Stumbling Blocks: Stress Testing the Robustness of Machine-Generated Text Detectors Under Attacks (2024)

Abstract: The widespread use of large language models (LLMs) is increasing the demand for methods that detect machine-generated text to prevent misuse. The goal of our study is to stress test the detectors’ robustness to malicious attacks under realistic scenarios. We comprehensively study the robustness of popular machinegenerated text detectors under attacks from diverse categories: editing, paraphrasing, cogenerating, and prompting. Our attacks assume limited access to the generator LLMs, and we compare the performance of detectors on different attacks under different budget levels. Our experiments reveal that almost none of the existing detectors remain robust under all the attacks, and all detectors exhibit different loopholes. Averaging all detectors, the performance drops by 35% across all attacks. Further, we investigate the reasons behind these defects and propose initial out-of-the-box patches. 1

heading: 1 Introduction
text: LLMs are becoming increasingly adopted in information seeking scenarios, assistive writing, translation, mental health support, and many more (Zhao et al., 2023a). Their evolving capabilities to generate human-like and persuasive language raise wide concerns about misuse, e.g., deception, academic misconduct, and disinformation (Zellers et al., 2019; Weidinger et al., 2021; Kumar et al., 2022; Feng et al., 2024), and it becomes harder for humans to distinguish machine-generated texts (MGT) from human-written texts (HWT) (Dugan et al., 2023). As a result, much recent work focus on automatic MGT detection to mitigate the risks (Liu et al., 2022; Mitchell et al., 2023; Kirchenbauer et al., 2023a; Mao et al., 2024).
1Code and data are released at https://github.com/ YichenZW/Robust-Det. Yichen Wang and Tianxing He are the corresponding authors.
In this work, we focus on potential malicious attacks that attempt to deceive the detector using various attack strategies. Existing works on this topic mostly focus on the robustness of specific detectors or particular attack methods. For example, Liu et al. (2022) specifically evaluate the token editing attack for model-based detectors, and Zhang et al. (2023) consider the topic-shifting attack for metricbased detectors, etc. To the best of our knowledge, in the literature, there is no thorough comparative evaluation of robustness of machine-generated text detectors against malicious attacks, covering a wide range of detectors and attacks.
With this goal, we study the robustness of 8 prevalent MGT detectors from 3 categories under 12 realistic attacks (§6, Table 1), including editing, paraphrasing, co-generating, prompting, etc. The majority of the attacks in this paper are proposed or attempted for the first time. For a fair comparison across detectors and attacks, we utilize a series of metrics to measure the perturbation level of each attack, which we term “budget” (§4). Strikingly, our experiments (§6.1) reveal that almost none of the existing detectors remains robust under all the attacks, showing a variety of potential weaknesses or loopholes. For example, about 2 to 6-character editing2 by typo insertion can severely deceive metric-based detectors, such as DetectGPT
22 to 6-character editing takes up a proportion of 0.35% to 1.06% characters in a text sample on average.
2894
(Mitchell et al., 2023), to perform worse than a random prediction (§6.2), etc. Hence, we view the attacks as the stumbling blocks for current MGT detectors toward robustness. Moreover, we interpret the reasons behind detectors’ weaknesses under attacks and further introduce out-of-the-box patches with inferior performance in some scenarios.
We build a robustness leaderboard (Table 2, and the pipeline is illustrated in Figure 1) by averaging results from different attacks. We find that watermarking (Kirchenbauer et al., 2023a) performs best for robust MGT detection to its applicable attacks.3 Next, model-based detectors are more robust than metric-based ones in most cases. Overall, this study aims to raise awareness of the detection vulnerabilities and the urgency of more robust methodologies, thereby turning the stumbling blocks into stepping stones.

heading: 2 Problem Formulation
text: Threat Model. Figure 1 shows the overall pipeline. There are three roles in the problem: generator (§3), detector (§3), and attacker (Table 1, §6). The task for the detector is to classify whether a given
3Watermarking requires logit-level access to the generator model and has the risk of negatively impacting text quality.
piece of text is human-written (HWT) or machinegenerated (MGT) from the generator LM. In the attacked scenario, before the MGT is sent to the detector, an attacker could tamper with the text or the generator, attempting to deceive the detector into classifying the MGT as HWT. We compute the budget (§4) of each attack to measure its impact on text quality and semantics. Scope. For a realistic scenario, we set the scope of our robustness evaluation under attack as follows:
(i) We assume that the attacker does not have any knowledge or access to the detectors.
(ii) The attacker only has limited access to the generators: We assume to have prompting access with tunable sampling hyper-parameters for the following reason: currently, most top-performing LLMs accessible to users are closed-source (e.g., GPT-4, Claude), to which we only have API access or a panel including a prompt input and sampling settings (OpenAI, 2022a). Due to the same reason, adversarial attacks (Li et al., 2018; Le et al., 2022) are not covered in this study.
(iii) For a holistic comparison, we apply each attack on different perturbation levels (e.g.,
number of typos), termed as budgets (§4).

heading: 3 Generators and Detectors
text: We select GPT-2 XL (1.5B) (Radford et al., 2019), GPT-J (6B) (Wang and Komatsuzaki, 2021), and LlaMA-2 (7B-hf) (Touvron et al., 2023a) as the representative open-source generators, and TextDavinci-003 (OpenAI, 2022b) and GPT-4 (OpenAI, 2023) as the closed-source generator representatives. All the generators shared similar results under attacks (Appendix F.3). We select GPT-J (6B) as the default generator to show the results in §6 if unspecified (we empirically find metric-based detectors do not perform well on stronger generative LMs even without attacks). The results of LlaMA-2 and GPT-4 will be additionally shown in Appendix F.3 and §6. For closed-source generators, some of the detectors can not be applied due to the requirement of white-box parameters.
Current MGT detectors could be classified into 3 high-level categories, as we introduce below. We include representative detectors from each category for our evaluation. A detailed introduction of the detectors is deferred to Appendix B.2.1.
Metric-Based Detector relies on the inferred logprobability from the generator LLM, and adopts a threshold for classification.4 Detectors for this type do not require any training. We include GLTR (Gehrmann et al., 2019; Solaiman et al., 2019), Rank and LogRank (Solaiman et al., 2019), and DetectGPT (Mitchell et al., 2023) as representative approaches in the category.
Fine-Tuned Detector is trained on a pretrained language model (PLM) in a supervised method with a classification loss. We include OpenAI Detector (Solaiman et al., 2019), SimpleAI Detector (Guo et al., 2023), and Fine-tuned DeBERTa as representative models in the category.
Watermark-Based Detector adds algorithmically detectable signatures into texts during generation. Kirchenbauer et al. (2023a) is a representative approach, which adds a token-level bias in the decoding stage (represented as Watermark afterward).
We follow the recommended configurations for most detectors. Detailed hyperparameters are included in the Appendix B.2.2.
4The setting of threshold largely impacts the detection accuracy, but it is out-of-the-scope of this paper’s focus. Thus, we mainly use threshold-free metrics (e.g., AUC ROC and TPR@FPR) in experiments (detailed in §5).

