Title: OSTAR: Optimized Statistical Text-classifier with Adversarial Resistance
Venue: NeurIPS 2025
Accepted: yes
Keywords: MGT detection、Adversarial Robustness、Contrastive Learning
Abstract: The advancements in generative models and the real-world attack of machine-generated text(MGT) create a demand for more robust detection methods. 
 The existing MGT detection methods for adversarial environments primarily consist of manually designed statistical-based methods and fine-tuned classifier-based approaches. 
 Statistical-based methods extract intrinsic features but suffer from rigid decision boundaries vulnerable to adaptive attacks, while fine-tuned classifiers achieve outstanding performance at the cost of overfitting to superficial textual feature.
 We argue that the key to detection in current adversarial environments lies in how to extract intrinsic invariant features and ensure that the classifier possesses dynamic adaptability.
 In that case,  we propose OSTAR, a novel MGT detection framework designed for adversarial environments which composed of a statistical  enhanced classifier and a Multi-Faceted Contrastive Learning(MFCL).
  In the  classifier aspect, our Multi-Dimensional Statistical Profiling (MDSP) module  extracts intrinsic difference between human and machine texts, complementing classifiers with useful stable features. 
  In the model optimization aspect, the MFCL strategy enhances robustness by contrasting feature variations before and after text attacks, jointly optimizing statistical feature mapping and baseline pre-trained models. 
  Experimental results on three public datasets under various adversarial scenarios demonstrate that our framework outperforms existing MGT detection methods, achieving state-of-the-art performance and robust against attacks.The code is available at https://github.com/BUPT-SN/OSTAR.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper introduces a novel method for detecting machine-generated text in adversarial settings. It combines statistical feature extraction with a neural classifier by integrating a multi-dimensional profiling module and a contrastive learning objective tailored to different types of text attacks. The approach is evaluated on several benchmarks and shows improved robustness and overall performance compared to prior methods.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n1. The proposed framework introduces a well-motivated combination of statistical profiling (MDSP) and task-specific contrastive learning (MFCL). This hybrid approach is original and effectively addresses the limitations of both traditional statistical detectors and purely classifier-based models under adversarial settings.\n2. The experiments are comprehensive. The proposed method achieves state-of-the-art results across multiple datasets.The ablation studies and detailed breakdown of results provide convincing evidence for the effectiveness of each component.\n3. The paper is clearly written and well-structured. The methodology is described in sufficient detail, including algorithmic steps, training procedures, and statistical feature definitions, making it easy to follow and likely straightforward to reproduce.\n\nWeaknesses:\n1. While the paper evaluates both perturbation and paraphrase-based attacks, the set of perturbation techniques is relatively narrow and mainly consists of syntactic or lexical-level changes. More advanced or semantic-preserving adversarial strategies (e.g., many word-level adversarial attacks) are not considered, which may limit the generalizability of the findings.\n2. The statistical features used are manually defined and fixed. It remains unclear whether these choices are optimal or how sensitive the model is to variations or additional feature dimensions.\n\nQUESTIONS:\nThe MDSP relies on manually designed features. Could the authors comment on whether other linguistic metrics were considered, or whether data-driven selection could further enhance performance?\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "CLARITY": 4, "IMPACT": 4, "ORIGINALITY": 4, "DATE": "2025-06-26"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes the OSTAR framework to enhance robustness in MGT detection within adversarial environments.  By designing statistically enhanced classifier with Multi-Faceted Contrastive Learning , addressing limitations of existing methods. Experiments demonstrate OSTAR's performance and robustness.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths\n1. The motivation of this work is clear: addressing the vulnerability of existing MGT detection methods in adversarial environments.\n2. Theoretical innovation: categorizing attacks based on whether they affect their originating sources, thereby effectively enhancing the response capability of contrastive learning against attacks.\n3. Novel Framework: OSTAR innovatively designs a statistically enhanced classifier and Multi-Faceted Contrastive Learning, resolving limitations of rigid decision boundaries in statistical methods and overfitting in classifier-based approaches under adversarial environments.\n4. Comprehensive Experiments: This paper evaluate the performance of OSTAR on three public datasets with seven baselines under nine attack scenarios. Special experiments are used to verify the statistical feature distinguishability and the attack impact of statistical feature.\n5. Clear structure: The structure is well organized with well-defined figures and tables, making it easy for readers to follow.\n\nWeaknesses:\n1. The limitations section notes the model’s non-robustness against multi-attack scenarios and compromised MDSP extraction capability with short texts, without proposing potential solutions.\n2. The text only provides the types of attacks, but the intensity of the attacks is not given, and the description of the adversarial environment is insufficient.\n3. Although this contrastive learning can enhance model performance, it substantially increases computational consumption. The paper does not provide relevant data or solutions for this issue.\n\nQUESTIONS:\n1. Are there any possible solutions or ideas for addressing the issues of multiple attacks and the short text problem mentioned in the limitation section?\n2. Can you provide more tables to present the concrete metrics of each attack's intensity and impact, making the attacks more explicit?