrew M Dai, Anja Hauth, et al. Gemini: A family of highly capable multimodal models. arXiv preprint arXiv:2312.11805 , 2023.

Edward Tian and Alexander Cui. Gptzero: Towards detection of ai-generated text using zero-shot and supervised methods", 2023.

Umut Topkara, Mercan Topkara, and Mikhail J Atallah. The hiding virtues of ambiguity: quantifiably resilient watermarking of natural language text through synonym substitutions. In The 8th Workshop on Multimedia and Security , 2006.

Eduard Tulchinskii, Kristian Kuznetsov, Laida Kushnareva, Daniil Cherniavskii, Sergey Nikolenko, Evgeny Burnaev, Serguei Barannikov, and Irina Piontkovskaya. Intrinsic dimension estimation for robust detection of ai-generated texts. Advances in Neural Information Processing Systems (NeurIPS) , 2023.

Honai Ueoka, Yugo Murawaki, and Sadao Kurohashi. Frustratingly easy edit-based linguistic steganography with a masked language model. In The North American Chapter of the Association for Computational Linguistics: Human Language Technologies (NAACL) , 2021.

Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Łukasz Kaiser, and Illia Polosukhin. Attention is all you need. Advances in Neural Information Processing Systems (NeurIPS) , 2017.

Vivek Verma, Eve Fleisig, Nicholas Tomlin, and Dan Klein. Ghostbuster: Detecting text ghostwritten by large language models. arXiv preprint arXiv:2305.15047 , 2023.

Eric Wallace, Tony Zhao, Shi Feng, and Sameer Singh. Concealed data poisoning attacks on nlp models. In Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (NAACL) , 2021.

Yuxia Wang, Jonibek Mansurov, Petar Ivanov, Jinyan Su, Artem Shelmanov, Akim Tsvigun, Chenxi Whitehouse, Osama Mohammed Afzal, Tarek Mahmoud, Alham Fikri Aji, et al. M4: Multi-generator, multidomain, and multi-lingual black-box machine-generated text detection. arXiv preprint arXiv:2305.14902 , 2023.

Wilson Wu, John X Morris, and Lionel Levine. Do language models plan ahead for future tokens? arXiv preprint arXiv:2404.00859 , 2024.

Xi Yang, Kejiang Chen, Weiming Zhang, Chang Liu, Yuang Qi, Jie Zhang, Han Fang, and Nenghai Yu. Watermarking text generated by black-box language models. arXiv preprint arXiv:2305.08883 , 2023.

Xianjun Yang, Wei Cheng, Linda Petzold, William Yang Wang, and Haifeng Chen. Dna-gpt: Divergent n-gram analysis for training-free detection of gpt-generated text. International Conference on Learning Representations (ICLR) , 2024.

Shuhai Zhang, Yiliao Song, Jiahao Yang, Yuanqing Li, Bo Han, and Mingkui Tan. Detecting machinegenerated texts by multi-population aware optimization for maximum mean discrepancy. In International Conference on Learning Representations (ICLR) , 2024.

Yue Zhang, Yafu Li, Leyang Cui, Deng Cai, Lemao Liu, Tingchen Fu, Xinting Huang, Enbo Zhao, Yu Zhang, Yulong Chen, et al. Siren's song in the ai ocean: a survey on hallucination in large language models. arXiv preprint arXiv:2309.01219 , 2023.

To further illustrate our BISCOPE with more details, we present the following materials in the Appendix, shown as follows:

Appendix A: Hyper-parameter settings for our method and all the baselines.

Appendix B: An additional motivation example using a smaller LLM.

Appendix C: More statistical details of the dataset crafted and utilized in the paper.

Appendix D: More detailed results on both normal and paraphrased data under OOD setting.

Appendix E: More details of the ablation study.

