Title: Advancing Machine-Generated Text Detection from an Easy to Hard Supervision Perspective
Venue: NeurIPS 2025
Accepted: yes
Keywords: Machine-Generated Text Detection

Simple-to-Hard Supervision

Large Language Model
Abstract: Existing machine-generated text (MGT) detection methods implicitly assume labels as the "golden standard". However, we reveal boundary ambiguity in MGT detection, implying that traditional training paradigms are inexact. Moreover, limitations of human cognition and the superintelligence of detectors make inexact learning widespread and inevitable. To this end, we propose an easy-to-hard enhancement framework to provide reliable supervision under such inexact conditions. Distinct from knowledge distillation, our framework employs an easy supervisor targeting relatively simple longer-text detection tasks (despite weaker capabilities), to enhance the more challenging target detector. Firstly, longer texts targeted by supervisors theoretically alleviate the impact of inexact labels, laying the foundation for reliable supervision. Secondly, by structurally incorporating the detector into the supervisor, we theoretically model the supervisor as a lower performance bound for the detector. Thus, optimizing the supervisor indirectly optimizes the detector, ultimately approximating the underlying "golden" labels. Extensive experiments across diverse practical scenarios, including cross-LLM, cross-domain, mixed text, and paraphrase attacks, demonstrate the framework's significant detection effectiveness. The code is available at: \url{https://github.com/tmlr-group/Easy2Hard}.

Advancing Machine-Generated Text Detection from an Easy to Hard Supervision Perspective

Abstract

Existing machine-generated text (MGT) detection methods implicitly assume labels as the "golden standard". However, we reveal boundary ambiguity in MGT detection, implying that traditional training paradigms are inexact. Moreover, limitations of human cognition and the superintelligence of detectors make inexact learning widespread and inevitable. To this end, we propose an easy-to-hard enhancement framework to provide reliable supervision under such inexact conditions. Distinct from knowledge distillation, our framework employs an easy supervisor targeting relatively simple longer-text detection tasks (despite weaker capabilities), to enhance the more challenging target detector. Firstly, longer texts targeted by supervisors theoretically alleviate the impact of inexact labels, laying the foundation for reliable supervision. Secondly, by structurally incorporating the detector into the supervisor, we theoretically model the supervisor as a lower performance bound for the detector. Thus, optimizing the supervisor indirectly optimizes the detector, ultimately approximating the underlying "golden" labels. Extensive experiments across diverse practical scenarios, including cross-LLM, cross-domain, mixed text, and paraphrase attacks, demonstrate the framework's significant detection effectiveness. The code is available at: https://github.com/tmlr-group/Easy2Hard .

1 Introduction

High-quality machine-generated text (MGT) is increasingly prominent due to its potential in areas like content creation [1], intelligent education [2], and customer service [3]. However, its misuse presents significant challenges, including misinformation [4], phishing attacks [5], and malicious impersonation [6]. Compounding this is research [7] indicating humans struggle to distinguish MGT from human-generated text (HGT), performing little better than random chance. This tension between MGT's risks and limited human detection highlights the urgent need for effective detection methods.

Existing detection methods can be primarily divided into: (1) metric-based methods, which detect differences by capturing the intrinsic statistical properties between MGTs and HGTs, using statistics such as Likelihood [8] and Entropy [9, 10]. In addition, a series of works represented by DetectGPT [11], Fast-DetectGPT [12], and DALD [13] utilize the probability curvature of text under LLMs as key detection features. (2) Model-based methods do not rely on explicit feature engineering. They input the full text into deep learning models, which automatically learn and extract discriminative implicit features end-to-end. This category includes energy-based models [14], GNN-based model [15], LLM [16], and other methods such as SeqXGPT [17], AI-Catcher [18], and RADAR [19]. With the powerful text representation learning capabilities of deep learning models, model-based methods typically demonstrate higher effectiveness in terms of detection performance and robustness.

0

2

4

6

8

10

12

14

x

0.0

2.5

5.0

7.5

10.0

12.5

15.0

y

Label

Human

Machine

0.0

0.2

0.4

0.6

0.8

1.0

Probability

0

50

100

150

200

250

300

350

Count

Label

Human

Machine

5

0

5

10

x

2.5

0.0

2.5

5.0

7.5

10.0

12.5

y

Label

Machine

Human

0.0

0.2

0.4

0.6

0.8

1.0

Probability

0

50

100

150

200

250

300

350

Count

Label

Human

Machine

(a) ChatGPT Text

(b) Mixed ChatGPT Text

0.0

0.1

0.2

0.3

0.4

0.5

0.6

0.7

TPR@FPR-1%

ChatGPT

PaLM

detector

Hard

Soft

0.64

0.72

0.80

0.88

0.96

AUROC

ChatGPT

PaLM

detector

Hard

Soft

0.0

0.1

0.2

0.3

0.4

0.5

0.6

TPR@FPR-1%

ChatGPT

PaLM

detector

Hard

Soft

0.64

0.72

0.80

0.88

0.96

AUROC

ChatGPT

PaLM

Detector

Hard

Soft

(b) Claude T ext Training

The aforementioned methods often implicitly rely on the assumption of perfect data labels; however, this may not hold in MGT detection. Specifically, considering the prevalence of human-machine collaboration scenarios [21] and the powerful generative capabilities of LLMs, MGTs may explicitly or implicitly resemble HGTs, leading to blurred boundaries. For instance, MGTs and HGTs overlap significantly in the latent space, especially in mixed texts, as shown in Fig. 1-1 and 1-3. Besides, Fig. 1-2 and 1-4 show that HGT prediction probabilities concentrate near 0 (0 indicates HGT, while 1 indicates MGT) while MGTs with human-like features exhibit a broad distribution across [0 , 1] , reinforcing their boundary ambiguity. To further validate the inexactness of hard labels, we trained a detector on mixed texts (1/4 MGT replaced with HGT) using label smoothing [22] (with a small smoothing factor of 0.05). Notably, even though we cannot access the underlying "golden" labels, the soft label with a small smoothing factor is closer to the golden labels than hard labels in significant mixed texts. As shown in Fig. 2, the results clearly indicate that a higher upper bound for label smoothing means it has the potential for enhancement. These results collectively indicate that the existing learning paradigm is inexact. See Appendix D.5 for more details and results.

Despite this clear insight, resolving the issue is challenging. MGT detection task surpasses human cognition, rendering inexact label annotation widespread. Furthermore, existing MGT detectors are often more capable than humans, making it difficult to reliably assess the detection quality, i.e., the supervisor may be weaker than the detector, rendering inexact supervision inevitable. In summary, unlike the limited accidental errors in noisy label learning, the fundamental difficulty in annotation and evaluation makes inexact supervision widespread and inevitable. This leads us to ask:

Is it possible to effectively learn from the supervisor when the provided label is inexact and the detection quality is difficult to assess?

Our work is dedicated to exploring this question. To achieve this, some key issues need to be solved:

RQ1 . How can the supervisor provide more reliable supervision signals under inexact labels and unclear detection quality?

RQ2 . How can the detector be improved based on the feedback signals provided by supervisors?

To address this, we propose an easy-to-hard supervision framework to enhance detection. Its core idea is to utilize a carefully designed supervisor, focused on the relatively easier task of longertext detection, to provide reliable feedback signals for guiding a more challenging target detector. To ensure the supervisor's reliable supervision signals, we meticulously consider its data quality improvement and structure design ( RQ1 ). Firstly, we construct longer texts as supervisor data, which can theoretically alleviate the impact of inexact labels, laying the foundation for reliable supervision. Secondly, we deviate from traditional approaches that rely on soft labels to provide supervision

signals, because it is unclear whether the soft label is more informative under unclear detection quality. Instead, we structurally integrate the detector into the supervisor's design, establishing a connection between the supervisor and the detector, where the supervisor's performance serves as a lower bound for the detector's capabilities. This coupled structure allows the detector to be indirectly optimized via the supervisor ( RQ2 ), finally encouraging convergence to the underlying "golden" labels. Our contributions can be summarized as follows:

We analyze the inexact supervision inherent in existing MGT detection methods and highlight this widespread and inevitable limitation as a critical direction for future research.

We propose an easy-to-hard supervision framework for enhanced detection, theoretically proving its optimization properties that facilitate convergence towards the underlying "golden" labels.

We demonstrate the effectiveness of the proposed framework with negligible latency in various practical scenarios, including cross-LLM, cross-domain, mixed text, and paraphrasing attacks.

2 MGTDetection from an Inexact Supervision Perspective

Traditional Learning Paradigm of MGT Detection . Let S denote the set of all possible text sequences, and Y = { 0 , 1 } denote the hard-label space, where 0 represents HGT and 1 represents MGT. Each sequence s ∈ S can be understood as multiple dependent sentences. Then, the dataset can be represented as D = { ( x i , y i ) } N i =1 , where x i ∈ S n i is a text composed of n i sequences from S , and y i ∈ Y is its corresponding hard label. This definition understands texts as a collection of multiple sequences, similar to the definition in the existing work [23] 2 . For the detector f parameterized by θ f , the learning paradigm uses the cross-entropy loss, which is usually as follows,

Inexact Supervision Learning of MGT Detection . In the above learning paradigm, it is implicitly assumed that the label y i is "golden standard"; however, this may not hold in MGT detection.

First, the boundary between MGT and HGT is often unclear, leading to potentially inexact hard labels. This blurred distinction stems from (1) human-machine collaboration [24, 25], where texts involve both human and machine contributions (e.g., LLM drafting followed by human editing); (2) the powerful generative capabilities of LLMs, where they trained on extensive human data are capable of producing highly human-like texts, especially for specific text types like short texts [26]. Therefore, MGTs may (explicitly or implicitly) contain human-like features, rendering hard labels inexact. This is also confirmed by the empirical results (Fig. 1 and Fig. 2) shown in the Introduction above, and more results can be found in Appendix D.5.

An intuitive solution like knowledge distillation [27] faces a key challenge: its effectiveness mainly relies on the target model being weaker than the strong teacher model. This is difficult for MGT detection because human cognition in distinguishing MGT is limited (e.g., [7] reports that human accuracy for GPT-3 texts is 49.9%). Besides, current MGT detectors show super intelligence and are even smarter than humans (e.g., RADAR achieves 87.3% of accuracy on Essay), making it even difficult to distinguish the quality of two predictions. For example, it is unclear whether 90% or 95% confidence is better for an MGT. Therefore, in MGT detection, the supervisor may be weak, and even picking a strong teacher model is challenging.

Noisy label learning (NLL) [28, 29] is another consideration, but its classic assumption is that there exist true, clearly discrete labels with only a limited random error occurring during the annotation process. Instead, in MGT detection, as emphasized above, limitations of human cognition in distinguishing MGT lead to widespread and complex inexactnesses in labeling (with correct categories), rather than limited random errors. Consequently, existing NLL techniques may require significant redefinition to accommodate this structure of inexact labels. See Appendix A.4 for more discussion.

In summary, due to human cognition's limitations and detectors' superintelligence, inexact supervision learning in MGT detection becomes widespread and inevitable. Therefore, this paper focuses on designing effective supervised learning algorithms under conditions where labels are generally inexact and detectors are difficult to evaluate reliably.

Dataset

HGT:

The

set

over

the

horizon,

painting

the

sky

in

hues of orange and pink.

HGT:

She opened the old book,

its pages whispering stories of

forgotten adventures.

HGT:

The sun set over the horizon, painting

the sky in hues of orange and pink.

MGT:

As

the

clock

struck

midnight,

she

made a wish upon the first falling star.

HGT:

She opened the old book, its pages

whispering stories of forgotten adventures.

Detection

model

MGT:

As

the

clock

struck

midnight,

she

made

a

wish

upon the first falling star.

MGT:

His

laughter

echoed

through

the

hallway,

bringing

warmth to a cold winter's day.

Target

Detector

……

Supervisor

Machine-generated texts

……

Human-generated texts

or

Longer Text Detector

NN

Detection

model

HGT 1

HGT

𝒎

MGT 1

MGT

𝒎

Longer HGT

Longer MGT

……

……

Long text

Construction

HGT

𝟏

HGT

𝒎

……

split

gumbel

softmax

Reliable

feedback

Annotation

MGT

HGT

Target

detector

Supervisor's

additional

network

Self

Sampling

⨀

3 Easy to Hard Supervision Enhancement Framework

To effectively learn from the inexact supervision lens, a supervisor capable of providing reliable supervision signals and a detector capable of continuous learning from this feedback are essential. To this end, we propose an easy-to-hard supervision enhancement framework, as shown in Fig. 3. It includes two key components: an "easy" supervisor, carefully designed for the simpler task of longer-text detection, and a "hard" target detector for the more challenging MGT detection. Briefly, the supervisor is carefully designed from both data and architecture aspects to provide more reliable feedback signals to the detector, while the detector continuously improves by integrating this feedback with its original learning paradigm. We will detail how they are designed to achieve this subsequently.

3.1 Supervisor: Providing Reliable Supervision Signals

In MGT detection, given the inexact labels and difficulty in reliably evaluating detection quality, the supervisor must provide as reliable supervision signals as possible. To achieve this crucial goal, our approach focuses on two key aspects: improving the supervisor's training data quality and designing its model architecture.

Data Quality Improvement . A supervisor's ability to provide reliable supervision is closely linked to its own performance; thus, effective supervisor learning is a fundamental prerequisite for achieving reliable supervision. Recognizing the inherent imprecision in training data, improving its training data quality is a natural and feasible method. Drawing upon existing research [23], which indicates a positive correlation between text length and MGT detection and implies that longer texts are easier to detect accurately, we focus the supervisor on detecting longer texts by constructing new longer text as its input data.

Specifically, let the longer text-label pair be denoted as ( x long , y long ) , then its generation rule is: first sample y long ∼ Y , and then the corresponding longer text x long is constructed as follows:

Here, ⊕ denotes the text splicing operator. The rationale behind this splicing operation is that joining MGTs or HGTs does not alter their fundamental nature as machine-generated or human-written text, respectively. The following theorem will prove this design's rationality by revealing the relationship between the distribution difference and the length of the text.