heading: 4 Budget of Attacks
text: As stated in §2, to measure the perturbation level of attacks on the generated texts, we utilize a series of text generation evaluation metrics as the budget of attacks, covering syntactic- or semantic-level perturbation. A strong attack should induce large detection performance degradation with a relatively small budget.
For the editing attacks, we use Levenshtein Edit Distance (Levenshtein, 1965) as the major budget, which is the minimum number of single-character edits, including insertions, deletions, and substitutions. A larger distance represents a larger attack budget. Additionally, we also record Jaro Similarity (Jaro, 1989).5
To measure the quality of texts under the attacks that change the semantic meaning (e.g., prompting attacks and co-generating attacks), we utilize Perplexity under LlaMA-7B-hf (Touvron et al., 2023b) and MAUVE (Pillutla et al., 2021). We use MAUVE to compare the distribution gap between MGTs and HWTs. MGTs are used to estimate the model distribution, and HWTs are used to estimate the target distribution (the setting is abbreviated as ‘M2H’). Lower Perplexity or higher MAUVE (M2H) represents better quality and a smaller budget. Table 6 shows the unattacked value for reference.
For the attacks that do not change semantics meaning, e.g., paraphrasing, we use BERTScore (Zhang et al., 2019) as the major metric for the budget. We utilize it to compare the similarity between MGTs after the attack to MGTs before the attack. In this scenario, attacked MGTs are the candidates for BERTScore, while unattacked MGTs are the reference (the setting is abbreviated as ‘A2B’). The BERTScore we used is rescaled. A larger BERTScore (A2B) value means a smaller budget in the attack. Besides, we also record BARTScore (Yuan et al., 2021) and Cosine Similarity, which shows equivalent results.
See Table 17 for more details on the metrics for the attack budget. Appendix F.1 shows the correlation among all metrics, which share highly similar trends of attacked performance.

heading: 5 Experiment Setting
text: Data Setting. Following the setting of Pu et al. (2023), we generate News-style texts with a proper
5The edit distance, Jaro similarity, and cosine similarity are implemented based on the string2string (Suzgun et al., 2023) package.

heading: Leaderboard: MGT Detector Robustness
text: sampling strategy for each generator, detailed in Appendix B.1. Our study can be readily applied to data from other domains. The prompts used for MGT generation are the first 20 tokens of HWTs in the dataset. The setting of the sampling strategy aims to prevent repetition (Welleck et al., 2019). The training, evaluation, and testing set size is 8,000, 1,000, and 1,000, respectively, with balanced labels.
Metrics for Detector Performance. The metrics we use to evaluate detection performance are binary classification metrics AUC ROC and TPR@FPR. AUC ROC is the area under the receiver operating characteristic curve. TPR@FPR is the true positive rate when the false positive rate is at a specific percentage. Under our setting, it is equivalent to Attack Success Rate (ASR) (Tsai et al., 2019)7. We mainly show TPR@FPR=5%, and TPR@FPR=10% and =20% are additionally recorded in the Appendix F.2. We do not involve Accuracy and F1-score because those metrics depend on the threshold setting for metric-based detectors, which could be biased in the comparison.
6The x-ticks in format (ZWS) character editing is twice the ones in typo and homoglyph because the Unicode is 2 bytes when computing edit distance.
7Under our settings, we define the success of the attack is to deceive detectors by classifying machine-generated text into human-written (described in §2). So, (1-TPR) and ASR are both evaluating the equivalent thing.

heading: Absolute MGT Detector Performance w/o Attack
text: Notably, we report all the metrics of attacked scenarios in relative value to the unattacked performance (Table 3) for clearer comparison.

heading: 6 Attacks and Results
text: In this section, we describe the attack methodologies and results divided by attack category. We view the degraded performance under attacks of various detectors as stumbling blocks to robust MGT detection. Further, we analyze the defects and propose defense patches in each category to explore the potential of turning stumbling blocks into stepping stones. Table 1 is an overview of all attacks and Table 16 shows some examples.

heading: 6.1 Overall Message
text: For readers who want a high-level overview of our findings, we show the overall results and messages ahead here by aggregating results from all types of attacks covered in our work. We will introduce and discuss the detailed attacks and results in the following subsections (§6.2 - §6.4).
Leaderboard. Overall, we build a leaderboard of detector robustness averaging all the performance datapoints under attacks. The relative AUC ROC under attack8 are as shown in Table 2. A high relative AUC ROC means that the detector is robust to the attack. According to the leaderboard, water-
8‘Relative AUC ROC under attack’ is the percentage of the AUC ROC in attacked scenarios divided by the unattacked AUC ROC, to show the relative performance drop of the detectors under attack. Detailed in §5.
marking is most robust to its accessible attacks9. Following, SimpleAI Detector and OpenAI Detector (large) rank second and third. Moreover, modelbased detectors are more robust than metricbased detectors in most cases. Additionally, we report the absolute performance of the detectors without attacks in Table 3, which should also be considered while selecting suitable detectors.
Detector Defect Review. We summarize the defect for each detector as follows. GLTR, Rank, and LogRank have an average performance drop of 51.35% under all attacks, especially not robust to editing, paraphrasing, and co-generating attacks. In comparison, DetectGPT shows better robustness (average 29.41% drop), especially on paraphrasing and co-generating attacks. Among fine-tuned detectors, the strongest attack method varies. SimpleAI Detector drops performance on paraphrasing and prompting attacks, OpenAI Detectors drop on editing, and F.t. DeBERTa performs worse on cogenerating while it keeps decent robust to other attacks. We empirically find a larger model size of OpenAI Detectors eases the robustness drawback. Notably, watermarking is robust to all applicable attacks, but it still fails under larger attack budgets10. Moreover, it requires decoding-time access to the generator compared with other detectors.

heading: 6.2 Editing Attacks
text: The first attack type we explore is the editing attacks, which are applied to the generated texts by minor editing at the character level without any change in semantics at the post-generation stage.
9Some prompting attacks can not be applied to watermark since it is in need of white-box models and compatibility to the watermarking decoding.
10For example, the inter-sentence paraphrasing attack degrades watermarking’s performance to 75.79 AUC ROC.
Thus, editing attacks are at a low granularity. Some of the attacks might cause the text to lose minor quality and readability. Below, we will introduce three attack types.