A Hyper-parameter Settings

We use the default best-performance settings for all the baselines. Specifically, we use GPT-Neo2.7B [6] as the surrogate model in LogRank and LRR, and as the scoring model in DetectGPT, where we use T5-3B [38] as the mask-filling model. For RADAR, we use its officially released detection model, which is a pre-trained RoBERTa-Large [29] model. For Zero-shot Query and Raidar, we use GPT-3.5-Turbo as the query model and the rewriting model. For other baselines, we strictly follow their official implementations with their best configurations. For our BISCOPE, we utilize six opensource LLMs in parallel, including Gemma-2B, Gemma-7B, Llama-2-7B, Mistral-7B, Llama-3-8B, and Llama-2-13B. We also test BISCOPE with (BISCOPE ∗ ) and without (BISCOPE) text summary guidance. For better reproducibility, we recommend using either Llama2-7B or Llama2-13B as the surrogate model, while the ensemble of more surrogate models is always welcomed. For the text split method, we recommend splitting the text at every 10% length, as used in our paper.

B Additional Motivation Example

Human Text

AI Text

Count

0

50

100

Rank

0

1000

Count

0

10

20

30

Rank

0

5000

Human Text

AI Text

Last Token Rank

0

2k

4k

6k

Next Token Rank

0

1000

Count

0

20

40

Cross Entropy Loss

2

3

4

5

Count

0

10

20

30

Cross Entropy Loss

10

12

Last Token CE Loss

9

10

11

12

13

Next Token CE Loss

2

3

4

5

(a) Next Token Rank, F1=0.58

(b) Last Token Rank, F1=0.63

(c) Both Rank, F1=0.67

(d) Next Token CE, F1=0.53

(e) Last Token CE, F1=0.76

(f) Both CE, F1=0.82

Figure 9 presents an additional example using a smaller language model: GPT-Neo-2.7B. Specifically, Figure 9(a) and (d) show the detection F1 score when only using the next token's rank and crossentropy loss for detection. The F1 detection scores are less than 0.60 in both cases. However, when we use the preceding token's rank or cross-entropy loss as the feature, shown in Figure 9(b) and (e), the detection F1 scores increase to 0.63 and 0.76 respectively, indicating the higher reference value of the preceding token information. Figure 9(c) and (f) also show that using both the preceding token information and the next token information in the output logits achieves the best detection performance, with overall detection F1 scores of 0.67 and 0.82.

Moreover, when considering the preceding token information, AI text has a smaller rank score or higher cross-entropy loss, representing worse memorization of the AI text in the output logits.

Conversely, when considering the next token information, the result is the opposite, showing better prediction for AI text. This trend aligns with the results in Figure 1, demonstrating the generality of our observation.

C Additional Details about Datasets

For all datasets, we reuse their human-generated data and craft AI-generated text using five of the latest commercial LLMs: GPT-3.5-Turbo [36], GPT-4-Turbo [1], Claude-3-Sonnet [2], Claude-3Opus [2], and Gemini-1.0-Pro [42]. Thus, for each dataset, we have one piece of human-generated data and five pieces of AI-generated data. Additionally, we also create a corresponding paraphrased dataset using similar paraphrasing prompts from previous studies [32] on our newly crafted dataset to evaluate the robustness of the detection methods.

Table 2 presents more detailed information about the datasets used in our paper, for both the normal dataset and the paraphrased dataset. For the short natural language datasets (i.e., Arxiv and Yelp), the average text lengths are 187 and 477, respectively, with minimal lengths of 101 and 10. In contrast, the average text lengths of the long natural language datasets (i.e., Creative and Essay) are 2860 and 3899, which are 6-15 times larger than the short natural language dataset's sample length. The code dataset contains approximately 164 pieces of Python code for human-generated text and AI-generated text from each LLM, with an average length of 983, a minimum length of 41, and a maximum length of 1993. For all the datasets, the human-generated data and AI-generated data share similar lengths, preventing simple length-based detection.

D Additional Comparison Results under OOD Setting

Table 3 illustrates more detailed OOD results on both the normal and paraphrased datasets across five datasets. Under the cross-model setting on the normal dataset, BISCOPE outperforms existing baselines in 21 out of 25 cases. Specifically, BISCOPE reaches over a 0 . 95 detection F1 score against five generative LLMs on the Arxiv, Creative, and Essay datasets, while the detection F1 scores of existing baselines are usually less than 0 . 90 . On the Yelp dataset, BISCOPE achieves over a 0 . 90 detection F1 score against all five generative models, while the five baselines reach less than a 0 . 85 detection F1 score in most cases. On the code dataset, our BISCOPE outperforms all baselines except for Raidar, achieving more than a 0 . 15 detection F1 score increase. Under the cross-dataset setting on the normal dataset, our BISCOPE performs worse than under the cross-model setting, outperforming existing methods in only 9 out of 25 cases. However, in most cases, BISCOPE is the second-best detection method, only trailing RADAR, which uses a detection model pre-trained on texts from multiple domains. As for the OOD setting on the paraphrased dataset, BISCOPE outperforms the five baselines in 17 out of 20 cases, achieving over a 0 . 90 detection F1 score compared to the < 0 . 75 average F1 score of the baselines.