Theorem 3.1 ( Distribution Difference for Longer Text ) . Let h ( s ) and m ( s ) be the distributions for human-generated and machine-generated sequences on s ∈ S , respectively, with the total variation distance TV ( m,h ) = δ > 0 . For the text contains n sequences, let α ≥ 0 denote the ratio of human-like component incorporated in MGT. For longer text formed by concatenating k independent lengthn texts, the total variation distance between their distributions, TV long can be bounded by:

The theorem indicates that increasing text number k (original k = 1 ) for longer text will amplify the distribution difference TV long between HGT and MGT. This leads to clearer classification boundaries

and reduced hard label ambiguity. Training supervisors with this more discriminative data is crucial for achieving its better performance and providing reliable supervision. Furthermore, a larger mixed text ratio α tends to a smaller distribution distance, theoretically supporting the conjecture in Section 2 regarding unclear boundaries due to (explicit or implicit) mixed text presence.

Reliable Feedback . Under the reliable learning of the supervisor, the core issue lies in providing reliable supervision signals to the target detector. An intuitive approach is to mimic knowledge distillation by directly using the supervisor's soft labels as supervision. However, this faces challenges in MGT detection. First, the detector's superintelligence makes it unclear if the supervisor's soft labels offer superior information. Second, while the supervisor also performs detection tasks, it focuses on longer texts with different distribution characteristics; these domain differences make ensuring soft label quality challenging when used for more difficult target detection.

Therefore, instead of directly providing soft label supervision, we cleverly integrate the target detector into the supervisor's design. To achieve this, we reveal the theoretical upper bound of the supervisor's performance, and link factors influencing it to the detector's performance. This link allows the supervisor's performance to be viewed as a theoretical lower bound for the detector's capability. Thus, maximizing supervisor performance indirectly enhances detector performance. Specifically,

Theorem 3.2 ( Detection Power for Longer Text ) . Under the assumption of Theorem 3.1, the supervisor's AUROC supv. satisfies

The theorem reveals that the supervisor's performance is the lower bound of 1 -1 2 · (1 -δ ) 2 nk (1 -α ) . If k is an optimizable variable positively correlated with detector performance, then optimizing the supervisor favors larger k , thereby indirectly enhancing detector performance.

In the framework, k represents the number of original texts x ( j ) concatenated to form the longer text for the supervisor, while the detector is aimed at identifying each original text x ( j ) . To establish a positive correlation between k and the detector's performance (i.e., better detector performance corresponds to a larger k ), we revisit the detector as a gating mechanism acting on each original text x ( j ) within the supervisor's input: If the detector misclassfies text x ( j ) , that it is filtered out, reducing the concatenation length k . In this way, a larger value of k corresponds to higher accuracy. When k reaches its maximum value (no filtering), the detector achieves an accuracy of 100%. Formally, we change supervisor's input from x long in Eq. 1 to

Here, the element-wise multiplication ⊙ is performed at the input embedding level. To ensure the supervisor's feedback could be back-propagated to the detector, we use Gumbel Softmax [30] to replace discrete argmax. Further, we simplify the y i = 0 branch and simplify Eq. 2 to

i.e., let HGT distribution h ( s ) collapse to Dirac δ 0 distribution [31], which has following benefits. Theorem 3.3 ( Distribution Difference after HGT Distribution Collapse ) . Under the assumption of Theorem 3.1 and assuming that m (0) → 0 3 , then if h ( s ) collapses to a Dirac δ 0 distribution, we have lim m (0) → 0 TV ( h, m ) = 1 .

This theorem indicates that this simplification maximizes the distribution distance between MGT and HGT. Similar to data quality improvement, this reduces the learning difficulty for the supervisor.

In summary, the supervisor g parameterized by θ g makes predictions for the long text x long as g ( x ′ long , θ g ) , where x ′ long is calculated by Eq. 3. Assuming that the longer text dataset is D long , the supervisor's training loss L supv. using cross entropy is as follows,

Theorem 3.4 ( The Effectiveness of the Proposed Framework ) . Under the assumption of Theorem 3.1, and assuming that the MGT's golden label is approximately the proportion of pure machinegenerated content distinct from HGT, if the supervisor reaches the best possible one, the detector converges to the underlying golden labels.

See Appendix A.5 for the discussion of the rationality of this golden label approximation. Unlike traditional methods that merely fit binary hard labels, this theorem reveals how the supervisor guides the detector towards convergence with more accurate underlying "golden" labels.

3.2 Detector: Learning from Reliable Signals

The detector is the target optimization model, which will improve itself by learning category information from hard labels and feedback from the supervisor. First, as an enhancement framework, we do not alter the original detector's structure and training paradigm, thus ensuring flexible extensibility and convenient application to various detectors. Therefore, the first loss is the original detector loss L ori , and the specific form depends on the implementation of the detector. Secondly, the design of the supervisor is closely linked to the detector, allowing it to indirectly optimize the detector, thus the second loss is supervisor loss L supv. shown in Eq. 4. In summary, we jointly train the supervisor and the detector, and the overall optimization objective with a coefficient λ is as follows:

The target detector f is trained only on the original, natural text, which allows it to learn the true data distribution. Instead, the concatenated text is used only to train the supervisor g . This intentional separation ensures the distribution shift (natural text vs. longer text) does not compromise the target detector's performance.

3.3 Overall Framework

Alg. 1 outlines the proposed framework's process. For each training batch, the supervisor's training data, a longer text set D ′ B , is first constructed based on the current batch data D B (Line 4). Then, the original detector loss L ori. (Line 5) and the supervisor's loss L supv. (Line 6) are computed based on D B and D ′ B , respectively. Finally, joint training is performed for the detector and supervisor (Line 7).

Notably, supervisor data is constructed from the current batch D B rather than the dataset D . This design enables the reuse of f ( x ( j ) , θ f ) , rendering the computational delay for x ′′ in Eq. 4 negligible. The main training delay stems from the

Algorithm 1 Easy to Hard Supervision Framework

1: Input: Train data D = { ( x i , y i ) } N i =1 , the detector f ( x, θ f ) , the supervisor g ( x ′ long , θ g ) , training epochs T , learning rate η .

2: for t = 0 to T -1 do

3: for each batch of samples D B ∼ D do

4: Based on the texts of D B , Construct N ′ longer texts by Eq. 1, denoted as D ′ B .

5: Calculate detector's original loss L ori. .

6: Calculate supervisor's loss L supv. by Eq. 4.

7: Jointly optimize θ g and θ g by Eq. 5.

8: end for

9: end for

10: Return the trained detector f ( x, θ f ) .

supervisor's forward and backward passes. Fortunately, by comprehensively considering performance and efficiency (see Appendix D.4), the supervisor uses a simple network (e.g., the three-layer fully connected network in our work) to achieve good supervision, resulting in computational costs trivial compared to the detector's typically complex pre-trained model. Therefore, the proposed framework introduces only minimal training latency, and the detector's inference time remains unchanged due to its unmodified nature. See Appendix A for more discussion of the proposed framework.

4 Experiments

Datasets and LLMs . We conduct experiments on two public datasets, Essay [16] and DetectRL [32], to validate our effectiveness. The Essay dataset comprises MGTs generated by GPT4All, ChatGPT,

ChatGPT-turbo, ChatGLM, Dolly, and Claude. The DetectRL dataset includes MGTs from PaLM, ChatGPT, Claude, and Llama-2. Furthermore, the DetectRL dataset contains mixed text, paraphrase attack text, and cross-domain text to simulate and evaluate the detection performance in various complex real-world scenarios. Please refer to Appendix D.1 for detailed descriptions of these datasets and Appendix D.4 for the implementation details of the experiments.

Baselines . We selected the following representative baselines, including: (1) metric-based methods: Likelihood [8], Log-Rank [11], Entropy [9], NPR [33], DetectGPT [11], and Fast-DetectGPT (FastGPT) [34]; (2) model-based methods: ChatGPT-D [20], RADAR [19], and MPU [35]. Notably, the proposed enhancement framework can be easily applied to model-based methods, and we denote the enhanced versions using the proposed framework as ChatGPT-E, RADAR-E, and MPU-E. Please refer to Appendix D.2 for detailed information on these baselines.

Evaluation metric . Following [36, 37, 38], considering the negative impact on users when HGT is misclassified as MGT, and thus, we typically expect a very low false positive rate (FPR). Therefore, we focus on the true positive rate (TPR) at low TPR. Specifically, we evaluate TPR when FPR is set at 1%, and denote it as TPR@FPR-1%. Besides, we use the area under the receiver operating characteristic curve (AUROC), which is commonly used in MGT detection.

4.1 Performance Evaluation

We conduct extensive evaluations in various practical scenarios [39], sentence-level, paragraph-level, mixed, paraphrasing, and cross-domain texts. Their detailed descriptions are in Appendix D.3.

Mix Train

Ori. Train

Mixed PaLM Text

0.30

0.45

0.60

0.75

0.90

TPR@FPR-1%

Mix Train

Ori. Train

Mixed ChatGPT Text

0.15

0.30

0.45

0.60

0.75

0.90

TPR@FPR-1%

Mix Train

Ori. Train

0.00

0.15

0.30

0.45

0.60

TPR@FPR-1%

Mix Train

Ori. Train

Mixed Llama-2 Text

0.4

0.5

0.6

0.7

0.8

0.9

TPR@FPR-1%

ChatGPT-D

ChatGPT-E

MPU

MPU-E

RADAR

RADAR-E

Back Translation

Polish

PaLM Text

0.15

0.30

0.45

0.60

0.75

0.90

TPR@FPR-1%

Back Translation

Polish

ChatGPT Text

0.15

0.30

0.45

0.60

0.75

0.90

TPR@FPR-1%

Back Translation

Polish

0.00

0.15

0.30

0.45

0.60

0.75

TPR@FPR-1%

Back Translation

Polish

Llama-2 Text

0.30

0.45

0.60

0.75

0.90

TPR@FPR-1%

ChatGPT-D

ChatGPT-E

MPU

MPU-E

RADAR

RADAR-E

Sentence-level Detection . Tables 1 (left) and 2 (top) present sentence-level detection performance w.r.t. TPR@FPR-1%, for models trained on PaLM and GPT4All texts, respectively. See Tables 6-23 in the Appendix for AUROC and results trained on other LLMs. Overall, the proposed enhancement strategy substantially improves the original models' performance. For example, on the DetectRL dataset, the average TPR@FPR-1% for RADAR increases from 27.98% to 31.65% with the enhanced RADAR-E, while performance rises from 26.19% to 28.98% on the Essay dataset. Furthermore, the results consistently show that model-based methods generally surpass metric-based methods. For instance, FastGPT, the best-performing metric-based method in our experiment, is only comparable to ChatGPT-D on the Essay dataset and notably inferior to model-based methods on the DetectRL dataset. This highlights the significance of our enhancement targeted at model-based approaches. Interestingly, we also observe that cross-LLM detection performance is not always inferior to withinLLM detection. For example, Table 1 shows RADAR performing worse on texts generated by PaLM compared to ChatGPT. We reasonably suspect that this may be related to the quality of the generated text, and the text generated by ChatGPT is more discriminative.

Paragraph-level Detection . Tables 1 (right) and 2 (bottom) show the paragraph-level detection performance in terms of TPR@FPR-1%, where detectors are trained on PaLM and GPT4All, respectively. For performance on AUROC and additional results trained on other LLMs, please refer to Tables 6-12 and 24-34 in the Appendix. We observe enhancing effects similar to those at the sentence level, highlighting the proposed method's benefit at this granularity. Moreover, by comparing detection performance at the paragraph level and the sentence level, it is evident that sentence-level detection is significantly more challenging, similar to the finding in [17]. This underscores the significance of sentence-level detection and encourages it to be a primary focus for future studies.

Mixed Text Detection . Fig. 4 illustrates the test performance (TPR@FPR-1%) on explicit mixed text, and the corresponding AUROC performance can be found in Fig. 12 in the Appendix. Our experiments were conducted under two settings: training on mixed text and training on original text. Compared to the performance improvements shown in Table 1 (right), the enhancements in detecting mixed text are more pronounced. This may be attributed to the inherently less precise hard labels in mixed text, the core issue our proposed strategy directly addresses, thereby demonstrating greater potential for improvement and highlighting the rationale behind our design. Besides, comparing the detectors trained on mixed text (left group) and original text (right group), it can be found that the former has better robustness in detecting mixed texts, which is akin to adversarial training [40].

Paraphrasing Text Detection . Recent studies have shown that MGT detectors are vulnerable to paraphrasing attacks [41, 42], where paraphrased text can bypass detection. To assess the robustness improvement in adversarial scenarios, we explored the detection performance on texts subjected to

arxiv

writing

xsum

yelp

Test Domain

arxiv

writing

xsum

yelp

Train Domain

0.86

-0.02

-0.59

0.21

0.29

0.59

0.28

0.77

0.86

0.38

0.55

0.94

0.70

0.79

0.70

1.63

1.00

0.75

0.50

0.25

0.00

0.25

0.50

0.75

1.00

AUROC

arxiv

writing

xsum

yelp

Test Domain

arxiv

writing

xsum

yelp

0.07

-0.17

1.19

0.40

-0.59

3.11

3.09

0.44

0.05

0.00

9.10

0.69

1.06

0.25

3.44

2.89

3

2

1

0

1

2

3

TPR@FPR-1%

ChatGPT-D

MPU

Method

0.81

0.84

0.87

0.90

0.93

0.96

AUROC

detector

origin

KD

Ours

ChatGPT-D

MPU

Method

0.2

0.3

0.4

0.5

0.6

0.7

TPR@FPR-1%

detector

origin

KD

Ours

ChatGPT-D

MPU

Method

0.76

0.80

0.84

0.88

0.92

AUROC

detector

origin

KD

Ours

ChatGPT-D

MPU

Method

0.30

0.35

0.40

0.45

0.50

0.55

0.60

TPR@FPR-1%

detector

origin

KD

Ours

(a) DetectRL Dataset

(b) Essay Dataset

two common paraphrasing attacks: Polish and Back Translation [32], as illustrated in Fig. 5 and Fig. 13 in the Appendix. Notably, detectors employing the proposed enhancement framework exhibited greater robustness in these attack scenarios. Compared to non-attack performance (Table 1, right), performance generally declined under attack. This not only reaffirms the vulnerability of existing MGT detection methods but also underscores the critical need to enhance detector robustness.

Cross Domain Detection . Cross-domain performance was evaluated across four high-risk domains: arXiv Archive, Writing Prompts, XSum, and Yelp Reviews. Results are presented in Fig. 6, with additional results in Fig. 14 in the Appendix. In most settings, models employing the proposed strategy demonstrate significantly enhanced generalization capabilities. This is likely attributable to our framework reducing the model's reliance on inexact hard labels, thereby mitigating overfitting.