heading: 6.2.1 Approaches
text: Typo Insertion intentionally adds a few typos into generated texts. We consider four main kinds of typos in English keystroke scenarios: insertion, deletion, substitution, and transposition (Kukich, 1992). Aside from testing on each kind, we propose a mixed typo insertion to mimic the realistic scenario according to the distribution investigated by Baba and Suzuki (2012).11 Also, we additionally take letter frequency into account when selecting the characters to be attacked (Pavel, 2000).
Homoglyph Alteration uses graphemes, characters, or glyphs with visually identical or very similar shapes but different meanings for imperceptible replacements, first introduced in the cyber security domain (Gabrilovich and Gontmakher, 2002). We use VIPER (Eger et al., 2019) (Visual Perturb) Easy Character Embedding Space (ECES) to get the best homoglyph alternative of the selected character.
Format Character Editing, also named Discreet Alteration (Kirchenbauer et al., 2023a), uses special escape characters and format-control Unicodes as human-invisible disruptions to deceive detectors. We consider \n - newline, \r - carriage return, \v - vertical tab, \u200B - zero-width whitespace, and \u000B - line tabulation as representatives and they shared similar results. Specifically, zero-width whitespace can be inserted between any tokens, while we only add shift-related characters at the end of sentences.
11substitution 55.6%, insertion 20.3%, transposition 1.1%, deletion 23.0%.

heading: Before Attack with Patch
text: We do all the editing on the character level, and the budget is measured by edit distance. Also, we do at most one edit per word.

heading: 6.2.2 Results and Analysis
text: As shown in Figure 2, all metric-based detectors and some fine-tuned ones drop dramatically, while only SimpleAI-Detector and Fine-tuned DeBERTa maintain good performance. Specifically, around 2 to 6 characters editing of typos or homoglyph per text can degrade the performance of most detectors to be worse than random (The average length of texts is around 110 tokens). All metricbased methods show a continuous decrease while attack budgets increase. In typo and homoglyph attacks, the decrease can mount up to a total failure with ROC AUC near 0. In comparison, DetectGPT is more robust than the others, e.g., its drop converges to about 0.5 under homoglyph alteration while GLTR and Log Rank degrade to near 0. However, DetectGPT with fewer perturbed samples (_1d) is more robust than larger ones (_10d and _10z), which is counterintuitive.
Among fine-tuned detectors, OpenAI Detectors show a similar unsoundness as metric-based ones. And their drops are most significant in format character editing. SimpleAI Detector and F.t.DeBERTa show great robustness to all editing attacks. Moreover, the comparison between two underperforming OpenAI Detectors of different sizes indicates that larger classification models could be more robust than smaller ones under editing. The watermarking method is also very robust to attacks, i.e., keeping the AUC ROC above 99%.
In addition, all four individual types of typo share similar negative impacts as the mixed version, as shown in Appendix E.1. Also, we observe similar drops for all format character editing attacks,
while zero-width whitespace is more effective.
Interpretation. Metric-based detectors assume that HWTs have smaller log probabilities than MGTs when inferred by the generator model. However, editing attacks can effectively decrease the next-token probabilities, leading to indistinguishable situations of the distribution curves and even inverse relative relationships, which cause completely wrong predictions (ROC AUC near 0) as the budget increases. Figure 3 shows a detailed illustration, taking GLTR and DetectGPT as examples. After the attack, a larger overlap of the two curves (column 2) means more severe indistinguishability, and the interchange of the relative positions of the two curves (column 3) leads to wrong predictions. From this intuition, we attempt to patch the issue by removing anomalies in the next section. For the fine-tuned detectors, OpenAI Detectors perform worse in most cases, while SimpleAI Detector and F.t.-DeBERTa show great robustness. We surmise the reason is that OpenAI Detectors is trained on the GPT-2 corpus, which is outdated compared to the ChatGPT corpus for SimpleAI Detector and the GPT-J corpus for F.t.-DeBERTa. The model shows less robustness under such an out-of-distribution (OOD) situation.

heading: 6.2.3 Out-of-the-box Defense Patch
text: In this section, we propose a simple patch for the under-performing DetectGPT approach. As the editing attacks mainly cause extremely low token probabilities to deceive the classification, we view them as anomaly points to filter them out. Specifically, for each text, the top k% tokens with the lowest probabilities are prevented from being masked and perturbed when doing mask-filling. We also do not take their token probability into the computation. Table 4 show the patch recovers performance by 0.2285 AUC ROC on average for 3 settings.
Other potential patches include adversarial training (Goodfellow et al., 2014), visual character embeddings (Wehrmann et al., 2019) for homoglyph, and preprocessing with grammatical error correction (Bryant et al., 2022). These approaches are more costly, and we leave them to future work.

heading: 6.3 Paraphrasing Attacks
text: Paraphrasing attacks aim to rewrite the generated texts without changing the semantic meanings at the post-generation stage. Paraphrasing has been used for robustness evaluation and data augmentation in many other tasks, e.g., sentiment analysis, textual entailment (Iyyer et al., 2018), and machine translation (Merkhofer et al., 2022). Usually, an extra LLM is used as the paraphraser (Iyyer et al., 2018; Yang et al., 2022). Krishna et al. (2023) has reported the attack success of their paragraph-level paraphraser on some MGT detectors, but a comprehensive study across a wider range of paraphrasers and detectors is missing in the literature. In this section, we will introduce five attack types that cover paraphrasing attacks of different granularity, from word-level to paragraph-level.

heading: 6.3.1 Approaches
text: Synonyms Substitution is to replace some words with their synonyms to perturb the textual features. Inspired by the red teaming setting of Shi et al. (2023), we design a model-free method and a model-based method. For the model-free substitution, we replace the selected words with their synonyms retrieved from a static dictionary WordNet (Miller, 1994).12 However, it does not consider
12We avoid substituting the pronouns and prepositions to avoid grammatical problems. However, issues like verb tense still might happen.
the context of the substituted words. In the modelbased method, we use T5-large (Raffel et al., 2020) to select the words to be substituted and prompt LlaMA (Touvron et al., 2023b) to get the synonyms given the context (detailed in Appendix E.2).
Span Perturbation is to rewrite word spans like phrases or clauses. Compared to synonym substitution, span perturbation is more flexible in that tokens can be reordered or replaced. Following the perturbation method of DetectGPT, we first randomly select spans for masking and then use T5-large to fill in.
Inner-Sentence Paraphrase is to paraphrase each sentence separately. We use Pegasus (Zhang et al., 2020) to process sentences of texts and join them back to the full texts. To control the budget, we can adjust the portion of sentences to be paraphrased.
Inter-Sentence Paraphrase uses Dipper (Krishna et al., 2023) to paraphrase the whole text at once, which can reorder, merge, and split multiple sentences. We control the lexical diversity and order diversity to change the budgets.
For budget, we measure the semantic difference between before- and after-attack with BERTScore.

heading: 6.3.2 Results and Analysis
text: The results are shown in Figure 4. Interestingly, lower-level perturbations (i.e., word substitution) show greater attack success than higherlevel perturbations (i.e., sentence-level para-
phrases) at the same budget. Metric-based detectors show weakness at all level perturbations, especially degrading to near 0.0 AUC ROC under word substitution attacks. Among metric-based detectors, DetectGPT shows slightly better robustness at word-level perturbation but then loses the lead at higher levels. For fine-tuned detectors, SimpleAI Detector remains robust under all attacks, while OpenAI Detectors and F.t.-DeBERTa fail at some attacks. A surprising result is that in some cases, fine-tuned detectors’ performance first drops but then increases as the budget increases, e.g., OpenAI Detectors under word substitution and F.t.DeBERTa under inter-sentence paraphrase. Finally, for watermarking, inter-sentence paraphrasing is the only effective attack.
See interpretation in Appendix C.1.