E Additional Details of Ablation Study

E.1 Results with Different Open-source LLMs

Table 4 shows additional details when different detection models are used by BISCOPE on both the normal and paraphrased datasets. In most cases, the ensemble results are better than the F1 scores derived using a single detection model. However, at least 90% of the detection performance can be preserved in most single-detection-model settings. Additionally, the detection F1 score consistently increases with the increasing model size of the detection model.

Among all the detection models, the Llama-2 series performs the best, outperforming its updated version, Llama-3. In contrast, the Gemma series performs the worst. A possible reason is that the Gemma and Llama-3 series models are still in their early development stages and are not fully capable of handling the AI-generated text detection task.

Additionally, when using only a single base model, BISCOPE can achieve a processing speed as fast as 0 . 03 s per sample, outperforming all baseline methods except for RADAR.

E.2 Detailed Contribution Comparison of Forward and Backward Cross-entropy Losses

Table 5 shows a more concrete comparison between the contributions of FCE and BCE to BISCOPE's detection effectiveness. In 21 of 25 cases, BCE is more discriminative compared with FCE (especially on code dataset), providing sufficient justifications for BISCOPE that introduce the preceding token information into the detection. Besides, In 16 of the 25 cases, the combination of FCE and BCE outperforms the FCE only and BCE only versions, supporting the necessity to use the bi-directional cross-entropy loss calculation method.

E.3 Impact of Different Segmentation Strategies in Multi-point Splitting in BISCOPE

Table 6 presents the ablation results with different segmentation strategies in the multi-point splitting of BISCOPE. We tested three strategies: splitting at every 50% text length, every 25% text length, and every 10% text length (as used in our paper). The results indicate that a more fine-grained splitting interval generally improves BISCOPE's performance. However, in a small number of cases, a smaller splitting interval may degrade performance. We choose to use 10% as it achieves the highest detection scores in most cases while reaching low degradation in corner cases.

E.4 Impact of The Completion Prompt in BISCOPE

Table 7 presents the comparison results when using and not using the completion prompt in BISCOPE. The results show that in 25 of 45 cases, using the completion prompt performs better. Additionally, the completion prompt is more compatible with the summary procedure. Thus, we chose to use the completion prompt in BISCOPE.

NeurIPS Paper Checklist

1. Claims

Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?

Answer: [Yes]

Justification: We summarize the procedure of our method and highlight both of our method and dataset contribution in the abstract and introduction sections.

Guidelines:

The answer NA means that the abstract and introduction do not include the claims made in the paper.

The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.

The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.

It is fine to include aspirational goals as motivation as long as it is clear that these goals are not attained by the paper.

2. Limitations

Question: Does the paper discuss the limitations of the work performed by the authors?

Answer: [Yes]

Justification: We present the limitation of our work and potential future research directions in § 5.

Guidelines:

The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.

The authors are encouraged to create a separate "Limitations" section in their paper.

The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.

The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with a few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.

The authors should reflect on the factors that influence the performance of the approach. For example, a facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or a speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.

The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.

If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.

While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an important role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.

3. Theory Assumptions and Proofs

Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?

Answer: [NA]

Justification: We use empirical examples and results to justify our method.

Guidelines:

The answer NA means that the paper does not include theoretical results.

All the theorems, formulas, and proofs in the paper should be numbered and crossreferenced.

All assumptions should be clearly stated or referenced in the statement of any theorems.

The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch to provide intuition.

Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.

Theorems and Lemmas that the proof relies upon should be properly referenced.

4. Experimental Result Reproducibility

Question: Does the paper fully disclose all the information needed to reproduce the main experimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?