Running Time . Table 3 presents the runtime comparison in paragraph-level settings (sentence-level results are in Appendix Table 36). As discussed in Section 3.3, since the target detector is not modified, the proposed framework introduces no additional inference delay. Regarding training overhead, the longer text for the supervisor is constructed within the batch, and the intermediate results f ( x ( j ) , θ f ) from the detector can be reused. This ensures negligible overhead during the data preparation phase. The primary training delay is the supervisor's forward and backward passes. However, as the supervisor model (i.e., three-layer fully connected network in the experiments) is significantly simpler than detectors, the overall training delay is negligible.

4.2 Comparison with Knowledge Distillation

Fig. 7 presents the performance comparison between the proposed framework and Knowledge Distillation (KD), which is based on the "strong teacher enhances weak student" concept. Here, we selected RADAR, which has the best detection performance in the experiment, as the teacher model to guide ChatGPT-D and MPU. The results indicate that knowledge distillation even led to a decrease in the performance of the student models in most settings. This is primarily because the effectiveness of knowledge distillation largely depends on the quality of the teacher model (i.e., high-quality soft labels). However, obtaining such a teacher model is challenging in complex MGT detection scenarios.

4.3 Supervision Quality Assessment

To further verify whether the supervisor guides the detector to learn more accurate "golden" labels for enhancement, we introduce a knowledge distillation-based analysis method for verification. Specifically, we use the detectors before and after enhancement as teacher models, distill a student

model respectively. By comparing these student models' performance, we can verify the quality of the supervisory signal. If the student distilled from the enhanced detector outperforms the student distilled from the original detector, it indicates that our approach has indeed enabled the detector to learn better detection scores from the supervisor, thereby improving detection performance. Table 4 presents the distillation performance, where Origin-KD and Ours-KD denote the original RADAR detector and our enhanced RADAR (i.e., RADAR-E) guided MPU detector, respectively. By comparison, we observe that Ours-KD achieves superior performance, proving that the proposed method learns better detection scores from the supervisor to enhance detection.

4.4 Case Study

We prepare some examples for quantitative analysis, as shown in Table 5. Specifically, the table shows sequentially selected three MGTs from the DetectRL dataset. The text in the left column is accurately identified as "MGT" by both the baseline version of RADAR and our improved version RADAR-E. The text in the right column represents "win" cases for our approach, that is, they are misclassified by RADAR but correctly detected by RADAR-D. We can find that the easy-to-detect texts (left column) typically exhibit more complex idioms, formal vocabulary, and convoluted expressions, which are typical of machine-generated text. Instead, the difficult-to-detect texts (right column), which our method successfully detects, are characterized by short, plain, straightforward, and somewhat colloquial sentences, which are much closer to a typical human-like distribution. The characteristics of difficult-to-detect text and the effectiveness of the enhancement strategy intuitively demonstrate our advantages in processing ambiguous machine-generated text.

5 Conclusion

Existing detection methods are limited by inaccurate labels leading to inexact training, while the limitations of human cognition and the superintelligence of detectors make inexact learning widespread and inevitable. To address this, the paper has proposed an easy-to-hard supervision enhancement framework. This framework utilizes easier supervisors (weaker models trained on simpler long-text detection tasks) to enhance the more complex target detection model. By structurally integrating the detector into the supervisor's design, we model the supervisor as a lower performance bound for the detector. Optimizing the supervisor thus indirectly optimizes the detector, leading to improved alignment with the underlying golden labels. Extensive experiments across diverse practical scenarios demonstrate that this framework significantly improves MGT detection capabilities.

Acknowledgment

This work was supported by the RGC Senior Research Fellow Scheme under the grant: SRFS23242S02, RGC Young Collaborative Research Grant No. C2005-24Y, RGC General Research Fund No. 12200725, and NSFC General Program No. 62376235.

References

Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. Gpt-4 technical report. arXiv preprint arXiv:2303.08774 , 2023.

Qingsong Wen, Jing Liang, Carles Sierra, Rose Luckin, Richard Tong, Zitao Liu, Peng Cui, and Jiliang Tang. Ai for education (ai4edu): Advancing personalized education with llm and adaptive learning. In Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining , pages 6743-6744, 2024.

Keivalya Pandya and Mehfuza Holia. Automating customer service using langchain: Building custom open-source gpt chatbot for organizations. arXiv preprint arXiv:2310.05421 , 2023.

Canyu Chen and Kai Shu. Combating misinformation in the age of llms: Opportunities and challenges. AI Magazine , 45(3):354-368, 2024.

Sayak Saha Roy, Poojitha Thota, Krishna Vamsi Naragam, and Shirin Nilizadeh. From chatbots to phishbots?: Phishing scam generation in commercial large language models. In 2024 IEEE Symposium on Security and Privacy (SP) , pages 36-54. IEEE, 2024.

Leonard Salewski, Stephan Alaniz, Isabel Rio-Torto, Eric Schulz, and Zeynep Akata. Incontext impersonation reveals large language models' strengths and biases. Advances in neural information processing systems , 36:72044-72057, 2023.

Elizabeth Clark, Tal August, Sofia Serrano, Nikita Haduong, Suchin Gururangan, and Noah A Smith. All that's 'human'is not gold: Evaluating human evaluation of generated text. In Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing (Volume 1: Long Papers) , pages 7282-7296, 2021.

Irene Solaiman, Miles Brundage, Jack Clark, Amanda Askell, Ariel Herbert-Voss, Jeff Wu, Alec Radford, Gretchen Krueger, Jong Wook Kim, Sarah Kreps, et al. Release strategies and the social impacts of language models. arXiv preprint arXiv:1908.09203 , 2019.

Sebastian Gehrmann, Hendrik Strobelt, and Alexander Rush. Gltr: Statistical detection and visualization of generated text. In Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics: System Demonstrations . Association for Computational Linguistics, 2019.

Hanxi Guo, Siyuan Cheng, Xiaolong Jin, Zhuo Zhang, Kaiyuan Zhang, Guanhong Tao, Guangyu Shen, and Xiangyu Zhang. Biscope: Ai-generated text detection by checking memorization of preceding tokens. Advances in Neural Information Processing Systems , 37:104065-104090, 2024.

Eric Mitchell, Yoonho Lee, Alexander Khazatsky, Christopher D Manning, and Chelsea Finn. Detectgpt: Zero-shot machine-generated text detection using probability curvature. In International Conference on Machine Learning , pages 24950-24962. PMLR, 2023.

Guangsheng Bao, Yanbin Zhao, Zhiyang Teng, Linyi Yang, and Yue Zhang. Fast-detectgpt: Efficient zero-shot detection of machine-generated text via conditional probability curvature. In The Twelfth International Conference on Learning Representations .

Cong Zeng, Shengkun Tang, Xianjun Yang, Yuanzhou Chen, Yiyou Sun, Zhiqiang Xu, Yao Li, Haifeng Chen, Wei Cheng, and Dongkuan DK Xu. Dald: Improving logits-based detector without logits from black-box llms. Advances in Neural Information Processing Systems , 37:54947-54973, 2024.

Anton Bakhtin, Sam Gross, Myle Ott, Yuntian Deng, Marc'Aurelio Ranzato, and Arthur Szlam. Real or fake? learning to discriminate machine from human generated text. arXiv preprint arXiv:1906.03351 , 2019.

Wanjun Zhong, Duyu Tang, Zenan Xu, Ruize Wang, Nan Duan, Ming Zhou, Jiahai Wang, and Jian Yin. Neural deepfake detection with factual structure of text. arXiv preprint arXiv:2010.07475 , 2020.

Vivek Verma, Eve Fleisig, Nicholas Tomlin, and Dan Klein. Ghostbuster: Detecting text ghostwritten by large language models. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers) , pages 1702-1717, 2024.

Pengyu Wang, Linyang Li, Ke Ren, Botian Jiang, Dong Zhang, and Xipeng Qiu. Seqxgpt: Sentence-level ai-generated text detection. In The 2023 Conference on Empirical Methods in Natural Language Processing , 2023.

Bushra Alhijawi, Rawan Jarrar, Aseel AbuAlRub, and Arwa Bader. Deep learning detection method for large language models-generated scientific content. Neural Computing and Applications , 37(1):91-104, 2025.

Xiaomeng Hu, Pin-Yu Chen, and Tsung-Yi Ho. Radar: Robust ai-text detection via adversarial learning. Advances in neural information processing systems , 36:15077-15095, 2023.

Biyang Guo, Xin Zhang, Ziyuan Wang, Minqi Jiang, Jinran Nie, Yuxuan Ding, Jianwei Yue, and Yupeng Wu. How close is chatgpt to human experts? comparison corpus, evaluation, and detection. arXiv preprint arXiv:2301.07597 , 2023.

Ekaterina Artemova, Jason Lucas, Saranya Venkatraman, Jooyoung Lee, Sergei Tilga, Adaku Uchendu, and Vladislav Mikhailov. Beemo: Benchmark of expert-edited machine-generated outputs. arXiv preprint arXiv:2411.04032 , 2024.

Rafael Müller, Simon Kornblith, and Geoffrey E Hinton. When does label smoothing help? Advances in neural information processing systems , 32, 2019.

Souradip Chakraborty, Amrit Bedi, Sicheng Zhu, Bang An, Dinesh Manocha, and Furong Huang. Position: On the possibilities of ai-generated text detection. In Forty-first International Conference on Machine Learning , 2024.

Katy Ilonka Gero and Lydia B Chilton. Metaphoria: An algorithmic companion for metaphor creation. In Proceedings of the 2019 CHI conference on human factors in computing systems , pages 1-12, 2019.

Katy Ilonka Gero, Vivian Liu, and Lydia Chilton. Sparks: Inspiration for science writing using language models. In Proceedings of the 2022 ACM Designing Interactive Systems Conference , pages 1002-1019, 2022.

Shuhai Zhang, Yiliao Song, Jiahao Yang, Yuanqing Li, Bo Han, and Mingkui Tan. Detecting machine-generated texts by multi-population aware optimization for maximum mean discrepancy. In The Twelfth International Conference on Learning Representations .

Geoffrey Hinton, Oriol Vinyals, and Jeff Dean. Distilling the knowledge in a neural network. arXiv preprint arXiv:1503.02531 , 2015.

Bo Han, Quanming Yao, Tongliang Liu, Gang Niu, Ivor W Tsang, James T Kwok, and Masashi Sugiyama. A survey of label-noise representation learning: Past, present and future. arXiv preprint arXiv:2011.04406 , 2020.

Pierre Foret, Ariel Kleiner, Hossein Mobahi, and Behnam Neyshabur. Sharpness-aware minimization for efficiently improving generalization. In International Conference on Learning Representations .

Eric Jang, Shixiang Gu, and Ben Poole. Categorical reparametrization with gumble-softmax. In International Conference on Learning Representations (ICLR 2017) . OpenReview. net, 2017.

Sadri Hassani and Sadri Hassani. Dirac delta function. Mathematical Methods: For Students of Physics and Related Fields , pages 139-170, 2009.

Junchao Wu, Runzhe Zhan, Derek Wong, Shu Yang, Xinyi Yang, Yulin Yuan, and Lidia Chao. Detectrl: Benchmarking llm-generated text detection in real-world scenarios. Advances in Neural Information Processing Systems , 37:100369-100401, 2024.

Jinyan Su, Terry Zhuo, Di Wang, and Preslav Nakov. Detectllm: Leveraging log rank information for zero-shot detection of machine-generated text. In Findings of the Association for Computational Linguistics: EMNLP 2023 , pages 12395-12412, 2023.

Guangsheng Bao, Yanbin Zhao, Zhiyang Teng, Linyi Yang, and Yue Zhang. Fast-detectgpt: Efficient zero-shot detection of machine-generated text via conditional probability curvature. In ICLR , 2024.

Yuchuan Tian, Hanting Chen, Xutao Wang, Zheyuan Bai, QINGHUA ZHANG, Ruifeng Li, Chao Xu, and Yunhe Wang. Multiscale positive-unlabeled detection of ai-generated texts. In The Twelfth International Conference on Learning Representations .

Brian Tufts, Xuandong Zhao, and Lei Li. An examination of ai-generated text detectors across multiple domains and models. In Neurips Safe Generative AI Workshop 2024 .

Kathleen C Fraser, Hillary Dawkins, and Svetlana Kiritchenko. Detecting ai-generated text: Factors influencing detectability with current methods. arXiv preprint arXiv:2406.15583 , 2024.

Abhimanyu Hans, Avi Schwarzschild, Valeriia Cherepanova, Hamid Kazemi, Aniruddha Saha, Micah Goldblum, Jonas Geiping, and Tom Goldstein. Spotting llms with binoculars: Zero-shot detection of machine-generated text. In International Conference on Machine Learning , pages 17519-17537. PMLR, 2024.

Yafu Li, Qintong Li, Leyang Cui, Wei Bi, Zhilin Wang, Longyue Wang, Linyi Yang, Shuming Shi, and Yue Zhang. Mage: Machine-generated text detection in the wild. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) , pages 36-53, 2024.

Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations , 2018.

Kalpesh Krishna, Yixiao Song, Marzena Karpinska, John Wieting, and Mohit Iyyer. Paraphrasing evades detectors of ai-generated text, but retrieval is an effective defense. Advances in Neural Information Processing Systems , 36:27469-27500, 2023.

Vinu Sankar Sadasivan, Aounon Kumar, Sriram Balasubramanian, Wenxiao Wang, and Soheil Feizi. Can ai-generated text be reliably detected? arXiv preprint arXiv:2303.11156 , 2023.

Nagarajan Natarajan, Inderjit S Dhillon, Pradeep K Ravikumar, and Ambuj Tewari. Learning with noisy labels. Advances in neural information processing systems , 26, 2013.

Bo Han, Quanming Yao, Xingrui Yu, Gang Niu, Miao Xu, Weihua Hu, Ivor Tsang, and Masashi Sugiyama. Co-teaching: Robust training of deep neural networks with extremely noisy labels. Advances in neural information processing systems , 31, 2018.

Hongyi Zhang, Moustapha Cisse, Yann N Dauphin, and David Lopez-Paz. mixup: Beyond empirical risk minimization. In International Conference on Learning Representations , 2018.

Kathleen C Fraser, Hillary Dawkins, and Svetlana Kiritchenko. Detecting ai-generated text: Factors influencing detectability with current methods. Journal of Artificial Intelligence Research , 82:2233-2278, 2025.