heading: 6.4 Co-Generating Attacks
text: Co-generating attacks perturb the generated tokens at each sampling step with some designed rules. Their mechanism shares similarities to the typo insertion attack (§6.2). But for co-generating, the perturbed text is cleaned to be grammatically correct after generation. We will introduce two attacks.

heading: 6.4.1 Approaches
text: Typo Co-Generation is to insert typos during generation. Different from the typo insertion attack (§6.2), we introduce typos immediately after the token is sampled (before the generation of the next token), following preset typo insertion rules, e.g., substitute all ‘a’s into ‘z’s. After the whole generation is finished, we reverse the inserted typos to clear the errors. Compared to the typo insertion attack, typo co-generation does not directly damage
AUC% Attack P.-Para ICL CS Gen Dataset GPT-J GPT-4 GPT-4 GPT-4
PPL unatt. 1.930 2.042 2.042 2.042 MAUVE unatt. 0.944 0.483 0.483 0.483
Budget PPL attacked 1.867 2.064 2.080 4.971 MAUVE att. 0.963 0.348 0.680 0.056
quality and human imperceptibility.
Emoji Co-Generation is developed in a similar fashion: We insert emojis at the end of generated sentences (before the generation of the next sentences) and remove them post-generation.
More approach details in Appendix E.3 to E.4.

heading: 6.4.2 Results and Analysis
text: Figure 5 shows the results. We observe that the metric-based detectors and F.t.-DeBERTa are not robust to the co-generation attacks, while OpenAI and SimpleAI Detectors show minor degradation. DetectGPT is more robust than other metric-based methods without perturbation, e.g., it converges at around 0.5 under typo co-generation while GLTR and (Log-)Rank converge near 0.1. For all detectors, the further increase in budgets for cogeneration attacks does not cause proportional performance drops.
We feel it is hard for detectors to overcome the degradation. And there are no related existing works to the best of our knowledge. See detailed discussion of interpretation in Appendix C.2.

heading: 6.5 Prompting Attacks
text: Most detectors are trained and tested on data based on fixed, well-designed prompts, e.g., question answering (Guo et al., 2023), continual writing
13For short, ‘P.-Para’ is the prompt paraphrasing attack, and ‘CS Gen’ is the character-substituted generation attack. Bolding indicates severe performance drop (drops larger than 50% are in red; between 25% and 50% are in yellow). Since GPT-4 is close-sourced, we can not test the watermark on it.
(Zellers et al., 2019), etc. But in realistic scenarios, user prompts might be much more diverse, abnormal, and even noisy (Zamfirescu-Pereira et al., 2023). In this section, we introduce three attack types. Table 5 shows the results.

heading: 6.6 Approaches
text: Prompt Paraphrasing. Instead of paraphrasing whole texts post-generation (§6.3), paraphrasing the prompt prior to generation is much cheaper and low-impact on the output quality. We use Pegasus paraphraser to rewrite the prompts.14
In-Context Learning (Dong et al., 2022) improves generation quality by giving only a few examples in the form of demonstration. To generate more human-like texts to deceive detectors, we give the generator a related HWT as a positive example and a vanilla MGT as a negative example. We follow the prompt design of Super-NaturalInstructions (Wang et al., 2022).15
Character-Substituted Generation is inspired by substitution cipher (Spillman et al., 1993) in the domain of cryptography. We found that recent LLM, e.g., GPT-4, are able to follow some easy substitution rule, e.g., replace ‘a’s with ‘z’s, during generation. Afterward, we substitute the mapping back to clean the output. Table 7 shows an example. Notably, we only find GPT-4 maintains acceptable generation quality under this attack, so we solely show its result.

heading: 6.7 Results and Analysis
text: Table 5 shows the results. The metric-based detectors severely suffer the character-substituted generation attack but are robust to prompt paraphrasing and in-context learning. On the other hand, the finetuned detectors show some drop in prompt paraphrasing but have great robustness under charactersubstituted generation.16
Discussion on interpretation is in Appendix C.3.
14Since the prompts are usually very short, it is hard for us to control the budget while paraphrasing. Hence, we report attacked performance under a single budget at Table 5.
15It is also hard to adjust the budget for this attack. One potential way is to change the demonstration number, but it shows no clear correlation to the budgets and also might exceed the generator’s maximum length of the input sequence.
16Note that the budget of character-substituted generation is larger than other attacks. As a prompting method, it is hard to control it, so a milder character-substitution method with an adjustable budget is by controlled generation (§6.4).

heading: 7 Future Work
text: We propose ideas of enhancement for detectors in Appendix D.1 and three stronger attack categories, namely sampling attacks, fine-tuning attacks, and human-involved attacks in Appendix D.2.

heading: 8 Related Work
text: To the best of our knowledge, there is no existing thorough study on stress testing the robustness of machine-generated text detection under various attacks. Some existing works of MGT detectors evaluate their robustness under some specific attacks. Liu et al. (2022) evaluate the robustness of their model-based detector CoCo under token editing. Krishna et al. (2023) stress test detectors on paragraph-level paraphrase, and further purpose a retrieval-based method to increase robustness. Hu et al. (2023) focus on paraphrastic robust modelbased detectors by adopting adversarial learning. Zhang et al. (2023) purpose that topic shifting drops the metric-based detectors’ performance. In the watermark domain, Kirchenbauer et al. (2023a) propose a list of initial attack ideas, including editing, paraphrasing, and generation strategy. However, they only experiment on the span perturbation attack for their watermark method. Further, Kirchenbauer et al. (2023b) study the watermark robustness after LLM paraphrase, manual paraphrase, and mix into a longer document. Zhao et al. (2023b) enhance the robustness of the watermarking scheme against editing and paraphrasing attacks by employing a fixed group design. And Hou et al. (2023, 2024) propose a semantic watermark at the sentence level for paraphrastic robustness.
To summarize, a thorough and comparative stress test on the robustness covering a wide range of detectors and attacks is lacking in the literature, which motivates our work.

heading: 9 Conclusion
text: This study evaluates the robustness of 8 MGT detectors against 12 realistic attacks, revealing striking vulnerabilities. Findings show that no detector consistently withstands all attacks, as some attack strategies severely compromise detection accuracy. Among various detectors, watermarking is the most robust, followed by model-based detectors. We also suggest combining metric- and model-based detectors for better resilience. Aiming at robust MGT detection, we call for awareness of vulnerability and the need for further methods.