Answer: [Yes]

Justification: We introduce the details of our method at each step in § 3, and the hyperparameters we used in Appendix A. The code will be available at https://github.com/ MarkGHX/BiScope .

Guidelines:

The answer NA means that the paper does not include experiments.

If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.

If the contribution is a dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.

Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.

While NeurIPS does not require releasing code, the conference does require all submissions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example

(a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm.

(b) If the contribution is primarily a new model architecture, the paper should describe the architecture clearly and fully.

(c) If the contribution is a new model (e.g., a large language model), then there should either be a way to access this model for reproducing the results or a way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).

(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.

5. Open access to data and code

Question: Does the paper provide open access to the data and code, with sufficient instructions to faithfully reproduce the main experimental results, as described in supplemental material?

Answer: [Yes]

Justification: We will open-source our data and code at https://github.com/MarkGHX/ BiScope .

Guidelines:

The answer NA means that paper does not include experiments requiring code.

Please see the NeurIPS code and data submission guidelines ( https://nips.cc/ public/guides/CodeSubmissionPolicy ) for more details.

While we encourage the release of code and data, we understand that this might not be possible, so 'No' is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for a new open-source benchmark).

The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines ( https: //nips.cc/public/guides/CodeSubmissionPolicy ) for more details.

The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.

The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only a subset of experiments are reproducible, they should state which ones are omitted from the script and why.

At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).

Providing as much information as possible in supplemental material (appended to the paper) is recommended, but including URLs to data and code is permitted.

6. Experimental Setting/Details

Question: Does the paper specify all the training and test details (e.g., data splits, hyperparameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?

Answer: [Yes]

Justification: We detailed all the dataset, metrics, and evaluation settings in § 4. We also list the hyper-parameters we used for our methods and all the baselines in Appendix A.

Guidelines:

The answer NA means that the paper does not include experiments.

The experimental setting should be presented in the core of the paper to a level of detail that is necessary to appreciate the results and make sense of them.

The full details can be provided either with the code, in appendix, or as supplemental material.

7. Experiment Statistical Significance

Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?

Answer: [No]

Justification: We do not use error bars, but we use the F1 score to measure our method and all the baselines instead. Additionally, we also conduct a detailed ablation study for each specific case in our paper.

Guidelines:

The answer NA means that the paper does not include experiments.

The authors should answer "Yes" if the results are accompanied by error bars, confidence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).

The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)

The assumptions made should be given (e.g., Normally distributed errors).

It should be clear whether the error bar is the standard deviation or the standard error of the mean.

It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have a 96% CI, if the hypothesis of Normality of errors is not verified.

For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative error rates).

If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.

8. Experiments Compute Resources

Question: For each experiment, does the paper provide sufficient information on the computer resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?

Answer: [Yes]

Justification: We provide detailed hyper-parameter settings and present the execution time for our method and all the baselines.

Guidelines:

The answer NA means that the paper does not include experiments.

The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.

The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.

The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make it into the paper).

9. Code Of Ethics

Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https://neurips.cc/public/EthicsGuidelines ?

Answer: [Yes]

Justification: Our paper is aligned with the NeurIPS Code of Ethics.

Guidelines:

The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.

If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics.

The authors should make sure to preserve anonymity (e.g., if there is a special consideration due to laws or regulations in their jurisdiction).

10. Broader Impacts

Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?

Answer: [Yes]

Justification: We present the advantages and limitations of our method, and introduce future directions at §5. We also compare our method with the latest commercial method, showing the positive impacts on the open-source community.

Guidelines:

The answer NA means that there is no societal impact of the work performed.

If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.

Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.

The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.

The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.

If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).

11. Safeguards

Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?

Answer: [NA]

Justification: Not involved in misusing.

Guidelines:

The answer NA means that the paper poses no such risks.

Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.

Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.

We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make a best faith effort.

12. Licenses for existing assets

Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?

Answer: [Yes]

Justification: We cite all the baseline methods and data sources in our paper.

Guidelines:

The answer NA means that the paper does not use existing assets.

The authors should cite the original paper that produced the code package or dataset.

The authors should state which version of the asset is used and, if possible, include a URL.

The name of the license (e.g., CC-BY 4.0) should be included for each asset.

For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.

If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswithcode.com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset.

For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.