John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. A watermark for large language models. In International Conference on Machine Learning , pages 17061-17084. PMLR, 2023.

Xuandong Zhao, Prabhanjan Vijendra Ananth, Lei Li, and Yu-Xiang Wang. Provable robust watermarking for ai-generated text. In The Twelfth International Conference on Learning Representations .

CHEN Liang, Yatao Bian, Yang Deng, Deng Cai, Shuaiyi Li, Peilin Zhao, and Kam-Fai Wong. Watme: Towards lossless watermarking through lexical redundancy. In ICLR 2024 Workshop on Secure and Trustworthy Large Language Models , 2024.

Chenchen Gu, Xiang Lisa Li, Percy Liang, and Tatsunori Hashimoto. On the learnability of watermarks for language models. In The Twelfth International Conference on Learning Representations .

Yepeng Liu and Yuheng Bu. Adaptive text watermark for large language models. In International Conference on Machine Learning , pages 30718-30737. PMLR, 2024.

Hanlin Zhang, Benjamin L Edelman, Danilo Francati, Daniele Venturi, Giuseppe Ateniese, and Boaz Barak. Watermarks in the sand: Impossibility of strong watermarking for generative models. In ICLR 2024 Workshop on Secure and Trustworthy Large Language Models .

Nikola Jovanovi´ c, Robin Staab, and Martin Vechev. Watermark stealing in large language models. In International Conference on Machine Learning , pages 22570-22593. PMLR, 2024.

Yang Xu, Yu Wang, Hao An, Zhichen Liu, and Yongyuan Li. Detecting subtle differences between human and model languages using spectrum of relative likelihood. In Proceedings of EMNLP , pages 10108-10121, 2024.

Xianjun Yang, Wei Cheng, Yue Wu, Linda Ruth Petzold, William Yang Wang, and Haifeng Chen. Dna-gpt: Divergent n-gram analysis for training-free detection of gpt-generated text. In ICLR , 2024.

Cong Zeng, Shengkun Tang, Xianjun Yang, Yuanzhou Chen, Yiyou Sun, Zhiqiang Xu, Yao Li, Haifeng Chen, Wei Cheng, and Dongkuan Xu. Improving logits-based detector without logits from black-box llms. CoRR , 2024.

Hoang-Quoc Nguyen-Son, Minh-Son Dao, and Koji Zettsu. Simllm: Detecting sentences generated by large language models using similarity between the generation and its re-generation. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing , pages 22340-22352, 2024.

Xiao Yu, Kejiang Chen, Qi Yang, Weiming Zhang, and Nenghai Yu. Text fluoroscopy: Detecting llm-generated text through intrinsic features. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing , pages 15838-15846, 2024.

Shixuan Ma and Quan Wang. Zero-shot detection of llm-generated text using token cohesiveness. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing , pages 17538-17553, 2024.

Eduard Tulchinskii, Kristian Kuznetsov, Laida Kushnareva, Daniil Cherniavskii, Sergey Nikolenko, Evgeny Burnaev, Serguei Barannikov, and Irina Piontkovskaya. Intrinsic dimension estimation for robust detection of ai-generated texts. Advances in Neural Information Processing Systems , 36:39257-39276, 2023.

Yann LeCun, Sumit Chopra, Raia Hadsell, M Ranzato, Fujie Huang, et al. A tutorial on energy-based learning. Predicting structured data , 1(0), 2006.

Zhongping Zhang, Wenda Qin, and Bryan Plummer. Machine-generated text localization. In Findings of the Association for Computational Linguistics ACL 2024 , pages 8357-8371, 2024.

Hyunseok Lee, Jihoon Tack, and Jinwoo Shin. Remodetect: Reward models recognize aligned llm's generations. In The Thirty-eighth Annual Conference on Neural Information Processing Systems .

Xun Guo, Yongxin He, Shan Zhang, Ting Zhang, Wanquan Feng, Haibin Huang, and Chongyang Ma. Detective: Detecting ai-generated text via multi-level contrastive learning. Advances in Neural Information Processing Systems , 37:88320-88347, 2024.

David Aldous. Random walks on finite groups and rapidly mixing markov chains. In Séminaire de Probabilités XVII 1981/82: Proceedings , pages 243-297. Springer, 1983.

Xinlei He, Xinyue Shen, Zeyuan Chen, Michael Backes, and Yang Zhang. Mgtbench: Benchmarking machine-generated text detection. arXiv preprint arXiv:2303.14822 , 2023.

NeurIPS Paper Checklist

1. Claims

Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?

Answer: [Yes]

Justification: We have summarized the position and key contribution of the paper in the abstract and introduction.

Guidelines:

The answer NA means that the abstract and introduction do not include the claims made in the paper.

The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.

The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.

It is fine to include aspirational goals as motivation as long as it is clear that these goals are not attained by the paper.

2. Limitations

Question: Does the paper discuss the limitations of the work performed by the authors?

Answer: [Yes]

Justification: We have discussed the limitations in Appendix A.7.

Guidelines:

The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.

The authors are encouraged to create a separate "Limitations" section in their paper.

The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.

The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with a few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.

The authors should reflect on the factors that influence the performance of the approach. For example, a facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or a speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.

The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.

If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.

While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an important role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.

3. Theory assumptions and proofs

Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?

Answer: [Yes]

Justification: The assumptions and proof are provided in Section 3 and Appendix C.

Guidelines:

The answer NA means that the paper does not include theoretical results.

All the theorems, formulas, and proofs in the paper should be numbered and crossreferenced.

All assumptions should be clearly stated or referenced in the statement of any theorems.

The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch to provide intuition.

Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.

Theorems and Lemmas that the proof relies upon should be properly referenced.

4. Experimental result reproducibility

Question: Does the paper fully disclose all the information needed to reproduce the main experimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?

Answer: [Yes]

Justification: The technical details of implementation are introduced in Appendix D.4. In addition, the source code is available at https://github.com/tmlr-group/Easy2Hard .

Guidelines:

The answer NA means that the paper does not include experiments.

If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.

If the contribution is a dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.

Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.

While NeurIPS does not require releasing code, the conference does require all submissions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example

(a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm.

(b) If the contribution is primarily a new model architecture, the paper should describe the architecture clearly and fully.

(c) If the contribution is a new model (e.g., a large language model), then there should either be a way to access this model for reproducing the results or a way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).

(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.

5. Open access to data and code

Question: Does the paper provide open access to the data and code, with sufficient instructions to faithfully reproduce the main experimental results, as described in supplemental material?

Answer: [Yes]

Justification: The source files are publiclly available at https://github.com/ tmlr-group/Easy2Hard .

Guidelines:

The answer NA means that paper does not include experiments requiring code.

Please see the NeurIPS code and data submission guidelines ( https://nips.cc/ public/guides/CodeSubmissionPolicy ) for more details.

While we encourage the release of code and data, we understand that this might not be possible, so 'No' is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for a new open-source benchmark).

The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines ( https: //nips.cc/public/guides/CodeSubmissionPolicy ) for more details.

The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.

The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only a subset of experiments are reproducible, they should state which ones are omitted from the script and why.

At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).

Providing as much information as possible in supplemental material (appended to the paper) is recommended, but including URLs to data and code is permitted.

6. Experimental setting/details

Question: Does the paper specify all the training and test details (e.g., data splits, hyperparameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?

Answer: [Yes]

Justification: The details of experiment setups and implementation are in Appendix D.

Guidelines:

The answer NA means that the paper does not include experiments.

The experimental setting should be presented in the core of the paper to a level of detail that is necessary to appreciate the results and make sense of them.

The full details can be provided either with the code, in appendix, or as supplemental material.

7. Experiment statistical significance

Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?

Answer: [Yes]

Justification: We perform five independent repeated experiments and report error bar.

Guidelines:

The answer NA means that the paper does not include experiments.

The authors should answer "Yes" if the results are accompanied by error bars, confidence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).

The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)

The assumptions made should be given (e.g., Normally distributed errors).

It should be clear whether the error bar is the standard deviation or the standard error of the mean.

It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have a 96% CI, if the hypothesis of Normality of errors is not verified.

For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative error rates).

If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.

8. Experiments compute resources

Question: For each experiment, does the paper provide sufficient information on the computer resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?

Answer: [Yes]

Justification: We have provided the running time in Section 4.1.

Guidelines:

The answer NA means that the paper does not include experiments.

The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.

The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.

The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make it into the paper).

9. Code of ethics

Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https://neurips.cc/public/EthicsGuidelines ?

Answer: [Yes]

Justification: We have carefully checked the NeurIPS Code of Ethics and confirmed that our paper obey it.

Guidelines:

The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.

If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics.

The authors should make sure to preserve anonymity (e.g., if there is a special consideration due to laws or regulations in their jurisdiction).

10. Broader impacts

Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?

Answer: [Yes]

Justification: We have discussed the broader impacts in Appendix A.8.

Guidelines:

The answer NA means that there is no societal impact of the work performed.

If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.

Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.

The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.

The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.

If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).

11. Safeguards

Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?

Answer: [NA]

Justification: The paper poses no such risks.

Guidelines:

The answer NA means that the paper poses no such risks.

Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.

Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.

We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make a best faith effort.

12. Licenses for existing assets

Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?

Answer: [Yes]

Justification: We have cited the original paper that produced the dataset.

Guidelines:

The answer NA means that the paper does not use existing assets.

The authors should cite the original paper that produced the code package or dataset.

The authors should state which version of the asset is used and, if possible, include a URL.

The name of the license (e.g., CC-BY 4.0) should be included for each asset.

For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.

If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswithcode.com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset.

For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.

If this information is not available online, the authors are encouraged to reach out to the asset's creators.

13. New assets

Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?

Answer: [NA]

Justification: The paper does not release new assets.

Guidelines:

The answer NA means that the paper does not release new assets.

Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.

The paper should discuss whether and how consent was obtained from people whose asset is used.

At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.

14. Crowdsourcing and research with human subjects

Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?

Answer: [NA]

Justification: The paper is not about crowdsourcing experiments or research with human subjects.

Guidelines:

The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.

Including this information in the supplemental material is fine, but if the main contribution of the paper involves human subjects, then as much detail as possible should be included in the main paper.

According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.

15. Institutional review board (IRB) approvals or equivalent for research with human subjects

Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?

Answer: [NA]

Justification: The paper is not about research with human subjects.

Guidelines:

The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.

Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.

We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.

For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.

16. Declaration of LLM usage

Question: Does the paper describe the usage of LLMs if it is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, or formatting purposes and does not impact the core methodology, scientific rigorousness, or originality of the research, declaration is not required.

Answer: [NA]

Justification: In MGT detection, LLM is used to generate MGT for training and testing.

Guidelines:

The answer NA means that the core method development in this research does not involve LLMs as any important, original, or non-standard components.

Please refer to our LLM policy ( https://neurips.cc/Conferences/2025/LLM ) for what should or should not be described.

Appendix

A Further Discussion

A.1 The solution to Inexact Supervision

In the introduction, we emphasized that this paper aims to learn effectively from the supervisor when (1) the provided label is inexact, and (2) the detection quality is difficult to assess. Therefore, we proposed an easy-to-hard enhancement framework. Here, we systematically discuss how the proposed framework solves them.

To address the first challenge, we design supervisors to focus on the relatively easier task of longer text detection. Theoretically, longer texts have a greater class distribution distance (Theorem 3.1), which helps mitigate the negative impact of inexact labels. Additionally, we collapse the HGT distribution as a Dirac δ 0 distribution, which theoretically increases the distribution distance (Theorem 3.3), further aiding the supervisor's learning.

To address the second challenge, we do not employ the method of supervisors directly providing soft labels to detectors, as is common in knowledge distillation. This is due to the evaluation difficulty and the fact that the supervisor may be weak and cannot guarantee the quality of the provided soft label. Instead, we structurally integrate the detector into the supervisor's design, establishing a connection between the supervisor and the detector, where the supervisor's performance serves as a lower bound for the detector's capabilities. This coupled structure allows the detector to be indirectly optimized via the supervisor, avoiding the larger error caused by directly providing label-based signals. Accordingly, the enhancement roadmap is: maximize supervisor performance → maximize k → maximize detector performance.

A.2 Scalability of the Proposed Approach

We examine the scalability of our approach to large-scale scenarios from the perspectives of computational compatibility and framework generality.

Computational compatibility . A key aspect of our framework is its computational efficiency. Incorporating an auxiliary supervisor throughout the training process adds negligible overhead, as shown in Table 3. This supervisor can be designed as a lightweight component that avoids bottlenecks, ensuring seamless integration into standard large-scale training pipelines with large models and massive datasets. In essence, the bias is in the training objective (Eq. 5), not in a restrictive architectural change that would hinder scaling.

Framework generality . The proposed framework applies to model-based approaches that rely on data and computing power rather than metric-based methods centered on specific features. This reflects the philosophy of 'The Bitter Lesson'-instead of forcing explanations of the detection mechanism through specific features, we learn to construct the most effective representations for detection using data and computation. Moreover, the enhancement framework is not built on narrowly designed knowledge; rather, it represents a general learning architecture under inexact supervision by using an easier supervisor to refine labels for the target model. Its applicability may extend beyond text detection to any inexact supervision problem characterized by inherently ambiguous labels.

Essentially, our framework employs an efficient computational method (training the supervisor on longer texts) to provide better learning signals for another method (the detector), rather than imposing a rigid, artificially designed bias that limits learning and scalable.

A.3 Different from Knowledge Distillation

The proposed framework exhibits significant differences from Knowledge Distillation (KD) [27] in several key aspects:

Model . KDis essentially a "strong teacher-weak student" enhancement paradigm, where a typically more powerful and complex teacher model guides a student model to improve performance or achieve model compression. In contrast, the proposed framework follows an easy-to-hard enhancement paradigm, enhancing the target detector through a supervisor that focuses on the relatively easier task of long text detection. Thanks to the relative simplicity of the task, the

supervisor model can often be designed in a more lightweight manner. For example, in the paper, it is modeled as a simple three-layer fully connected network, which significantly reduces complexity compared to detectors usually built upon complex pre-trained models.

Task . In traditional KD, both the teacher and student models are typically trained and evaluated on the same task, with the teacher model providing guidance based on its superior performance in that task. However, in the proposed framework, although the overarching goal for both the supervisor and the detector is MGT detection, the tasks they focus on differ significantly in terms of difficulty and data characteristics. The supervisor deals with longer texts that are relatively easier to detect, while the detector handles the more challenging original texts.