heading: Limitations
text: We mainly show and discuss the results of representative generators, detectors, and attack methods in the main paper following the preset scope §2. Since our work is a general and reproducible evaluation pipeline, it is readily applicable to other generators or detectors.
We mainly focus on English in our work. Most attacks are able to be generalized to other languages, but the generation quality might suffer mainly depending on the generator’s capability, especially in lower-resource languages. Also, the detection accuracy highly relies on the base model’s capability in other languages. Some attacks could have slightly different designs for other languages, e.g., the homoglyph alteration attack could be more complex in logographic languages like Chinese, Japanese (Kanji), and Vietnamese (Chu Nôm), and it would be interesting to explore in future work.

heading: Ethics Statement
text: The goal of this paper is not to provide a cookbook for malicious use of attacks to deceive MGT detectors. On the contrary, we want to draw attention to the potential vulnerabilities of current MGT detectors. Moreover, we call for future MGT detectors that are robust against the attacks we tested. For this target, we will open-source all the code and dataset for easy reproduction of our pipeline of robustness tests. We also propose and describe some defense patches for fixing these loopholes.

heading: Acknowledgements
text: We thank our anonymous ACs and reviewers, who helped us to improve the paper greatly. We appreciate the Tsvetshop group, especially Xiaochuang Han and Niloofar Mireshghallah, for their helpful discussions and feedback. This material is based upon work supported by the National Science Foundation under CAREER Grant No. IIS2142739, NSF Grant No. IIS2125201, and the DARPA CMO under Contract No. HR001120C0124. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of the funding agencies. We also gratefully acknowledge support from Alfred P. Sloan Foundation Fellowship.

heading: A Other Related Works

heading: Study on Adversarial Attack to MGT Detection.
text: Adversarial attack (Goodfellow et al., 2014), which exposes optimized regions of the input space where the model under-performs, first introduced to text data by Li et al. (2018), is powerful to reveal robustness in text classification (Jin et al., 2020). Shi et al. (2023) first use adversarial attack on MGT detectors, including OpenAI-Detector, DetectGPT, and watermarking. They cover adversarial word substitution and prompting, both of which deceive three detectors. Furthermore, RADAR (Hu et al., 2023) attempts to improve the robustness of model-based detectors by adversarial learning on paraphrasing. We also take inspiration from recent work on the blind spots of NLG metrics (He et al., 2023a).
However, under realistic scenarios, attackers do not have detailed knowledge of which detector is being used (§2). Hence, our work focuses on nonadversarial attacks, which are under-explored.

heading: Study on Generalization of MGT Detection.
text: Generalization capability is an important aspect of robustness in MGT detection. For model-based detectors, Solaiman et al. (2019) evaluate their OpenAI Detector on generalize through different model sizes, sampling strategies, and input text length. Pu et al. (2023) study the generalization ability when testing on out-of-domain data from different generators. Pagnoni et al. (2022) analyze the generalization on sequence length, decoding strategy, dataset domain, and generator size. Wang et al. (2023) introduce a multi-generator, multi-domain, and multilingual corpus to train more generalizable detectors. For metric-based detectors, Mireshghallah et al. (2023) explore the generalization between different base models and dataset generators on a perturbation-based metric-based detector.
In comparison, our research focuses not on the generalization problem but on the robustness against realistic and malicious attacks.

heading: B Experiment Settings
text: The experiments are done on 8 Tesla V100 and 4 Tesla A100 GPUs, taking up a total of around 500 GPU hours.

heading: B.1 Dataset and Generators
text: We build the dataset based on Pu et al. (2023). The HWTs are from the News domain of the dataset, and the MGTs are generated with different temperatures for each generator we selected. Table 8 shows the sample number of each split in our dataset.
Table 9 shows the number of tokens of each entry in the dataset from each generator. All of them are around 110 tokens. The length setting follows the literature, e.g., 120 tokens in Pu et al. (2023) (based on RealNews), 200 tokens in Hu et al. (2023) (based on Xsum, SQuAD, and Reddit WritingPrompts), 100 words in He et al. (2023b) (based on Essay, WP, and Reuters), and 100 words in Chakraborty et al. (2023) (based on Reuters). Moreover, a longer average length would lead to higher detection accuracy (Bao et al., 2023; Chakraborty et al., 2023). So, we also aim to control the level of task difficulty by controlling the length.
For sampling, we use a combination of nucleus sampling (Welleck et al., 2019) with top-p = 0.96 and a tuned temperature parameter (Caccia et al., 2020; Nadeem et al., 2020). While smaller temperature gives higher quality, it will also cause repetition, especially for less capable LMs. So, we tune the temperature based on the criteria of preventing repetition, which is < 0.2 in terms of 4-gram duplication under metric seq-rep-4 in Welleck et al. (2019). Table 10 shows the our temperature settings.

heading: B.2 Detectors

heading: B.2.1 Detailed Introduction
text: Metric-Based Detector relies on the inferenced log-probability from the generator LLM, and adopts a threshold for classification.
GLTR (Gehrmann et al., 2019; Solaiman et al., 2019) using the average of the next-token probability to determine whether an input text is MGT. Texts with high average probability are classified as MGTs.
Rank and LogRank (Solaiman et al., 2019; Mitchell et al., 2023) using the averaged rank and log-rank of next-token probability for detection respectively.
DetectGPT (Mitchell et al., 2023) stands as the pioneering work of using perturbation as a comparison to original texts to enhance metric-based detection. Perturbation here refers to rewriting or substituting spans of tokens using a mask-filling LM (i.e., T5-small (Raffel et al., 2020)). It poses that perturbed MGTs tend to have lower log probabilities compared to the original samples under the base LM, while perturbed HWTs may be at about a similar level to the origin. Bao et al. (2023); Su et al. (2023); Liu et al. (2024); Mao et al. (2024) further follow up DetectGPT.
We apply the white-box setting to the metricbased detectors, where full knowledge (e.g., which LLM generated the texts) and access ( including the parameters of the generator LLM) are given to the detectors. The reason is that those detectors require the generator LLM as the base model to compute the metrics.
Fine-Tuned Detector is trained on a pretrained language model (PLM) in a supervised method with a classification loss.
OpenAI Detector (Solaiman et al., 2019) is a model to detect GPT-2 generation by fine-tuning a RoBERTa (Liu et al., 2019) model. We evaluate both the base size (125M) and the large size (355M) model.
SimpleAI Detector (Guo et al., 2023) is a detector mainly for distinguishing ChatGPT, using the HC3 QA dataset (Guo et al., 2023) to fine-tune a
RoBERTa model. Fine-tuned DeBERTa is the model we fine-tuned on our generation data, representing an in-domain setting. We use DeBERTa-v3-base (He et al., 2021) as the base model.17
Compared with OpenAI and SimpleAI Detectors as off-the-shelf models, our fine-tuned DeBERTa is relatively in-domain since it is solely fine-tuned on the dataset from the same generator and within the same topic domain as the test set. All the fine-tuned detectors are under the black-box setting, which means they have no knowledge or access to the generator LLM but only the generated dataset.
Watermark-Based Detector adds algorithmically detectable signatures into texts during generation. Kirchenbauer et al. (2023a) is a representative watermarking approach, which adds a token-level bias in the decoding stage (represented as Watermark afterward). This work is followed up by Zhao et al. (2023b); Christ et al. (2023); Kuditipudi et al. (2023); Hou et al. (2023, 2024). All watermarkbased detectors are under the white box setting, where they have all the knowledge and access to the generator LLM.