If this information is not available online, the authors are encouraged to reach out to the asset's creators.

13. New Assets

Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?

Answer: [Yes]

Justification: We present a detailed information about our new dataset in Appendix C.

Guidelines:

The answer NA means that the paper does not release new assets.

Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.

The paper should discuss whether and how consent was obtained from people whose asset is used.

At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.

14. Crowdsourcing and Research with Human Subjects

Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?

Answer: [NA]

Justification: Not applicable.

Guidelines:

The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.

Including this information in the supplemental material is fine, but if the main contribution of the paper involves human subjects, then as much detail as possible should be included in the main paper.

According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.

15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects

Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?

Answer: [NA]

Justification: Not applicable.

Guidelines:

The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.

Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.

We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.

For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.

Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper presents BiScope, a new algorithm for AI-generated text detection, that leverages logits from a tect expansion task to detect AI-generated text. The algorithm proceeds in three steps:\n\n1. Given a candidate input text T, break it into two segments (seg1, seg2, such that seg1 + seg2 = T). A \"text completion\" prompt is created where given <summary(T), seg1>, the goal is to predict seg2. The rationale for this is to give the detection algorithm full context awareness of the candidate input text.\n\n2. These completion prompts are passed through several open-source LLMs with seg2 tokens present in a teacher forcing manner. The logits are used as features for subsequent downstream classification.\n\n3. The features are used to train a binary classifier to detect AI-generated text.\n\nThe authors perform several experiments and ablations in their paper, and find that BiScope is effective and efficient compared to many baselines (including GPTZero).\n\nSTRENGTHS:\n1. The paper presents a novel algorithm for AI-generated text detection, a research area growing in importance due to the development of powerful LLMs. Utilizing bidirectional logit information to discriminate between LLM-generated and human-written text is an interesting idea, and the authors have done a good job figuring out the technical details for an effective implementation.\n\n2. The paper performs thorough experiments on five AI-generated text detection datasets, five popular commerical LLMs, and in both IID / OOD settings. The paper compares their method to both academic and commerical AI-generated text detectors, including GPTZero, a popular commerical software for AI-generated text detection. Additionally, the paper showcases the robustness of BiScope to paraphrasing attacks.\n\n3. The paper does some additional ablation studies on the choice of open source LLMs for step 2 above, an efficiency analysis, and the choice of classifier features.\n\nWEAKNESSES:\n1. The out of distribution (OOD) experiments in the paper are quite limited, which put the baselines at an unfair disadvantage. The authors experiment with two OOD settings (L280-290), making either the text domain OOD or the generative LLM, **but not both**. Hence, I don't think the OOD settings are fully OOD, I think this puts BiScope at an unfair advantage over all baselines, since many of them have not received any in-distribution training.\n\n2. The paper would be stronger with more baselines, ideally some watermarking methods too. I am curious to know how BiScope compares to newer methods like Binoculars [5], as well as text watermarking algorithms like KGW [1], EXP-Edit [2], SemStamp [3], or [4]?\n\n3. A few more ablation experiments would make the paper stronger. These were some additional questions I had: a) how much does the number of segments (`n`) in Section 3.5 matter? b) What is the performance like if a classifier is trained just on the feed-forward logits of the same open-source LLMs (using the same training data), without any completion prompts?\n\n[1] - https://arxiv.org/abs/2301.10226  \n[2] - https://arxiv.org/abs/2307.15593  \n[3] - https://arxiv.org/abs/2310.03991  \n[4] - https://arxiv.org/abs/2305.08883  \n[5] - https://arxiv.org/pdf/2401.12070\n\n---\n\n**After rebuttal**: Thank you for the response. I've raised my score to 5 due to extra baselines like Ghostbusters and Binoculars.