Supervision Signal . The core of KD lies in using the soft labels output by the teacher model as a supervision signal to guide the student model, with the typical optimization goal being the minimization of the divergence between the output distributions of the student and teacher models. This is to enable the student model to learn the decision boundaries and generalization capabilities of the teacher model. Its effectiveness depends on the teacher model providing high-quality soft labels. However, in MGT detection, the detector's superintelligence makes it unclear if the supervisor's soft labels offer superior information. Therefore, the proposed framework does not directly rely on the supervisor's soft labels. Instead, by structurally incorporating the detector into the supervisor, we consider the supervisor's performance as a theoretical lower bound for the detector's capabilities. Thus, optimizing the supervisor indirectly enhances the detector.

A.4 Challenge of Noisy Label Learning

Noisy label learning (NLL) [29, 28] is primarily designed to address incidental and limited labeling errors, whereas in MGT detection, the issue to be addressed is the widespread inexactness in labels (the categories are correct) due to limitations of human cognition. There are significant differences in both the problem and the techniques involved:

Nature of the Problem . NLL assumes the existence of clear, discrete ground truth, viewing erroneous labels in the training set as occasional random errors, with its core focus being the correction of these errors, emphasizing label accuracy. In contrast, the imprecision in MGT detection stems from the ambiguity of the issue itself- the "machine-generated" attribute of text is not always a clear binary judgment. The focus in MGT detection is on hard labels that do not sufficiently represent the sample, rather than labeling errors.

Technical Means . Classic strategies in NLL, such as robust loss functions [43, 29] and sample selection [44], attempt to identify and prioritize training on 'clean' samples while reducing or ignoring the influence of 'erroneous' ones. This mechanism typically implies the assumption that noise is limited and identifiable, and the default fact is that when the noise ratio > 50%, it is impossible to learn without additional assumptions [44]. However, in MGT detection, due to the limitations of human cognition in recognizing inherent data ambiguity, these inexact samples are both prevalent and complex. Even when clearly distinguishable samples exist, it is challenging for human cognition to reliably filter them out. This makes it difficult for NLL techniques to adapt to MGT detection.

To further verification, this paper also experimentally evaluates the feasibility of noisy label learning, as shown in Appendix D.8.

A.5 Reasonableness of the Golden Label Assumption

In MGT detection, traditional binary labels ("human-generated" or "machine-generated") struggle to accurately reflect the degree of "machineness" in text. Considering the limitations of human cognition, perfect, clear golden labels might be impossible to define. To this end, recognizing that the degree of "machineness" largely depends on the explicit mixed text in human-machine collaboration scenarios, as well as the implicit mixed texts when LLMs generate human-like text, we naturally approximate MGT golden labels as the proportion of purely machine-generated content distinguishable from HGT (even if unknown). Compared to simple binary labels, this continuous proportional labeling can more finely and quantitatively capture the true characteristics of texts and their degree of "machineness". For example, a piece of text might be 30% machine-edited, so using this proportion would approximate its golden label to 0.3, which indicates the degree of machine-likeness in this piece of text, information that cannot be represented by a binary label.

Undeniably, the text generation in practical scenarios can be highly complex and unstructured (e.g., clause-level, word-level modification), making the simple use of proportion as an approximation of the golden label imperfect. However, in the current absence of more precise metrics, this proportionbased label provides a relatively unbiased ground truth approximation that better reflects machine contribution. It aids models in understanding the distribution characteristics of data within a continuous label space, similar to Mixup [45]. Future research could further explore more precise quantification methods for defining the degree of "machineness" in texts for MGT detection.

A.6 Differences from Existing Theoretical Results

Our theoretical results build upon Chakraborty's foundational theory [23] but differ substantially in several aspects:

Lower bounds vs. upper bounds . While existing work [23] establishes critical theoretical lower bounds for detection, we extend to the theoretical upper bounds (Theorem 3.2 and the right-hand side of Theorem 3.1) to further explore the potential of detection. Although they are both related to text length, they measure different bounds.

Guidance for the proposed framework . In addition to exploring the detection potential, it is more important to guide the design of the proposed framework: by coupling the influencing factors of the supervisor's upper bound with the detector, maximizing the supervisor's performance indirectly optimizes the detector, i.e., maximizing the supervisor's performance -> optimizing the influencing factors of the upper bound -> optimizing the detector. Instead, such a guided optimization mechanism cannot be achieved with the theoretical lower bounds.

A.7 Limitation

The proposed framework in the paper is currently applicable to enhancing model-based detection methods with relatively good performance. One future research direction could explore ways to effectively enhance metric-based MGT detection methods under inexact supervision learning conditions. Moreover, Theorem 3.4 reveals that the proposed framework tends to lead the detector to converge to predefined "golden" labels: the proportion of purely machine-generated content distinguishable from HGT. As discussed in Section A.5, in the absence of more precise metrics, although this approximate gold label provides a relatively less biased ground truth compared to hard labels, it is undeniably imperfect. Future research may focus on the quantification of more precise golden labels and the design of detection algorithms that approximate them.

A.8 Broader Impact

This paper presents work that aims to advance the field of trustworthy machine learning and large language models, specifically by improving machine-generated text detection. We do not involve human subjects, potentially harmful insights, potential conflicts of interest and sponsorship, discrimination and bias concerns, privacy and security issues, legal compliance, or other ethical issues.

B Related Work

Existing MGT detection methods can be broadly categorized into three categories: proactive watermarking-based methods, post-hoc metric-based methods and model-based methods.

B.1 Watermark-based Method

Watermarks are embedded as subtle yet consistent information at the inception of machine-generated text while maintaining expected grammar and semantics, which facilitate traceability by enabling the detection of machine-generated text [46]. Kirchenbauer et al. [47] randomly partition tokens into two categories, biasing the probability distribution to favor one category, resulting in a higher frequency of these tokens in watermarked text. This allows for watermark detection using statistical hypothesis testing. Furthermore, simplifying this approach to a fixed word list has demonstrated greater robustness against paraphrase attacks [48]. Chen et al. [49] evaluated the impact of watermarks on different capabilities of large language models from a cognitive science perspective, finding

that knowledge recall and logical reasoning are more adversely affected than language generation. To address this, they introduced Watermarking with Mutual Exclusion, dynamically optimizing token use during decoding by applying exclusion rules to recognized lexical redundancies. In addition to manually designing watermarks, leveraging the capabilities of language models to directly learn to generate watermarked text is promising. This includes training student models [50] and semantically invariant watermark models [51]. While watermark-based methods exhibit strong detection capabilities, they are limited by the requirement for full access to the generation model, which hinders their practicality in detection tasks, as there is often no prior knowledge of the generation model, let alone the ability to modify its generation rules. Besides, they are also vulnerable to attacks [52, 53], which exacerbates the challenge of detection.

B.2 Metric-based Methods

Metric-based methods detect based on the statistical differences between generated and natural text. Mitchell et al. [11] found that slight perturbations in generated text can result in rewritten text having a lower log probability than the original text, leading to the design of DetectGPT. Similarly, Solaiman et al. [8] performed detection based on the higher log probability of generated text compared to natural text. Additionally, using relative likelihood instead of absolute likelihood has proven to be more competitive than previous zero-shot methods [54]. Considering the intensive computational cost of DetectGPT, Fast-DetectGPT [12] introduced conditional probability curvature to measure differences in token selection and used sampling to improve efficiency. DNA-GPT [55] divided the text into two parts and used them to generate the other part, performing detection by measuring the difference between the generated and the original. Since LLMs are often black boxes in practice [39], these methods use a proxy model to extract features, leading to performance degradation due to distribution discrepancies between the proxy and target models. To address this, Zeng et al. [56] proposed a distribution-aligned detection framework, ensuring enhanced detection capability and resilience against rapid model iterations with minimal training investment. Nguyen-Son et al. [57] observed that the similarity between original and generated texts is significantly higher than between generated and subsequently regenerated texts. Accordingly, they proposed SimLLM, which detects by estimating the similarity between input sentences and their generated counterparts. Yu et al. [58] captured intrinsic features of text by identifying layers with the greatest distribution differences when projecting onto lexical space, and using intrinsic rather than semantic features for detection has proven to yield better performance. Given that existing methods struggle with out-of-distribution data, token cohesiveness [59] has been shown to be a good indicator, with LLM-generated text often exhibiting higher token cohesiveness than human-written text. Tulchinskii et al. [60] discovered that the intrinsic dimension of text is a good metric, as generated text typically has an average intrinsic dimension about 1.5 lower than natural text. Clearly, metrics-based methods are manually designed features based on limited data, casting doubt on their broader effectiveness.

B.3 Model-based Methods

Model-based methods do not involve explicit feature extraction; instead, they leverage the powerful representation capabilities of deep learning models to implicitly learn distinguishable features by taking the entire text as input. Energy-based models [61], which perform well in continuous space, have been applied to text sequence detection, demonstrating better adaptability to changes in LLM architectures [14]. SeqXGPT [17] focuses on sentence-level detection, employing a detection framework that uses the probability list from a white-box LLM as detection features. AI-Catcher [18] integrates multilayer perceptrons and convolutional neural networks to learn statistical features and high-level semantic representations for detection. Addressing the challenge of limited information in short text detection, Zhang et al. [62] utilized contextual information to simultaneously predict whether multiple sentences were written by machines or humans. Zhong et al. [15] represented the factual structure of a given document as an entity graph, where adjacent nodes denote sentences with consistent relationships, and employed graph neural networks to learn sentence representations, combining them into the document representation for prediction. Hu et al. [19] proposed RADAR, a robust detector resistant to paraphrasing attacks, by employing adversarial learning between a paraphraser and a detector. Lee et al. [63] observed that LLM-generated text has higher estimated preference alignment compared to human-written text, making it easily detectable by utilizing LLMs trained to mimic human preference distributions. Guo et al. [64] posited that the key to detection lies in distinguishing different authors' writing styles, proposing a detection framework based on

multitask auxiliary and hierarchical contrastive learning. Considering the similarity between short texts and human texts, MPU [35] treated short texts as partially unlabeled and adopted a multiscale positive-unlabeled strategy for training. These model-based methods, when supervised on specific datasets, demonstrate higher effectiveness and robustness [32].

C Theoretical Analysis

C.1 Proof of Theorem 3.1

Theorem. 3.1 (Distribution Difference for Longer Text) . Let h ( s ) and m ( s ) be the distributions for human-generated and machine-generated sequences on s ∈ S , respectively, with the total variation distance TV ( m,h ) = δ > 0 . For the text contains n sequences, let α ≥ 0 denote the ratio of human-like component incorporated in MGT. For longer text formed by concatenating k independent lengthn texts, the total variation distance between their distributions, TV long can be bounded by:

Proof. We will prove the upper and lower bounds of the total variance distance of longer texts TV long , respectively.

Upper bound . First, we introduce a necessary lemma to help our proof.

Lemma C.1 ( Coupling Lemma [65]) . Suppose that P and Q are given. For every coupling ( X,Y ) of P and Q ,

̸

A direct corollary of this lemma is that for any coupling ( X,Y ) of ( P, Q ) , there is:

̸

For the longer text containing k texts, each of which contains n sequences, therefore, it is natural that the longer MGT is i.i.d. sampled from the m × nk , where m × nk := m × m × . . . × m ( nk times) denotes the product distribution. Similarly, longer HGT is i.i.d. sampled from the h × nk . In our setting, HGT with α ratio is mixed into MGT. Therefore, the longer MGT is revisited as m × (1 -α ) nk h × αnk .

̸

Based on the Coupling Lemma, to obtain the upper bound, we need to construct a random pair ( X,Y ) = (( X 1 , . . . , X kn ) , ( Y 1 , . . . , Y kn )) , so that X ∼ m × (1 -α ) nk h × αnk and Y ∼ h × nk , and then calculate Pr ( X = Y ) . we can construct this coupling by coupling each component ( X i , Y i ) independently.

̸

Specifically, by the Coupling Lemma, there exists a coupling ( U, V ) of m and h such that Pr ( U = V ) = TV ( m,h ) = δ . We can choose such a coupling ( U, V ) . Then, we construct a coupling for ( X,Y ) as follows:

̸

For the first (1 -α ) nk components ( i = 1 , . . . , (1 -α ) nk ) : Let ( X i , Y i ) be drawn independently and identically from ( U, V ) . Thus, X i ∼ m and Y i ∼ h , and Pr ( X i = Y i ) = δ .

̸

For the last αnk components ( i = (1 -α ) nk +1 , . . . , nk ) : we need X i ∼ h and Y i ∼ h . The simplest coupling is to let X i = Y i and draw this common value independently from the distribution h . Then, X i = Y i ∼ h and Pr ( X i = Y i ) = 0 .

̸

̸

Now we calculate the probability of X = Y under this coupling. X = Y iff there is at least one index i ∈ { 1 , . . . , nk } such that X i = Y i .

̸

̸

̸

Using the probability of complementary events:

̸

Since ( X i , Y i ) pairs are constructed independently, the event { X i = Y i } is independent for different i . therefore:

According to our coupling construction:

̸

̸

Therefore,

̸

Therefore, Pr ( X = Y ) = 1 -(1 -δ ) (1 -α ) nk , and accordingly, TV long ≤ Pr ( X = Y ) = 1 -(1 -δ ) (1 -α ) nk . The upper bound is proved.

̸

Lower bound . From the definition of total variance distance, we know that there exists a specific measurable subset A ∈ S such that

If the probability of a single sample drawn from h falling into set A is Pr ( s ∼ h ∈ A ) = p , the probability of a single sample drawn from m falling into A is Pr ( s ∼ m ∈ A ) = p + δ , where δ > 0 .

According to the proof of the upper bound above, the longer MGT can be considered as sampling a set of (1 -α ) nk i.i.d. sequences { s i } (1 -α ) nk i =1 from distribution m , and sampling a set of αnk i.i.d. sequences { s i } nk i =(1 -α ) nk +1 from distribution h . Then, the expected number of sequences belonging to A is ( q +(1 -α ) δ ) nk . Similarly, the longer HGT can be considered as sampling a set of nk i.i.d. sequences s i nk i =1 from distribution h , the expected number of sequences in A is qnk . Then we can apply the Chernoff bound to have

and

Now consider the even E where nk sequences containing at least ( q + (1 -α ) δ 2 ) sequences of A , then we have

Therefore, the lower bound is proved.