heading: B.2.2 Detailed Hyperparameters
text: For all model-based detectors, we use the original generator of the test set as the base model to compute the next-token probability and perplexity.
For DetectGPT, we follow the recommendation hyperparameter setting. The perturbation word ratio is 15% on 2-spam, the perturbation model is T5-3B (Raffel et al., 2020), and the sample number of perturbation is 1 or 10 (indicated in the name of the legend). In the legend, mode ‘d’ represents the direct use of the absolute likelihood drop while mode ‘z’ adds an additional normalization. The mask-filling in perturbation is with temperature 1 without any sampling strategy (e.g., top-p and topk).
For all fine-tuned detectors, we directly use the logits as the output probability. When fine-tuning F.t. DeBERTa, we set batch size as 4, learning rate as 1e-5, weight decay as 0, adam epsilon as 1e-8, and epoch number as 10.
For the watermark, we follow the setting in Kirchenbauer et al. (2023a), setting gamma as 0.25,
17We have also tried other base models, e.g., BERT (Devlin et al., 2018), RoBERTa, ELECTRA (Clark et al., 2020), etc. The selection of base model does not impact the overall trend of the findings, and the gap on the absolute detection accuracy is within 2%.
seeding scheme as selfhash, and z-score threshold as 4.0.

heading: B.2.3 Under Closed-Source Dataset
text: For GPT-4 datasets, as we do not have the whitebox generator model, we select an alternative LM as the base model. According to the conclusion from Mireshghallah et al. (2023), GPT-2 Small (Radford et al., 2019) is the best-performed base model when generalized to GPT-4. Our experiment compares GPT-2 (Small, Medium, Large, XL), OPT (125M, 350M, 1.3B, 2.7B) (Zhang et al., 2022), GPT-Neo (125M, 1.3B, 2.7B) (Black et al., 2021), and GPT-J (6B), and the results align that GPT-2 Small is the best. Hence, our GPT-4 dataset results are all under GPT-2 Small as the base model. Table 12 shows the unattacked performance. Table 11 shows the Perplexity and MAUVE (M2H) as budget of unattacked GPT-4 dataset.
C Interpretation
The watermarked detector adds a signature at each token, and our editing attacks only change a minimal portion of them. Hence, they show substantial robustness, maintaining high AUC ROC.

heading: C.1 Paraphrasing Attacks (§6.3)
text: For metric-based detectors, localized disturbances from lower-level perturbations cause more decreases in next-token probability than high-level perturbations. While for high-level perturbations,
the decrease is spread out in wider spans, thus minor the overall impact. For fine-tuned detectors, Liu et al. (2022) pose that they concentrate more on long-form patterns (e.g., commonly used phrases or sentence structures) from LLM to detect. Hence, localized disturbances of low-level perturbation directly interrupt the long-form patterns, while highlevel paraphrasing is milder as it rewrites such patterns but still keeps some of the machine signatures. Moreover, we surmise that paraphrasing attacks are not making MGTs more human-like but only mixing the machine signatures. So, sometimes, the detectors’ performance falls then rises as the budgets increase, during which the dominant machine signatures switch from the original generator’s to the paraphraser’s.

heading: C.2 Co-Generating Attacks (§6.4)
text: The insertion of emojis and typos during recurrent next-token generation is a disruption for the sampling of LLMs, shifting the generation away from the generator’s original distribution. Moreover, re-
moving the emojis and recovering the typos postgeneration disrupt the conditional probability again for metric-based detectors. For fine-tuned models, we surmise that when doing in-domain detection (F.t.-DeBERTa), the detector might focus more on localized features. Otherwise, out-of-domain models here (OpenAI and SimpleAI Detectors) focus on long-term patterns. Thus, the in-domain model is less robust to the attacks.
We have also attempted emoji co-generation for watermarking, and it also demonstrates very strong robustness, similar to the typo case. Interestingly, inserting more emojis did not affect the budget (MAUVE score) for watermarked generation. Therefore, we choose not to plot this result in Table 5 to avoid confusion.

heading: C.3 Prompting Attacks (§6.5)
text: The character-substituted generation attack is a more localized perturbation compared with prompt paraphrasing and in-context learning, which is on the general level. So, similar to the paraphrasing attacks, metric-based detectors show a larger vulnerability to localized perturbation since it directly increases the next-token probabilities, which is also shown as the high perplexity after the attack. However, fine-tuned detectors focus more on long-term patterns, which may not impacted by a few substitutions. But, prompt paraphrasing is a form of attack that shifts the prompt pattern, which can degrade fine-tuned detectors severely, especially those ones that are not generalizable.

heading: D Future Work

heading: D.1 Future Work on Defenses

heading: D.1.1 Paraphrasing Attacks (§6.3)
text: For metric-based detectors, a straightforward way is to choose a base model that is related to common paraphrasers’ base models, e.g., T5, ProphetNet (Qi et al., 2020), or fine-tune the base model on some paraphrased corpus. Similarly, data augmentation on paraphrasing and adversarial learning could be useful for training fine-tuned detectors (Hu et al., 2023). Moreover, Krishna et al. (2023) purpose that retrieval on an MGT database can be the defense, if it is possible to collect enough indomain MGT entries. For watermarking, semanticlevel watermarking (Hou et al., 2023) (as opposed to token-level) has been proposed for paraphrastic robustness.

heading: D.1.2 Co-Generating Attacks (§6.4)
text: To the best of our knowledge, there are no related existing works. We feel it is hard for metricbased detectors to overcome the defects. Under this scenario, fine-tuned detectors could be the better choice. One potential way to enhance fine-tuning is to adopt some data augmentation, like random masking on short-term spans. Also, we surmise a combination of metric-based detectors and modelbased detectors is useful to bypass each other’s stumbling blocks better when attacked. The ensembling could also ease the impact of other attacks. Fortunately, the co-generation attacks are still not widely available now since they need to be on the white-box models.

heading: D.1.3 Prompting Attacks (§6.5)
text: To patch the weakness of fine-tuned detectors under prompt paraphrasing, an efficient way is to finetune the classifier on multi-generator, multi-domain datasets, e.g., M4 by Wang et al. (2023). Otherwise, using an ensembling system (Pagnoni et al., 2022) containing both metric-based and fine-tuned detectors could ease the problem. However, we surmise there is no direct way to patch the charactersubstituted generation because it mimics the suboptimal generation strategy of humans at the root. Yet current LLMs are not capable of always following the character-substitution prompts with high text quality, which could cause unnatural expressions and extra typos. A way to fix the loophole could be censoring the prompts and generated texts if they have weird expressions (Dou et al., 2022; Chiang and Lee, 2023). Additionally, training detectors on the MGT corpus from unnatural instructions (Honovich et al., 2022) could also be considered.