\n3. Can you provide a comparison of the increased training time when using contrastive learning strategies?\n4. During training, the authors balanced the quantity of human-generated text and machine-generated text. If the ratio between these two becomes imbalanced, how would that impact the model’s performance?\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 5, "CLARITY": 4, "IMPACT": 3, "ORIGINALITY": 4, "DATE": "2025-06-27"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper states that the key of machine-generated text detection lies in how to extract intrinsic invariant features and ensure the dynamic adaptability of the classifier. Thus, it proposes OSTAR to solve the problem. The experiment results shows its effectiveness in three datasets.\n\nSTRENGTHS AND WEAKNESSES:\nThis paper is well organized, and the proposed method is well detailed. The authors evaluate several novel methods on three representative datasets, which provides a comprehensive view of the methods efficacy.\n\nThe author states that the key of MGT detection lies in how to extract instrinsic invariant features and ensure the dynamic adaptability of the classifier. It also claims that \"classification methods tend to capture superficial correlation patterns rather than the intrinsic differences in training data\". I think \"capturing superficial correlation patterns in training data\" is actually a common property of deep learning methods, and the design of a validation set is exactly to address the problem&mdash;proving that the method are not just overfitting the training data, but also learning some \"intrinsic\" properties so that it can perform well on the test set.\n\nIf the author claim that the proposed method captures the intrinsic patterns of MGT, I would expect to see an explicit design in the proposed framework, or some experimental analysis to support the claim. I think the three dimension features used in the MDSP component (syntactic, lexical, semantic) or the two types of contrast learning in MFCL (para-contrast, pert-contrast) might not be so explicit in solving the \"intrinsic\" problem, and the existing experiment might not provide a strong provement to support the statement. I think the performance of existing methods is already high enough on the three datasets, so simply improving the metrics further may not bring significant benefits to the community.\n\nBesides, I think Fugure 1 may not by a good teaser figure to introduce the task and the proposed method to the reader. Line 25 claims that \"As shown in Figure 1(a), in real-world scenarios, MGT texts are often attacked to evade detection\". But the Figure 1(a) literally doesn't show that MGTs are often attacked, it just presents an attack flowchart. And Figure 1(b) lists two old types of pipelines, along with the proposed method. However, it doesn't clearly shows the difference, or the key modification, that distinguish the proposed methods from the others.\n\n\nAdditionally, I think the paper need a proofread to correct typos in the script:\n\n* Table 3 highlights the performance of OSTAR, but OSTAR (Feature Extract+Analysis) has a higher performance. \n* Line 25-26 \"MGT texts\" is duplicated.\n* Line 181 The sentence ends with a comma.\n* Line 216 \"e.g.news, reviews...\" is missing a comma.\n* Line 224 \"Evaluation Metric\" -> \"Evaluation Metrics\"\n* Whether there sould be a space before a left parenthesis (in many places) and an em dash (Line 225) should be consistent thoughout the paper.\n\nMoreover, the code is not submitted with the manuscript, instead it will be publicly available upon publication. But the author claims \"Yes\" in the paper checklist that the paper provides open access to the data and the code. I'm not sure if it's proper.\n\nQUESTIONS:\nAccording to the strengths and weaknesses part, I'd like to learn more about how the proposed method solves the intrinsic feature capturing problem.\n\nLIMITATIONS:\nYes.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 2, "ORIGINALITY": 3, "DATE": "2025-07-03"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper introduces OSTAR, a novel framework designed to detect machine-generated text (MGT) with enhanced robustness against adversarial attacks. It introduces Multi-Dimensional Statistical Profiling to capture invariant patterns and Multi-Faceted Contrastive Learning to handle adversarial attacks. The MDSP captures invariant patterns across scenarios, while attack-specific contrastive learning mitigates adversarial effects. Evaluations on three datasets show state-of-the-art performance with enhanced accuracy and robustness.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths\n1. The paper combines Multi-Dimensional Statistical Profiling (MDSP) with classifier-based methods, improving robustness in detecting machine-generated text under adversarial attacks.\n2. The structure is clear and well-organized, with detailed technical descriptions, pseudocode, that enhance readability and reproducibility.\n3. Extensive experiments on three datasets show strong performance, achieving high accuracy and robustness against various adversarial attacks.\n\nWeaknesses\n1. The paper lacks an experimental analysis of hyperparameters and a detailed representation of implementation details, such as attack impact ratio, regularization coefficient, etc.\n2. The relationship between L_Para and L_Pert needs clearer intuition.\n3. While MFCL's categorization is novel, using contrastive learning for robustness itself builds on prior work.\n\nThe paper has some minor problems. \n- There are many places in the paper where spaces are missing, such as “text(MGT)” and “Learning(MFCL)” in the abstract. \n- There are some grammar problems in the paper, such as “an overview the framework of OSTAR” in line 119.\n\nQUESTIONS:\n1. Which of the 3 MDSP dimensions (syntax/lexical/semantic) contributes most to robustness? Are all 4-D features (μ, σ, ρ, R) necessary?\n2. How does OSTAR perform against unseen attack combinations (e.g., perturbation + paraphrase) or sophisticated adversarial attacks beyond the 9 pre-defined perturbations?\n3. Is it possible to use LLM for machine-generated text detection and how effective is it?\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-03"}