C.2 Proof of Theorem 3.2

Theorem. 3.2 ( Detection Power for Longer Text ). Under the assumption of Theorem 3.1, the supervisor's AUROC supv. satisfies:

Proof. Invoking Proposition 1 in existing work [23], we have

Since the right-hand part is the monotonically increasing function of TV long , combing the upper bound in Theorem 3.1, we can bound

The theorem is proved.

C.3 Proof the Theorem 3.3

Theorem. 3.3( Distribution Difference after HGT Distribution Collapse ). Under the assumption of Theorem 3.1 and assuming that m (0) → 0 , then if h ( s ) collapses to a Dirac delta distribution, we have lim m (0) → 0 TV ( h, m ) = 1 .

Proof. The assumption that h converges in distribution to Dirac measure δ 0 implies that for the set A = { 0 } , P r ( s ∼ h ∈ { 0 } ) → δ 0 ( { 0 } ) = 1 . We are given that Pr ( s ∼ m ∈ { 0 } ) → 0 . Consider the measurable set A = { 0 } . The difference in probabilities for this set tends to:

By the definition of the total variation distance as a supremum, TV( h, m ) ≥| Pr ( s ∼ h ∈ { 0 } ) -Pr ( s ∼ m ∈ { 0 } ) | . Taking the limit, we get lim m (0) → 0 TV( h, m ) ≥ 1 . Since the total variation distance between any two probability distributions is at most 1 (i.e., TV( h, m ) ≤ 1 ), we have lim m (0) → 0 TV( h, m ) = 1 . The theorem is proved.

C.4 Proof of Theorem 3.4

Theorem. 3.4( The Effectiveness of the Proposed Framework ). Under the assumption of Theorem 3.1, and assuming that the MGT golden label is approximately the proportion of pure machinegenerated content distinct from HGT. If the supervisor reaches the best possible one, the detector converges to the underlying golden labels.

Proof. According to our approximation of the golden label (i.e., the proportion of pure machinegenerated content distinguished from HGT in MGT), the golden label of MGT is 1 -α . In the proposed framework, we use Gumbel Softmax, whose mathematical expectation maintains the original prediction distribution of the detector. Therefore, under the expected behavior, for longer MGT, suppose that the predicted soft label of the detector is 1 -α ′ , then texts with α ′ proportion are filtered. Here we consider two cases:

α ′ ≥ α . To maximize the supervisor's performance, it is necessary to retain the MGT part as much as possible, that is, the HGT of α proportion and the MGT with α ′ -α proportion are filtered. After filtered, the longer MGT can be considered as sampling a set of (1 -α ′ ) nk i.i.d. sequences

{ s i } (1 -α ′ ) nk i =1 from distribution m . For longer HGT, since it collapses to Direc δ 0 distribution, it can be considered as any length, which is also set as (1 -α ′ ) nk i.i.d. sequences from distribution h . Similar to the proof of Theorem 3.1, we have the total variance distance between longer MGT and HGT is TV long = TV( m (1 -α ′ ) nk , h (1 -α ′ ) nk ) ≤ 1 -(1 -δ ) (1 -α ′ ) nk . Furthermore, similar to the proof of Theorem 3.2, the supervisor's performance satisfies:

When the supervisor achieves the best possible one, α ′ should be minimum, i.e., α ′ = α .

α ′ ≤ α . Similarly, to maximize supervisor's performance, the original HGT of α ′ proportion is filtered, and the MGT retains. Therefore, the total variance distance between longer MGT and HGT is TV long = TV( m × (1 -α ) nk h × ( α -α ′ ) nk , h × (1 -α ) nk h × ( α -α ′ ) nk ) ≤ TV( m × (1 -α ) nk , h (1 -α ) nk ) , and the best supervisor also is AUROC supv. = 1 -1 2 · (1 -δ ) 2 nk (1 -α ) when α ′ = α .

In summary, when the supervisor is optimal, the detector's prediction probability for MGT is 1 -α . The theorem is proved.

D Additional Experiments

D.1 Datasets

A detailed description of the datasets used in the paper is as follows:

Essay [16]. The essay dataset comprises 1,000 text samples. The HGT samples are the original essays from IvyPanda, which spanned numerous subjects and educational levels (high school to university). To create the MGT samples, it first employed ChatGPT-turbo to generate a specific prompt designed to align with the content of each original essay. This prompt was then fed into various LLMs, including GPT4All, ChatGPT, ChatGPT-turbo, ChatGLM, Dolly, and Claude, which produced machine-generated essays in response. This generation strategy allowed for the generation of a diverse corpus of LLM-generated essays linked to the topics of the initial source documents.

DetectRL [32]. It comprises human-written samples from four sources: arXiv academic abstracts (2002-2017), XSum news, Writing Prompts stories, and Yelp Reviews. These domains were specifically chosen because they are considered particularly susceptible to generating deceptive text when LLMs are misused. For each source dataset, it chooses 2,800 human-written samples as HGTs. For MGTs, it selects four LLMs that widely used in the real world, including GPT-3.5turbo (ChatGPT), PaLM-2-bison (PaLM), Claude-instant (Claude), and Llama-2-70b (Llama-2), to generate machine texts. In addition, the dataset includes various practical attack scenarios. The first is the paraphrase attack, which uses the Dipper paraphraser [41] and Google Translate's Back-translation to rewrite the generated MGT. The second is the mixed text, which randomly replaces a quarter of the original machine-generated text with human-written text, but its label remains in the "machine-generated" category.

D.2 Baselines

To verify the effectiveness of the proposed strategy, we compare it with metric-based methods such as Likelihood, Log-Rank, Entropy, NPR, DetectGPT, and Fast-DetectGPT, as well as model-based methods such as ChatGPT-D, MPU, and RADAR.

Likelihood [8]. It employs LLM to quantify the log probability at the token level. To derive a detection score for a given text, these individual token log probabilities are then averaged. Notably, a higher score suggests that the text is more likely to have been machine-generated.

Log-Rank [11]. It assigns a score to a text by averaging values derived from the log rank of each token. Specifically, for each token, based on the context that precedes it, a language model provides a rank for that word among its possible predictions. The logarithm of this predicted rank is then taken. The text's score is the mean of these log-rank values across all words. It should be noted that a lower score indicates a higher probability of the text being machine-generated.

Entropy [9]. Similar to the Log-Rank score, the Entropy score for a text is the average of the conditional entropy for each token, given its prior context. It is worth noting that machine-generated texts are likely to have a lower Entropy score.

DetectGPT [11]. It assesses a text by quantifying how minor perturbations affect its log probability under the LLM. The core intuition posits that text generated by an LLM typically resides near local optima within the model's log probability landscape. Consequently, applying small alterations to model-generated text tends to result in a reduced log probability according to the model, compared to the original text. Conversely, applying similar minor perturbations to human-written text does not consistently lead to a decrease and may result in the log probability being either higher or lower than that of the original text.

NPR [33]. Similar to DetectGPT, the Normalized Perturbed Log-Rank (NPR) method also applies perturbations to the original text. The rationale behind NPR is that both MGTs and HGTs are susceptible to minor disturbances, which is indicated by an increase in their Log-Rank score after such perturbations. However, this effect is notably more pronounced in MGTs.

Fast-DetectGPT (FastGPT) [34]. It reveals the limitation of DetectGPT's intensive computational cost, uses the conditional probability curvature metric to identify the difference in token selection between LLMs and humans in a given environment, and proposes to use a more efficient sampling step instead of the perturbation step of DetectGPT.

ChatGPT-D [20]. It is built upon a RoBERTa model that was fine-tuned using the HC3 dataset, and solely utilizes the pure answered text from the dataset.

MPU [35]. The Multiscale Positive-Unlabeled (MPU) training framework attempts to solve the difficulty of short text detection without sacrificing long text. First, it considers the similarity between short machine text and human text, regards this part of short text as partially "unlabeled", and reformulates AI text detection as a partially positive unlabeled (PU) problem. Then, in this PU context, it uses a length-sensitive multi-scale PU loss to train the detection model.

RADAR [19]. It trains a robust MGT detector through an adversarial learning strategy. Specifically, it includes a paraphraser and a detector, where the paraphraser aims to generate real content to evade AI text detection, while the detector tries to detect this part of the content. Both sides improve the robustness of the model in this adversarial training environment.

The implementation of these baseline methods is mainly based on the MGT detection benchmark [66], while Fast-DetectGPT is based on the DetectRL benchmark [32]. In order to compare them fairly with our enhancement methods, we also fine-tune these model-based methods on the given dataset. The learning rate, training epochs and other parameter settings of the enhancement strategy are consistent with them, as shown in Appendix D.4.

D.3 Evaluation Scenario

To comprehensively evaluate the effectiveness of the proposed framework, we conduct experiments in the following practical scenarios:

Cross-LLM . We trained the detector on texts generated by one LLM and tested it on texts generated by various LLMs to evaluate its cross-LLM generalization performance. The main text presents our results of training on the DetectRL dataset based on PaLM and testing on other LLMs (see Table 1), as well as the results of training on the Essay dataset based on GPT4All (see Tables 2). Additionally, we provide the complete results of training and testing on texts generated by all LLMs in Tables 6-34 in the Appendix. These experiments cover both sentence-level and paragraph-level granularity. For sentence-level experiments, we selected sentences with a token number of at least 5 as valid samples. For paragraph-level experiments, we used the original text without any modifications.

Cross-Domain . The DetectRL dataset comprises four different domains: arXiv academic abstracts, XSum news articles, Writing Prompts stories, and Yelp Reviews. We use this dataset to evaluate the model's cross-domain performance by training the detector on texts from a source domain and testing it on texts from the remaining target domains. In this cross-domain evaluation setup, all MGTs are generated using the default PaLM model. Fig. 6 and Fig. 14 present the heatmap that visually illustrates the relative performance improvements of the proposed framework when applied to various baseline detection models.

Paraphrase Attack . It involves paraphrasing text to preserve its original meaning. We conduct experiments on the DetectRL dataset, which contains paraphrased data from Polish and Back Translation. As in the existing adversarial attack setting, we train on clean text and evaluate its robustness on paraphrased text. Specifically, the detector is trained on the clean PaLM texts and tested on the paraphrasing texts of various LLMs, with results shown in Fig. 5 and Fig. 13.

Mixed Text . In the real world, text is often not purely generated by humans or machines independently, which makes mixed text very common in practice. The DetectRL dataset contains mixed text by replacing one quarter of the sentences in an LLM-generated text with human-written text at random. In this scenario, we perform two settings: (1) The detector was trained on original (non-mixed) text and tested on mixed text; and (2) The detector was trained and tested on mixed text. Fig. 4 and Fig. 12 show the performance under mixed settings, where for each sub-figure, the left group denotes detectors trained on mixed texts, and the right group denotes detectors trained on original texts.

D.4 Implementation Details

Supervisor Implementation . As a supervisor providing reliable guidance to the detector, we model it as a three-layer fully connected neural network in this work. Although it appears simple, this choice is made after in-depth consideration of many aspects:

Performance . Firstly, providing reliable supervision signals depends on the supervisor having satisfactory performance itself. Based on this consideration, there is a tendency to select models with higher expressive capacity as the supervisor. However, the core idea of the proposed enhancement framework is to improve the quality of input data by maximizing the supervisor's performance, thereby promoting the improvement of the detector. If the supervisor's model is over-parameterized, it may prioritize adjusting its parameters to directly fit imperfect data, rather than effectively transmitting signals to the detector to improve data. This may weaken the enhancement effect. For example, if the number of original text segments that constitute a longer text is 4 (i.e., k = 4 ), and the average accuracy of the current detector for these text segments is 50%, this means that the supervisor's long text has only 2 text segments on average, which is defective. In this case, an over-parameterized supervisor model may directly fit this defective data through parameter memory, rather than improving this defective data through optimization (i.e., approaching the length of 4). Based on this consideration, the supervisor tends to be a simple model, which is inconsistent with the above considerations. Thus, as a compromise, we adopt a three-layer fully connected neural network. On the one hand, benefiting from the proposed two data quality enhancements (Theorem 3.1 and Theorem 3.3), even a three-layer network can achieve satisfactory performance, as shown in Appendix D.9.1. On the other hand, the design of this simple model prevents the weakening of enhancement effects on the detector typically caused by over-parameterized models.

Efficiency . As an enhancement framework, minimizing the introduced training delay is preferable. As discussed in Section 3.3, the longer text for the supervisor is constructed within the batch, and the intermediate results f ( x ( j ) , θ f ) from the detector can be reused. This ensures negligible overhead during the data preparation phase. The primary training delay is the supervisor model's forward and backward passes. This implies that simpler models can achieve reduced training delays. Therefore, we chose a three-layer fully connected neural network, whose training delay is almost negligible, as shown in Table 3 and Table 36.

In summary, using a three-layer fully connected neural network as the supervisor is a comprehensive consideration of performance and efficiency. In the specific implementation of the supervisor, the size of the three hidden layers are 256, 64, and 2, respectively. The input of the supervisor needs to convert the text into the embedding, which is obtained by the tokenizer of the detector and using the embedding layer of the detector. Let e ( x ) represent the embedding of text x , then Eq. 3 can be rewritten as:

Here, the text slicing operator ⊕ is a vector concatenation operation.

Hyperparameter Setting . We fixed five different random seeds (1-5) and conducted five independent repeat experiments. For the DetectRL and Essay datasets, we randomly selected 10% of the data as the training set, with the remaining 90% evenly divided into validation and test sets. To ensure a

5

0

5

10

x

7.5

5.0

2.5

0.0

2.5

5.0

7.5

10.0

y

Label

Machine

Human

0.0

0.2

0.4

0.6

0.8

1.0

Probability

0

50

100

150

200

250

300

350

Count

Label

Human

Machine

5

0

5

10

15

20

x

4

6

8

10

12

14

16

y

Label

Machine

Human

0.0

0.2

0.4

0.6

0.8

1.0

Probability

0

50

100

150

200

250

300

350

Count

Label

Human

Machine

(a) PaLM Text

(b) Mixed PaLM Text

5

0

5

10

15

x

6

8

10

12

14

16

y

Label

Machine

Human

0.0

0.2

0.4

0.6

0.8

1.0

Probability

0

50

100

150

200

250

300

350

Count

Label

Human

Machine

10

5

0

5

10

x

2

0

2

4

6

8

10

y

Label

Machine

Human

0.0

0.2

0.4

0.6

0.8

1.0

Probability

0

50

100

150

200

250

300

350

Count

Label

Human

Machine

(a) Claude T ext

fair comparison with baseline models, the enhanced models used the same hyperparameters as their corresponding base models. Specifically, all models were fine-tuned for 5 epochs, with a batch size set to 32. Regarding learning rates, we set 5e-6 for relatively smaller models like ChatGPT-D and MPU. For the larger RADAR model, we found that a learning rate of 5e-6 led to unstable training, so a smaller learning rate of 1e-6 was chosen. For supervisor-related hyperparameters, the default settings are as follows: the number of texts in longer texts ( k = 3 ), the number of longer texts per batch ( N ′ = 128 ), and the weight ( λ = 10 ). For performance analysis under more hyperparameter settings, please refer to Appendix D.9.