heading: D.2 Future Work on Attacks
text: Below, we briefly discuss other types of attacks related to generalization, which are not covered in this work.
Sampling Attacks. Diverse sampling strategies (Holtzman et al., 2019) can be adopted when generating MGTs both by setting different hyperparameters. Pagnoni et al. (2022) show that detection performance generally decreases when a fine-tuned detector is evaluated on a sampling strategy it was not trained on.
Fine-Tuning Attacks. In some scenarios, users might fine-tune the generator LLM on their specific domain. Since the detectors have no knowl-
edge and access to the customized generator, their performance might decrease. Human-Involved Attacks is to manually polish or replenish MGTs to be more human-like and improve their quality, which could deceive the MGT detector. Kirchenbauer et al. (2023b) purpose manual paraphrasing and mixing HWTs into MGTs as an attack to watermarks. And Christ et al. (2023) describe a manual prefix-specificity scheme to lead to a more human-like generation. Therefore, a major limitation of the current detector technique is the inability to classify human-LLM-collaborated texts into binary classes. Future MGT detectors that are able to measure the portion of LLM involvement in text writing are worth considering as an answer to this attack genre.

heading: E Attack Details
text: In this section, we report the details that are not included in the main paper due to lack of space, including methodologies and settings.

heading: E.1 Typo Insertion
text: Table 13 shows the performance drop of four separate typo types, i.e., insertion, deletion, substitution, and transposition. All of them share similar observations on degradation trends and are close to the mixed typo type. Therefore, for the figure in the main text, we show the result of mixed for brevity.

heading: E.2 Synonym Substitution
text: Table 14 shows the prompt design for LlaMA to do the model-based synonym generation with the context. After the generation, we have an additional step to ask LlaMA double check and correct the grammar of the substituted sentences.

heading: E.3 Typo Co-Generation
text: The results reported in the main text using the typo substitution rule switching ‘c’s and ‘k’s. We have also tried other rules, e.g., ‘a’s and ‘z’s. The different rules cause different budgets depending on the character appearance frequency in the texts. We select a rule that has a comparable budget interval to other attacks, but our system also supports other rules.

heading: E.4 Emoji Co-Generation
text: Emojis are widely used in web texts, especially social media (Ayvaz and Shiha, 2017). However, emojis are usually excluded from the training corpus of fine-tuned detectors and are situated at the long tail of distribution for metric-based detectors. Thus, they have a similar effect as the insertion of typos (§6.2). We insert a random emoji from Gemoji18 when LLM finishes a sentence and let the LLM generate the next sentence recurrently. We control the budgets by tuning the probability of inserting an emoji after a sentence. We clean the output texts after generation by removing all emojis to hide the trace of the attack. Note that the distribution shift caused by emoji during sampling will still embodied in the text and deceive the detectors.

heading: F Additional Results

heading: F.1 Across Budgets
text: The design of the budget considers the alignment of different metrics’s indications, especially for the ones on the same aspects.
Figure 6 to Figure 10 and Figure 11 to Figure 15 show the performance drop in terms of BERTScore, BARTScore, Cosine Similarity, Jaro Similarity, and Edit Distance for paraphrasing attacks. Figure 16 to Figure 17 show the editing attacks, and Figure 18 to Figure 21 show the co-generating attacks. The line charts illustrate a similar trend for performance drop of MGT detectors under attacks, which crossvalidate our results and conclusion. Also, they support the reasonability of the design of our budget.
18A package of emoji collections: https://github.com/ wooorm/gemoji.

heading: F.2 Across Metrics
text: Figure 22 to Figure 27 shows the performance drop of the detectors in terms of different metrics, including ROC AUC, PR AUC, accuracy (ACC), TPR@FPR=20%, =10%, and =5%. The similar drop trends show the correlation between all metrics involved in our study. Here, we show editing attacks as examples and omit others for brevity.

heading: F.3 Across Generators
text: In this section, we report the results of the main test on LlaMA-2 (Touvron et al., 2023a) as the generator. As we have mentioned, due to larger LLMs not having good detection capability for metric-based detectors (Mireshghallah et al., 2023), the trend results might be noisy and unclear compared with the GPT-J main results in §6. However, the results and conclusion align well across generations at a high level. Table 15 and Figure 28 - Figure 28 show the results.
Prompt A new poll reveals that more Americans would choose the Internet as their only news source than TV, radio
HWT
A new poll reveals that more Americans would choose the Internet as their only news source than TV, radio and newspapers combined, and Internet reports are considered much more reliable that other media. It also shows only 1 in 200 people surveyed believes newspapers will be a dominant source of information in