\n\nQUESTIONS:\n1. AI-generated text detectors typically need to operate in a low FPR setting, to minimize the risks of labeling innocent text as AI-generated. Given this, what are the Table 1 true positive rates at a low FPR of say 0-1% (or equivalently, an AUC-ROC curve in that range)? TPR at low FPR ranges (0-1%) is a standard metric for evaluating AI-generated text detectors which has been used in many previous papers and blogs: https://arxiv.org/abs/2303.13408, https://openreview.net/pdf?id=DEJIDCmWOz, https://arxiv.org/pdf/2401.12070, https://foundation.mozilla.org/en/blog/who-wrote-that-evaluating-tools-to-detect-ai-generated-text/\n\n2. How in-distribution is the RADAR training data compared to the evaluation data used? Since RADAR was not retrained, I'm worried the baseline maybe put at an unfair disadvantage compared to BiScope.\n\n3. In Table 1, I'm a bit surprised that there's almost no drop in detection accuracy before/after paraphrasing for most baselines in the non-Essay settings (line 300-301). What is the reason for this? This seems in contradiction with findings in multiple prior works.\n\n4. In Table 2, there's a strong length bias in the two domains. Does that make the classification task easier than it would have been in a length-controlled setting (take first K tokens of AI-generated / human-generated text and classify them)?\n\nPresentation / nits:\n\n* Figure 4 is hard to read, could it be converted to a table?\n\n* Move the baselines description (L112-117) to a dedicated subsection / paragraph in Section 4.1\n\n* In Section 3.4, add the list of open-source LLMs used in main body\n\nLIMITATIONS:\nYes, adequately addressed", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 2, "DATE": "2024-07-05"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper describes work on detecting machine-generated texts using a proposed method called BiScope which exploits a model’s states by considering both the preceding token information and the next token information via an bi-directional cross-entropy loss calculation method. The proposed BiScope method does not make use of any additional finetuning and instead leverages on the calculated forward and backward cross-entropy losses as features for the binary classifier. The performance of said classifier can also be improved through the use of summaries. Results show that using BiScope with summaries outperform existing SOTA methods for AI text generators across aspects such as in and out-of-distribution results, intentional paraphrasing, and efficiency. Overall, I believe the study has the level of completeness, technical rigor, and impact required for a NeurIPS paper.\n\nSTRENGTHS:\nThe paper is well-written, easy to follow, and has the level of completeness required for NeurIPS. The proposed bi-directional calculation of losses which the authors hypothesized to contain information preceding token and next token has been properly motivated with a clear research framing. The proposed method has also been extensively and rigorously compared with a number of SOTA baselines, a large compiled multi-domain dataset, and was able to prove its superiority over previous approaches.\n\nWEAKNESSES:\nI do not see any strong cases of technical issues. However, some points can be considered to improve the overall quality of the work and support the realistic application of the method:\n\nIt might be best to further emphasize what specific additions or changes were made to the compiled existing dataset (Arxiv, Yelp, code, etc) in the main paper and possibly name this. Moreover, you should also provide immediate details about the datasets used particularly on the length (whether they are essay-length, paragraph-length, etc), language coverage, as well as register or domain.\n\nTo strengthen the contribution of the study, I strongly suggest the authors to do the same experiment as done by Tulchinskii et al (https://proceedings.neurips.cc/paper_files/paper/2023/hash/7baa48bc166aa2013d78cbdc15010530-Abstract-Conference.html) and on evaluating the limitation of the proposed BiScope method in detecting whether non-native written texts are falsely identified as machine-generated. If BiScope is still able to clearly differentiate non-native written texts from machine-generated texts, then this is an advantage for the authors. Moreover, this particular advantage may also give another favorable reason to use the model other than its performance.\n\nQUESTIONS:\n1. Is there a limit or a threshold for the number of approximator models as described in Step 2 for calculating the bi-directional cross-entropy losses? Moreover, is there a criteria for the selection of these models to ensure the converged values of the losses are met? Can users just go for open models? I think this part is not much discussed/clarified.\n2. Is the combination of FCE and BCE statistically significant over using just one of them? The values presented in Table 4 seem to be very close with each other particularly on text-based datasets.\n3. Following #1, is there a particular model or combination of models that gives the best approximation of FCE and BCE loss values and particular text split combination for classification? Future researchers may want to only test with the best setup combinations for comparing SOTA or baselines.