D.5 More Results of Boundary Fuzziness

Continuing the discussion on the blurred boundaries between MGT and HGT mentioned in the introduction, Fig. 8, Fig. 9, and Fig. 10 further show the boundary fuzziness evaluation results on more LLM texts. To enhance the persuasiveness of the visualization results, the analyses characterizing the latent space distribution and prediction confidence distribution are based on the RADAR [19], which performed best in our experiments. The analysis results across various LLMs consistently indicate that there is a general blurriness in the boundary between MGT and HGT.

Continuing the discussion in the introduction about the inexactness of hard-label-based training, Fig. 11 further presents experimental results on mixed texts of additional LLMs. It can be observed that in most settings, even the simple application of label smoothing can improve detection performance. This result also indicates that traditional hard-label-based learning may be inexact.

D.6 More Performance Comparisons

Sentence-level Detection . Continuing the sentence-level detection setting discussed in Section 4.1, Tables 6-12 (left) and Tables 13-23 provide a detailed comparison of the performance of various detectors trained on texts generated by different LLMs in the DetectRL and Essay datasets, respectively. From these tables, it can be observed that the experimental results are consistent with the main conclusions in the main text. Notably, in a total of 312 cross-LLM detection settings, the proposed enhancement strategy outperformed the corresponding baseline models in 87% of the cases. This widespread and consistent improvement highlights the general applicability and practical value of the proposed enhancement framework.

Paragraph-level Detection . Continuing the paragraph-level detection setting in Section 4.1, Table 612 (right) shows the performance comparison of detectors trained with various LLMs in the DetectRL

5

0

5

10

x

0

2

4

6

8

10

12

y

Label

Human

Machine

0.0

0.2

0.4

0.6

0.8

1.0

Probability

0

100

200

300

400

Count

Label

Human

Machine

0

5

10

15

x

7.5

10.0

12.5

15.0

17.5

20.0

y

Label

Human

Machine

0.0

0.2

0.4

0.6

0.8

1.0

Probability

0

50

100

150

200

250

300

350

Count

Label

Human

Machine

(a) Llama-2 T ext

(b) Mixed Llama-2 Text

0.0

0.1

0.2

0.3

0.4

0.5

0.6

0.7

TPR@FPR-1%

ChatGPT

PaLM

detector

Hard

Soft

0.64

0.72

0.80

0.88

0.96

AUROC

ChatGPT

PaLM

detector

Hard

Soft

0.0

0.1

0.2

0.3

0.4

TPR@FPR-1%

ChatGPT

PaLM

detector

Hard

Soft

0.64

0.72

0.80

0.88

0.96

AUROC

ChatGPT

PaLM

Detector

Hard

Soft

(a) PaLM Text Training

dataset, while Table 24-34 shows the performance comparison in the Essay dataset. We can also get the same conclusion as the main text. In addition, similar to the sentence-level setting, under the 312 cross-LLM settings, the proposed enhancement strategy outperforms the basic model in 85% of the settings. This extensive enhancement effect is very valuable.

Mixed Text Detection . Continuing the mixed detection settings from Section 4.1, Fig. 12 presents a performance comparison of various methods on mixed texts based on the AUROC metric. Similarly, compared to the performance improvement on original texts (see the right part of Table 6), the proposed method demonstrates a more significant enhancement in detecting mixed texts, highlighting the rationality of our design.

Paraphrasing Text Detection . Section 4.1 has demonstrated robustness enhancement against paraphrase attacks in terms of TPR@FPR-1%. Here we supplement with Fig. 13, showing AUROC performance under the same attack settings. Similarly, the AUROC metric also indicates that the proposed strategy enhances the robustness of the original detection models.

Cross Domain Detection . In addition to the cross-domain performance on RADAR shown in Section 4.1, Fig. 14 illustrates the proposed strategy's enhancement of cross-domain performance for ChatGPT-D and MPU. Similar findings can be observed, where the enhanced versions exhibit better cross-domain generalization capabilities in most settings.

Test on Newer LLMs . Based on the Essay prompts, we employed the latest LLMs-GPT-4o, GPT4.1, DeepSeek-R1, and Llama4 Maverick-to generate machine text. The detection results are shown in Table 35, where detectors are trained on GPT4All texts from the Essay dataset. As can be seen, our proposed enhancement strategy remains significantly effective on these newer LLMs. Moreover, compared to the LLMs used in Table 2, the detection performance on these more advanced LLMs has declined, underscoring the ongoing arms race between detection and large-model development: detectors design stronger strategies based on current generation models, and then newly emerging LLMs produce higher-quality text that is harder to distinguish, thus driving further progress on both sides.

Running Time . Table 36 presents a comparison of the runtime (including inference and training time) of various detection models under the sentence-level setting. Similar to the paragraph-level setting, the additional training delay introduced by the enhancement strategy at the sentence level is minimal. This is primarily due to the lightweight design of the supervisor model and the method of constructing long text data within batches during training.

D.7 Performance under Noisy Labels

Our framework assumes that hard labels are correct by default. To this end, this section verifies the detection performance in the presence of noisy labels. We randomly flipped 10% of the labels and then evaluated detectors trained on these noisy data, as shown in Fig. 15. First, we found that the proposed enhanced framework remained effective. Second, compared to the noiseless results in Table 1, our method is generally less affected by noise, verifying our mitigation efforts.

D.8 Comparison with Noisy Label Learning

In addition to discussing the challenges of noisy label learning (NLL) techniques in Appendix A.4, we also evaluated them experimentally. We selected two typical NLL methods: Co-teaching [44] and SAM [29], applying them to the ChatGPT-D baseline model for evaluation, denoted as ChatGPT-Co and ChatGPT-SAM, respectively. The performance comparison is shown in Fig. 16. It can be observed that the direct application of these NLL techniques not only failed to improve performance but, in most cases, even led to a decline in detector performance. This is mainly because the core objective of NLL techniques is to identify and correct limited erroneous labels in training data. However, in the context of MGT detection, the labels themselves are correct; the issue lies in widespread labeling inexactness. Therefore, NLL strategies designed based on the assumption of erroneous labels do not align with the nature of imperfect labels (ambiguity) in MGT detection, making them difficult to effectively apply to tasks aimed at enhancing MGT detection.

D.9 Sensitivity Analysis

D.9.1 About the Supervisor

Sensitivity w.r.t. Original Text Number k for Longer Text . A core idea in the design of the supervisor is to use longer texts to enhance data quality. Theorem 3.1 theoretically demonstrates that

this strategy can lead to better feature discrimination, thereby mitigating the negative effects of hard labels and fostering effective learning. To empirically verify these theoretical findings, we analyze the impact of the number of original texts constituting longer texts (i.e., the value of k ) on supervisor performance, as shown in Fig. 17. Experimental results align with theoretical predictions: increasing the number of original text segments k that constitute longer texts helps improve the supervisor's learning performance.

Sensitivity w.r.t. the Number of Longer Texts N ′ Per Batch . Increasing the number of longer texts processed by the supervisor (reflected in the number of longer texts per batch, N ′ ) should enhance its detection capability. To investigate this, we experimented with different settings of N ′ to evaluate the supervisor's performance, as shown in Fig. 18. The experimental results meet expectations: as the value of N ′ increases, the detection performance of the supervisor indeed improves.

Sensitivity w.r.t. Supervisor Loss Coefficient λ . In the joint training process shown in Eq. 5, the weight λ of the supervisor loss term directly determines the emphasis on supervisor training within the overall optimization objective. To explore its impact on the supervisor's performance, we experimented with different λ settings to evaluate the supervisor's performance, as illustrated in Fig. 19. it can be observed that in the relatively weaker ChatGPT-D, the supervisor requires a larger λ . In contrast, for the relatively stronger MPU and RADAR, the supervisor's performance initially improves with an increase in λ value but reaches saturation and does not show significant further improvement. This might be related to the implementation of the supervisor, which, as explained in Appendix D.4, uses the input embeddings from the detector as its embeddings. In the stronger MPU and RADAR, the higher quality of embeddings provides a better initialization for the supervisor's learning, alleviating the overly large focus on the supervisor.

D.9.2 About the Detector

Sensitivity w.r.t. Original Text Number k for Longer Text . According to our theoretical results (Theorem 3.1), longer text lengths help achieve greater distribution distance for text data, thereby simplifying the supervisor's learning difficulty and laying the foundation for providing reliable supervision to the detector (empirically proved in Fig. 17). To this end, we explore the impact of different original text numbers k for longer text on detector performance, as shown in Fig. 20. The setup with k = 0 represents the original detector baseline without using the enhancement strategy. The experimental results align with the theoretical predictions: using longer texts for supervised learning enhances the supervisor's performance (Fig. 17), thereby providing more reliable supervisory signals and ultimately improving detector performance.

Sensitivity w.r.t. the Number of Longer Texts N ′ Per Batch . The performance of the supervisor significantly impacts the target detector's performance, and the supervisor's own effectiveness largely depends on the amount of longer texts (proved in Fig. 18). Here we aim to explore the impact of varying quantities of longer text data on the performance of the detector, as shown in Fig. 21. N ′ = 0 represents the original model without enhancement. The results are as expected: as the amount of long text data used for training the supervisor increases, the detector's learning is better supported, leading to improved performance. This can also be seen from the consistent trend of changes in Fig. 18 and 21. Although increasing the data volume might introduce additional computational overhead, as indicated in our previous runtime analysis, even with relatively large data settings (e.g., N=128), the additional training delay remains minimal.

Sensitivity w.r.t. Supervisor Loss Coefficient λ . We also investigated the impact of the supervisor's loss term coefficient λ on detector performance, as illustrated in Fig. 22. We can also find that the detector's performance change curve is consistent with the change of the supervisor (Fig. 19), which also indirectly emphasizes the guiding role of the supervisor on the detector.

D.10 Ablation Study of Supervisor

In our framework design, we aim to encourage the detector to correctly classify each sample within longer texts, rather than strictly requiring the predicted probability of the correct class to approach 1. This raises the question of whether directly using the loss function only focused on the class could achieve similar goals. Therefore, we conduct an ablation study using two class-only loss functions to highlight the role of the supervisor in enhancement.

First, we define the training loss of the baseline model after removing the supervisor module as follows:

To ensure that gumbel( f ( x ( j ) i , θ f )) is meaningful, the non-hard-label version of Gumbel-Softmax is used.

Second, we use Hinge loss to replace L supv. as follows,

These two variants are defined as Gumbel and Hinge. Aside from the form of the supervisory signal, all other experimental settings (such as k , N ′ , λ ) remain consistent. The experimental results are shown in Fig. 23. It can be observed that using these alternative loss functions focused solely on class can enhance detection performance in some settings, yet there are instances of instability. For example, applying the Hinge loss to the RADAR model on the Essay dataset resulted in a performance decline. Furthermore, even though these alternatives provided performance improvements in certain

settings, their enhancement effects were generally inferior to our proposed strategy. This is because our strategy not only focuses on correct classification but, more importantly, guides the model's predicted probabilities to approximate the underlying true labels through the supervisor's signal (see Theorem 3.4), offering richer supervisory information.