heading: 2014. The survey discovered 56 percent of adults nationwide would pick the Internet if they were allowed just one source for their news, while television, newspapers and radio earned the support of 41 percent – together. Among
text: Republicans, 56 percent would choose the Internet for their news, while among Democrats that figure was 50 percent.
unattacked MGT
A new poll reveals that more Americans would choose the Internet as their only news source than TV, radio or newspapers. And it’s true: only a third of Americans get their news from newspapers, TV or radio. In a new Pew Research Center poll, only 37 percent of Americans said they get their news from newspapers. That’s down from 44 percent who said they got news from newspapers in 2010. TV news was a distant second in the poll. Only 23 percent of Americans said they get their news from TV. That’s down from 26 percent in 2010.
unattacked watermarked MGT A new poll reveals that more Americans would choose the Internet as their only news source than TV, radio, newspapers or magazines. The poll, conducted by the News Literacy Project, found that 42 percent of American adults say they rely exclusively on the Internet for news. That’s up from 33 percent in 2008. At the same time, the number of people relying on television for information has declined since the poll began asking this question in 2003. In 2003, 47 percent of Americans said they used TV exclusively for news. That’s down to 38 percent in 2008 and 34 percent today.
typo insertion (mixed)
Description: Create typos by a mixture method of inserting, deleting, substituting, and transposing. Config: Insert typo in 20% of tokens, one edit per selected token. A new poll reveals that more Americans would choose the Internet as their only news source than TV, rapio or newsbapers. And it’s true: only a third of Ameyicans get their news from newspapers, TV or radio. In a now Pew Research Center poll, only 37 percent of Americans said they ges their nws fro newspapers. Bhat’s down rrom 4 percent who aid hthey got nelws from newspapers in 2010. TV news wae a distant secod in the poll. Only 23 percent of Americans said hey get their news fdom TV gThat’s down from 26 percent in 2010.
homoglyph alternation
Description: Change English characters into visually similar Unicodes. Config: Change 20% of tokens, one homoglyph character per selected token. A new poll reveals thaτ more Americans would choose the Internêt as their only news source than TV radio or newspapers. And it’s true: oňly a third of Americans get their news from newspapers, TV or radio. In a new Pew Research Ceňter poll, only percent of Americans said they get their neωs from newspapers. Thât’s down from 44 percent who said they gôt news from newspapers in 2010. TV newŝ was a distant second în the poll. Only 23 peřcent of Amêricans said they get their nêws from TV. Thaτ’s down from 26 percenτ in 2010.
format character editing (zero-width whitespace) Description: Insert formatting characters, i.e., zero-width whitespace \u200B. Config: Insert \u200B at the end of 20% of tokens. A new poll reveals that more Americans would choose the Internet as their only news source than TV, radio or newspapers. And it’s true: only a third of Americans get their news from newspapers, TV or radio. In a new Pew Research Center poll, only 37 percent of Americans said they get their news from newspapers. That’s down from 44 percent who said they got news from newspapers in 2010. TV news was a distant second in the poll. Only 23 percent of Americans said they get their news from TV. That’s down from 26 percent in 2010. [Note: zero-width whitespace can not be displaced in LATEX.]
synonyms substitution model-free
Description: Retrieve synonym from a static dictionary to substitute. Config: Substitute 10% words. A new poll reveals that more American English would choose the Internet as their only news source than TV, radio, newsprint or magazines. The crown, conducted by the news show Literacy Project, found that 42 percent of American English adults say they rely exclusively on the Internet for news. That’s up from 33 percent in 2008. At the same clock, the bit of people relying on television for info has declined since the poll began asking this interrogative sentence in 2003. In 2003, 47 percent of American English said they used TV exclusively for news show. That’s down to 38 percent in 2008 and 34 percent today.
synonyms substitution model-based
Description: Utilize an LLM to generate a synonym list given context. Config: Substitute 10% words using LlaMA with temperature 1. A new poll reveals that more Americans would choose the Internet as their only news source than TV, depend on solely newspapers or magazines. The poll, conducted by the News Literacy Project, found that 42 percent of American adults say they rely exclusively on radio Internet for news. That’s survey from 33 percent in 2008. At the same time, the number of people relying on television solely information has declined since the poll began asking this question in 2003. In yesterday, 47 percent of Americans said they used TV exclusively for news. That’s down to 38 percent in 2008 and 34 percent today.
span perturbation
Description: Use a masked LM (Raffel et al., 2020) to rewrite spans of tokens by masked filling. Config: Rewrite 30% of 2-spans. A new poll reveals that more people choose the Internet as their primary news source than TV, radio, newspapers or magazines. The survey, conducted by The Media Literacy Project, found 73 percent of American poll respondents said they rely exclusively on the Internet for news. It’s up from 33 percent in 2008. At the same time, the number of people relying on television for news has declined since the poll began asking questions in 2007. In 2003, 47 percent of Americans said they used TV exclusively to get their news. That’s down to 38 percent in 2009, and 34 percent today.
inner-sentence paraphrasing
Description: Use Pegasus (Zhang et al., 2020) to paraphrase each sentence of the text and then join them. Config: Paraphrase 80% of the sentences. A new poll shows that more Americans would prefer the internet to TV, radio, newspapers or magazines. The poll, conducted by the News Literacy Project, found that 42 percent of American adults say they rely exclusively on the Internet for news. It was up from 33 percent in 2008. At the same time, the number of people relying on television for information has declined since the poll began asking this question in 2003. Almost half of Americans used TV exclusively for news in 2004. In 2008 it was 38 percent and today it is 34 percent.
inter-sentence paraphrasing
Description: Paraphrase with Dipper (Krishna et al., 2023), a paragraph-level paraphraser that can re-order, split, and merge sentences. Config: Lexical (L) diversity 60 and Order (O) diversity 60. Most Americans get their news from television, radio, and old-fashioned newspapers. In a recent poll by the Pew Research Center only 37 percent reported that they get news from newspapers. And that’s true. More Americans would now use the Internet to get their news than would do so newspapers, radio, or the Americanized news service. In the survey, “American View” was the second most favored channel, with 23 percent, and the Americanized news service was the third most favored with 13 percent. In 2010, 44 percent of Americans said they would get their news from newspapers. Now that’s just 33 percent. Down from the old-fashioned 32 percent in 2010.
prompt paraphrasing
Description: Paraphrase the raw prompt before generation using Pegasus. Config: - More Americans would choose the internet as their only news source, according to a new poll released recently. The survey shows a significant shift in how people consume news, with a growing preference for digital platforms over traditional media like television or newspapers. Respondents cited the convenience, immediacy, and accessibility of online sources as key reasons for this shift. However, concerns about misinformation and fake news persist, emphasizing the need for diligent fact-checking and critical evaluation of digital content. The study underscores the significant influence of the internet on shaping public opinion and the rapidly changing media landscape.
in-context learning Description: Given the example of HWT and MGT as positive and negative demonstrations when generating MGT on the same prompt. Config: 1 positive demonstration + 1 negative demonstration. A new poll reveals that more Americans would choose the Internet as their only news source than TV, radio, and print media. The survey further indicates that 60% of the respondents rely on social media for daily news updates, highlighting the increasing importance of platforms like Facebook, Twitter, and Instagram in news dissemination. The trend is particularly prominent among the younger demographic, with 70% of those aged 18-34 choosing the internet as their primary news source. Despite this, concerns about the spread of fake news and misinformation online persist, stressing the need for digital literacy and fact-checking mechanisms.
charactersubstituted generation
Description: Prompt to ask the model to generate the text with specific character substitution criteria and recover the output after finishing the whole generation. Config: Substitute ‘c’s and ‘k’s using GPT-4. A new poll reveals that more Americans would choose the Internet as their only news source than TV, radio or newspapers. This shift in preferenae highlights the growing influence of the Internet and digital technologa in shaping public opinion. It’s not surpriaing, given the ezae of access to information online. Yet, some raise concern over the increasing relianae on the web for news, as it makes it easier to spread misinformation. With fake news becoming a common issue, there’s a growing need for digital literacy and critical thinking skills to discern fact from fiction.
typo co-generation Description: Preset character substitution rules and execute the rules when finishing sampling each token and recover them after finishing the whole text generation. Config: Substitute ‘c’s and ‘k’s with 50% probability. A new poll reveals that more Americans would choose the Internet as their only news source than TV, radio or newspapers. The results 73 percent are reported by Pew Research that were conducted on an average of views based on discussions and polls around the Internet, and express popular ingestion vivid facts. The majority of Americans choose fer the Internet as their source of faksual information rather than TV news or radio news, reports Pew. About half online respondents (52%), for example, say they go there when they need information they likely folllow upwere.

heading: Future Work
text: Future MGT detectors that are able to measure the portion of LLM involvement in text writing are worth considering as an answer to this attack genre