\n\nLIMITATIONS:\nThe paper can benefit from a much clearer discussion of limitations of the work, particular as it has not emphasized aspects such as language and ability of the proposed method to be robust on non-native speaker written texts as already explored by previous works (see cited work above).", "TITLE": "Official Review", "RECOMMENDATION": 7, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 4, "DATE": "2024-07-09"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes extracting various features from predictive distributions of surrogate LLMs to detect LLM-generated text. Relative to prior work, the main novelty appears to be the use of bi-directional cross-entropy losses to extract features. These features are then fed into a traditional supervised classifier to make predictions, which is estimated on a labelled dataset of human and machine-written text. Evaluations on a new dataset (expanded version of existing datasets) shows that the method is competitive with some prior approaches.\n\nSTRENGTHS:\n* The paper tackles an important problem: automatic detection of LLM-written text.\n\n* The paper contributes datasets that cover several state-of-the-art LLMs and multiple domains, including code.\n\n* The paper includes some results for the more realistic out-of-distribution condition, where novel LLMs / genres are introduced at test time relative to the training data. The approach appears to be quite robust to new LLMs, in some genres.\n\n* The approach appears to be quite robust to paraphrased text.\n\nWEAKNESSES:\n* There are some missing comparisons, e.g. https://arxiv.org/abs/2401.12070.\n\n* The performance in the most important setting (OOD) is mixed.\n\n* The presentation is somewhat confusing. For example, it’s unclear from what exposition (e.g., Figure 3) which steps occur at training time and which steps occur at test time.\n\n* The proposed approach amounts to a supervised binary classifier. However, the obvious baseline (fine-tuned BERT) is not included in the comparisons, even though this approach (“OpenAI classifier”) is prominent and discussed in related work. Why not?\n\n* Important details are not included in the main text. For example, for the cross-model evaluation, which models are trained on and which models are held-out? Hopefully, the latest LLMs are held-out and previous generation LLMs (e.g., GPT-2) are used for training.\n\n* Why is F1 used as the metric? Usually, in detection scenarios we are interested in detection accuracy while maintaining a low false alarm rate, which suggests using ROC-based metrics, e.g. AUC restricted to the low false alarm region.\n\n* The bold-underlines in Table 1 seem a bit random. For example, there are cases where two identical values occur in the same column but both are not bolded (0.9955). Ideally, these would represent statistical tests of which relative improvements are significant.\n\n* The discussion of limitations is completely lacking. For example, it seems like the proposed approach requires evaluating multiple LLMs in parallel. Also, I’m unclear on why there is not an evaluation setting in which both data and model shift occurs, relative to the training data.\n\nQUESTIONS:\nSee \"Weaknesses\"\n\nLIMITATIONS:\nNo; see \"Weaknesses\"", "TITLE": "Official Review", "RECOMMENDATION": 7, "REVIEWER_CONFIDENCE": 5, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2024-07-13"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper develops an AI-generated text detection method called BiScope. The key idea is to formulate the detection task as a guided text completion task. The generated text and the original text are used to calculate two types of cross-entropy losses, which are used to extract features for classification.\n\nSTRENGTHS:\n- (S1) The idea of taking the preceding token account for AI-generated text detection is interesting.\n- (S2) The paper is well-written and easy to follow.\n\nWEAKNESSES:\n- (W1) The feature extraction is computationally expensive, as it needs to run inference at least twice with LLMs for summary generation and text completion. It’s not clear if the feature extraction cost is worth for the improvements. (Similar to the comment below).\n- (W2) Missing references and comparisons, especially against the following methods. Among them, [Ref 2] should be a solid baseline method for the classification-based approach.\n[Ref 4] is recent work and is optional to compare but reports that simply using n-gram and POS features would be sufficient to detect machine-generated text and thus interesting to compare as a baseline.\n    - [Ref1] OUTFOX: LLM-Generated Essay Detection Through In-Context Learning with Adversarially Generated Examples https://arxiv.org/abs/2307.11729\n    - [Ref 2] Ghostbuster: Detecting Text Ghostwritten by Large Language Models https://arxiv.org/abs/2305.15047\n    - [Ref 3] Smaller Language Models are Better Zero-shot Machine-Generated Text Detectors https://aclanthology.org/2024.eacl-short.25.pdf\n    - [Ref 4] Your Large Language Models Are Leaving Fingerprints https://arxiv.org/abs/2405.14057\n\nQUESTIONS:\nPlease respond to the weaknesses raised above.\n\nLIMITATIONS:\nI believe it’s important to mention the computational cost in the body text as a limitation.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2024-07-14"}