Mix Train

Ori. Train

Mixed PaLM Text

0.80

0.84

0.88

0.92

0.96

1.00

AUROC

Mix Train

Ori. Train

Mixed ChatGPT Text

0.80

0.84

0.88

0.92

0.96

1.00

AUROC

Mix Train

Ori. Train

0.66

0.72

0.78

0.84

0.90

0.96

AUROC

Mix Train

Ori. Train

Mixed Llama-2 Text

0.90

0.92

0.94

0.96

0.98

1.00

AUROC

ChatGPT-D

ChatGPT-E

MPU

MPU-E

RADAR

RADAR-E

Back Translation

Polish

PaLM Text

0.80

0.84

0.88

0.92

0.96

1.00

AUROC

Back Translation

Polish

ChatGPT Text

0.84

0.88

0.92

0.96

1.00

AUROC

Back Translation

Polish

0.64

0.72

0.80

0.88

0.96

AUROC

Back Translation

Polish

Llama-2 Text

0.90

0.92

0.94

0.96

0.98

1.00

AUROC

ChatGPT-D

ChatGPT-E

MPU

MPU-E

RADAR

RADAR-E

arxiv

writing

xsum

yelp

Test Domain

arxiv

writing

xsum

yelp

Train Domain

-0.36

0.80

0.08

0.32

0.44

-0.18

0.85

0.16

-0.19

-0.52

1.49

-0.63

0.69

0.65

2.09

0.62

1.00

0.75

0.50

0.25

0.00

0.25

0.50

0.75

1.00

AUROC

arxiv

writing

xsum

yelp

Test Domain

arxiv

writing

xsum

yelp

-0.25

-2.10

-0.74

-1.01

2.37

0.17

0.40

1.38

0.35

-0.05

1.14

0.49

3.24

3.66

0.54

5.36

3

2

1

0

1

2

3

TPR@FPR-1%

arxiv

writing

xsum

yelp

Test Domain

arxiv

writing

xsum

yelp

0.86

-0.02

-0.59

0.21

0.29

0.59

0.28

0.77

0.86

0.38

0.55

0.94

0.70

0.79

0.70

1.63

1.00

0.75

0.50

0.25

0.00

0.25

0.50

0.75

1.00

AUROC

arxiv

writing

xsum

yelp

Test Domain

arxiv

writing

xsum

yelp

0.07

-0.17

1.19

0.40

-0.59

3.11

3.09

0.44

0.05

0.00

9.10

0.69

1.06

0.25

3.44

2.89

3

2

1

0

1

2

3

TPR@FPR-1%

(a) ChatGPT-E

(b) MPU-E

ChatGPT

MPU

RADAR

Test text: Google-PaLM

30

45

60

75

TPR@FPR-1%

ChatGPT

MPU

RADAR

Test text: ChatGPT

15

30

45

60

75

TPR@FPR-1%

ChatGPT

MPU

RADAR

Test text: Claude-instant

8

16

24

32

40

TPR@FPR-1%

ChatGPT

MPU

RADAR

Test text: Llama-2-70b

45

60

75

TPR@FPR-1%

w/o Enhance

w Enhance

Paragraph

Sentence

Setting

0.69

0.72

0.75

0.78

0.81

0.84

AUROC

Paragraph

Sentence

Setting

0.00

0.05

0.10

0.15

0.20

0.25

TPR@FPR-1%

Paragraph

Sentence

Setting

0.72

0.76

0.80

0.84

0.88

AUROC

Paragraph

Sentence

Setting

0.00

0.08

0.16

0.24

0.32

0.40

TPR@FPR-1%

(a) DetectRL Dataset

(b) Essay Dataset

ChatGPT-D

ChatGPT-Co

ChatGPT-SAM

ChatGPT-E

0.75

0.90

0.2

0.4

0.7

0.8

0.1

0.2

0.88

0.96

AUROC

0.3

0.6

TPR@FPR-1%

0.8

0.9

AUROC

0.2

0.4

TPR@FPR-1%

1

2

3

4

5

k

0.8

0.9

1

2

3

4

5

k

0.3

0.6

1

2

3

4

5

k

0.8

0.9

1

2

3

4

5

k

0.3

0.6

(a) DetectRL Dataset

(b) Essay Dataset

ChatGPT-E

MPU-E

RADAR-E

0.78

0.84

0.1

0.2

0.76

0.80

0.05

0.10

0.91

0.92

AUROC

0.30

0.45

TPR@FPR-1%

0.84

0.87

AUROC

0.08

0.16

TPR@FPR-1%

2

4

8

16

32

64

128

N

′

0.90

0.93

2

4

8

16

32

64

128

N

′

0.2

0.4

2

4

8

16

32

64

128

N

′

0.90

0.93

2

4

8

16

32

64

128

N

′

0.1

0.2

(a) DetectRL Dataset

(b) Essay Dataset

ChatGPT-E

MPU-E

RADAR-E

0.60

0.75

0.1

0.2

0.75

0.80

0.10

0.15

0.900

0.925

AUROC

0.3

0.4

TPR@FPR-1%

0.84

0.88

AUROC

0.1

0.2

TPR@FPR-1%

0.1

0.5

1

5

10

20

50

0.88

0.92

0.1

0.5

1

5

10

20

50

0.2

0.3

0.4

0.1

0.5

1

5

10

20

50

0.88

0.92

0.1

0.5

1

5

10

20

50

0.1

0.2

(a) DetectRL Dataset

(b) Essay Dataset

ChatGPT-E

MPU-E

RADAR-E

0.72

0.76

0.08

0.11

0.72

0.76

0.10

0.12

0.86

0.87

AUROC

0.24

0.28

TPR@FPR-1%

0.82

0.84

AUROC

0.15

0.18

TPR@FPR-1%

0

1

2

3

4

5

k

0.87

0.88

0

1

2

3

4

5

k

0.28

0.32

0

1

2

3

4

5

k

0.88

0.90

0

1

2

3

4

5

k

0.27

0.30

(a) DetectRL Dataset

(b) Essay Dataset

ChatGPT-E

MPU-E

RADAR-E

0.72

0.76

0.09

0.11

0.74

0.76

0.11

0.12

0.86

0.87

AUROC

0.21

0.24

0.27

TPR@FPR-1%

0.82

0.84

AUROC

0.15

0.18

TPR@FPR-1%

0

2

4

8

16

32

64 128

N

′

0.86

0.87

0.88

0

2

4

8

16

32

64 128

N

′

0.28

0.32

0

2

4

8

16

32

64 128

N

′

0.88

0.89

0

2

4

8

16

32

64 128

N

′

0.24

0.28

(a) DetectRL Dataset

(b) Essay Dataset

ChatGPT-E

MPU-E

RADAR-E

0.72

0.76

0.09

0.11

0.73

0.76

0.10

0.12

0.86

0.87

AUROC

0.21

0.24

0.27

TPR@FPR-1%

0.82

0.84

AUROC

0.15

0.18

TPR@FPR-1%

0.0 0.1 0.5

1

5

10

20

50

0.86

0.87

0.88

0.0 0.1 0.5

1

5

10

20

50

0.28

0.32

0.0 0.1 0.5

1

5

10

20

50

0.88

0.90

0.0 0.1 0.5

1

5

10

20

50

0.27

0.30

(a) DetectRL Dataset

(b) Essay Dataset

ChatGPT-E

MPU-E

RADAR-E

ChatGPT-D

MPU

RADAR

Original Detector

0.80

0.84

0.88

0.92

0.96

1.00

AUROC

detector

origin

Hinge

Gumbel

Ours

ChatGPT-D

MPU

RADAR

Original Detector

0.2

0.3

0.4

0.5

0.6

0.7

TPR@FPR-1%

detector

origin

Hinge

Gumbel

Ours

ChatGPT-D

MPU

RADAR

Original Detector

0.80

0.84

0.88

0.92

0.96

1.00

AUROC

detector

origin

Hinge

Gumbel

Ours

ChatGPT-D

MPU

RADAR

Original Detector

0.40

0.48

0.56

0.64

0.72

0.80

TPR@FPR-1%

detector

origin

Hinge

Gumbel

Ours

(a) DetectRL Dataset

(b) Essay Dataset

Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper presents a new algorithm for classification-based detection of AI-generated text.\n\nThe key intution in the paper's method is that longer chunks of text provide a more reliable supervision for detecting AI-written text, a fact that's been well established in prior literature.\n\nThis paper's converts this intuition into a training-time algorithm. During training, gumbel-softmax sampled predictions over continguous text chunks are aggregated based on the detector's current weights, and then sent to an external \"supervisor\" network. The supervisor and detectors are then jointly optimized, with a much higher weight (10:1) on the supervisor network.\n\nInstead of optimizing on potentially noisy individual text labels, the detector is incentivized to optimize for detecting a longer chunk more holistically --- potentially learning more generalizable features.\n\nSTRENGTHS AND WEAKNESSES:\n*Strengths*\n\n1. This is a pretty interesting and novel formulation for AI-generated text detection modeling. It's a nice conversion of the \"long text is easier to detect\" to an operational learning algorithm. I couldn't think of any cleaner alternative formulations during the review.\n\n2. The proposed formulation seems to beat ablated baselines across all tested settings, proving its effectiveness.\n\n3. The paper has great experimental breadth, including experiments on multiple datasets, base LLMs, detector baselines. The paper also includes experiments on paraphrased outputs and mixed-text detection which strengthens the contribution.\n\n4. The proposed method has no extra latency at inference time, and only a slight increase in training time latency.\n\n*Weaknesses*\n\n1. The base LLMs (whose text is being detected) in this paper are quite old --> ChatGPT / GPT-turbo / Claude / PaLM are models from 2022-2023. Do these methods generalize to newer LLMs from 2024/2025, which likely have a very different distribution?\n\n2. The paper was lacking in qualitative analysis and the kinds of features being learnt by this detector (vs the baseline). I would imagine this detector has learnt more robust / generalizable features pertaining to AI-generated text rather than overfit to noisy datapoints. Is there any qualitative evidence / win-analysis over individual test datapoints to justify this?\n\n3. The paper's presentation could really be improved, it was really hard to understand the paper's contributions from the abstract/introduction. I felt the authors were underselling their work by talking mostly about previous efforts. The mathematical notation and naming is also confusing. For instance, the notation in L179, the use of `'` is too subtle to distinguish differences between detector and supervisor labels. Also in L244 the naming isn't great, looking at the table it's hard to understand `-E` refers to the method proposed in this work.\n\n4. As a thought experiment, would this method work at scale? While I agree that supervising long-form detection indirectly is a good inductive bias in this setup, tradtionally inductive biases have usually lost out to scaled training (http://www.incompleteideas.net/IncIdeas/BitterLesson.html).\n\nQUESTIONS:\nSee review above\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "CLARITY": 2, "IMPACT": 2, "ORIGINALITY": 4, "DATE": "2025-06-29"}

comments: SUMMARY:
In this work, the authors propose an easy-to-hard enhancement framework for training a detector on machine-generated text. It employs an easy supervisor targeting longer-text detection tasks to enhance the more challenging target detector. Extensive experiments validate the effectiveness of the proposed approach.

STRENGTHS AND WEAKNESSES:
# Strengths

1. The paper is well-written and easy to follow.

2. The proposed easy-to-hard claim seems to be reasonable and practical.

# Weakness

1. The authors claim that the label of machine-generated text is hard to obtain but I cannot figure out the reason. I can simply use the text generated by LLM as the machine generated text. Do your indicate that it might be hard to find some human generated text currently?

2. It is unclear how the supervisor helps improve the detector using the same dataset as depicted in Algorithm 1.

3. Why does a single weak model (supervisor) can lead to a powerful model (detection).

4. It might be unfair for comparison by using the baselines trained on different datasets.

QUESTIONS:
See weakness

LIMITATIONS:
N/A
TITLE: Official Review
CLARITY: 3
IMPACT: 3
ORIGINALITY: 3
DATE: 2025-07-02

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper tackles the challenge of detecting machine-generated text (MGT) under inexact or ambiguous labeling. The authors propose an easy-to-hard supervision framework where a simpler supervisor, trained on longer and more distinguishable texts, guides the training of a more complex target detector operating on shorter. The framework is theoretically justified and empirically validated across diverse datasets, tasks, and attack settings, showing consistent improvements over baseline detectors.\n\nSTRENGTHS AND WEAKNESSES:\nWeaknesses:\n1.\tFigure 1 is the estanblised information from model collapse papers[1] [2];\n2.\tTheorem 3.1 Distribution Difference for Longer Text lacks of emprical supports.\n3.\tThe Easy-to-Hard Supervision Framework seems a bit complex. The paper assumes the existence of underlying \"golden\" labels approximated by machine-likeness, but this definition may lack grounding in real-world annotation practices. I’m just wondering—would using only supervised fine-tuning (SFT) be sufficient to achieve good performance on your collected data?\n\n\nStrengths:\n1.\tThis paper provides solid formal theorems to justify why longer texts are more discriminative and how the supervisor’s performance bounds the detector.\n2.\tAuthors conduct comprehensive experiments across tasks, detectors, and attack scenarios, with consistent gains.\n[1] Shumailov I, Shumaylov Z, Zhao Y, et al. AI models collapse when trained on recursively generated data[J]. Nature, 2024, 631(8022): 755-759.\n[2] How to Synthesize Text Data without Model Collapse?, ICML, 2025\n\nQUESTIONS:\n1.\tThe paper builds on the premise that label ambiguity between human- and machine-generated text necessitates an easy-to-hard supervision framework. However, given the increasing fluency of modern language models, aren't there some case where human and AI texts are inherently indistinguishable? How does the proposed method address such ambiguity?\n2.\tHow do the authors justify that longer texts improve separability between human and machine-generated content? Given that prior work [1] [2] links their difference to long-tail distributions, what is the connection between longer-text construction and capturing those distinctive patterns?\n3.\tWhile the paper provides extensive quantitative results, are there any concrete case studies ？These case studies may conduct between the proposed method and baselines. Such comparisons would help illustrate how the method improves detection in practice.\n4.\tTo what extent does the effectiveness of the proposed method depend on the quality of the original labels? Given that even humans often fail to distinguish between real and machine-generated texts, how does the framework handle ambiguous?\n\nLIMITATIONS:\n1.\tWhile text length correlates with detectability supported theoretically, real-world MGT (e.g., headlines or tweets) often appear in short form, where this assumption may break down.\n2.\tAlthough the paper constructs longer texts from labeled data, if the original labels are flawed or biased, the framework may reinforce these issues.\n3.\tSome theoretical results assume idealized conditions (e.g., total variation distances, independence), which may not strictly hold in practice. These need some evidences empirically.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 2, "ORIGINALITY": 3, "DATE": "2025-07-02"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper proposes an easy-to-hard enhancement framework for machine-text detectors. It enhances the performance a detector by relying on supervision signals coming from another that is trained to distinguish longer texts. Relying on previous theoretical insights regarding the increase in distributional distance as the size of the text increases, the authors propose a framework where optimizing the supervisor indirectly optimizes the detector.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n\n•\tThe method is generally interesting and novel, and is a nice extension of Chakraborty’s work (https://arxiv.org/pdf/2304.04736) for enhancing the robustness of detectors. \n\n•\tThe author’s deal with the inherent uncertainty in the labels of human-written and machine-generated text, better focusing in on the more relevant case where the label is in fact smooth (partial machine and human).\n\nWeaknesses:\n\n•\tW1- I found the language of this paper very hard to follow, and it needs a lot of polishing before it’s published. \n\n•\tW2- Line 47 states that Figure 2 is clear in showing that label smoothing exhibits better performance. It’s not clear from the figure that the label smoothing variants do exhibit better performance. In fact, the variance of the results is very high, and in fact, many of the medians are worse than those that use hard labels (left hand side in particular). In general, a lot of the results on mixed texts tend to be quite marginal (Figure 4), with strong models (RADAR) remaining close to the performance of their enhanced counterparts. \n\n•\tW3- When comparing against knowledge distillation, it would’ve been good to also report distilling a version of RADAR that has been trained on long texts against a version of RADAR that hasn’t to more closely mimic your approach. \n\n•\tW4- I found that many of the theorems are quite similar to Chakraborty’s (https://arxiv.org/pdf/2304.04736) and distract from the most important one being Theorem 3.4 (the effectiveness of the approach). For example, increasing the length of the text  amplifies the distributional distance is something that was already shown by Chakraborty. Similar comments hold for Theorem 3.2, in that the larger the k (the larger the text), the better the AUROC is also something that is known from Chakraborty. \n\n•\tW5 – Ablations regarding the number of texts concatenated are missing. Also, although randomly splicing sentences does preserve the label as machine-generated or human-written, it does shift the distribution of natural text generated by humans or machines.\n\nQUESTIONS:\n•\tClarification – In Equation 3, there is $x^j$ multiplied by the Gumbel sample, however, if I understand it correctly the $x^j$ is in fact a string. Or, was it mean that the supervisor takes the set of Gumbel-softmax samples from the detector, and then predicts human or machine?\n\n•\tGenerally, I think a stronger Knowledge Distillation baseline is needed (W3), more ablations are necessary (W5), and the writing has to be polished (W1). Tackling those, in that order, would ease some of my concerns.\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "CLARITY": 2, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-02"}