D etect LLM : Leveraging Log Rank Information for Zero-Shot Detection of Machine-Generated Text (2023)

Abstract: With the rapid progress of Large language models (LLMs) and the huge amount of text they generate, it becomes impractical to manually distinguish whether a text is machine-generated. The growing use of LLMs in social media and education, prompts us to develop methods to detect machine-generated text, preventing malicious use such as plagiarism, misinformation, and propaganda. In this paper, we introduce two novel zero-shot methods for detecting machine-generated text by leveraging the Log-Rank information. One is called DetectLLM-LRR, which is fast and efficient, and the other is called DetectLLM-NPR, which is more accurate, but slower due to the need for perturbations. Our experiments on three datasets and seven language models show that our proposed methods improve over the state of the art by 3.9 and 1.75 AUROC points absolute. Moreover, DetectLLM-NPR needs fewer perturbations than previous work to achieve the same level of performance, which makes it more practical for real-world use. We also investigate the efficiency-performance trade-off based on users’ preference for these two measures and provide intuition for using them in practice effectively. We release the data and the code of both methods in https://github.com/mbzuai-nlp/DetectLLM.

## introduction large language models (llms) have made rapid advancements in recent years, and are now able to generate text with significantly improved diversity, fluency, and quality. models such as chat-gpt (openai, 2022), gpt-3 @xcite , llama @xcite and bloom @xcite demonstrate exceptional performance in answering questions @xcite , writing stories @xcite and thus facilitating daily life and improving work efficiency. however, llms can also be misused for generating plagiarized text, misinformation, and propaganda, which can lead to negative consequences @xcite . for instance, students might use llms to write assignments @xcite , making fair evaluation difficult for teachers, and in the long run, undermining the integrity of the entire education system. malicious actors might generate fake news articles to spread misinformation and propaganda or to manipulate public opinion, which is dangerous, especially when it comes to politics @xcite . with the proliferation of llms and the increasing amount of texts they produce, it is challenging for humans to accurately identify machinegenerated texts @xcite . moreover, it is unrealistic to hire humans to manually identify machine-generated text at scale due to the prohibitively high costs and the efficiency requirements in real-time applications, e.g., in social media. thus, it is essential to develop tools and strategies to automatically identify machine-generated text and to mitigate the potential negative impact of llms. the problem of distinguishing machinegenerated from human-written text is commonly formulated as a binary task @xcite . most previous work has focused on the black-box scenario, where the detector has access to the output of the llms only and cannot make use of its internals. such methods lack flexibility since they need to be retrained from scratch to be able to recognize the output of a new llm @xcite . given the speed at which new llms are developed, black-box methods are becoming more and more expensive and impractical. in cases when the access to the llm is via an api only, one possibility is for the llm owner to record all content it has generated, or to watermark all texts it has generated @xcite . however, such solutions are not feasible for third parties. we therefore consider a white-box setting, where the detector has full access to the llms. we focus on zero-shot methods, where we use the llm without additional training. generally speaking, zero-shot methods use the source llm to extract statistics such as the average per-token log probability or the average rank of each token in the ranked list of possible choices to make a prediction by comparing it to a threshold @xcite @xcite . based on whether the queried statistics are only about the target texts, we can roughly categorize them as perturbation-free and perturbation-based. perturbation-free methods only query llms about the statistics on the target text x, while perturbation-based methods such as @xcite queries also the statistics of additional perturbed texts, which achieves better performance but is 50-100 times more costly than perturbation-free methods. thus, there exists a trade-off between performance and efficiency among zero-shot methods. to mitigate the gap of these two categories and design zero-shot methods with better performanceefficiency balance, we should either improve the accuracy of perturbation-free methods or reduce their cost. thus, we propose two novel zero-shot methods, one perturbation-free, but more accurate than previous methods, and one perturbation-based method, but with better efficiency. in the perturbation-free method we proposed, we apply log-likelihood log-rank ratio (lrr), which enhances log-likelihood information with log-rank information as the discerning feature that achieves better performance than existing perturbation-free methods and can even surpass perturbation-based methods on some llms. for the perturbation-based method, we use normalized perturbed log rank (npr), which is based on the intuition that machine-generated texts are more sensitive to minor rewrites (or small perturbations). compared to existing perturbation-based methods such as detectgpt @xcite , this approach takes less time and computational resources and is more efficient. we denote these two methods detectllm-lrr and detectllm-npr respectively. our contributions are as follows: ## related work the detection of machine-generated text is commonly formulated as a classification task @xcite @xcite @xcite . one way of solving it is to use supervised learning, where a classification model is trained on a dataset containing both machine-generated and human-written texts. for example, gpt-2 detector @xcite fine-tunes roberta @xcite on the output of gpt-2, while the chatgpt detector @xcite fine-tunes roberta on the hc3 @xcite dataset. however, models trained explicitly to detect machine-generated texts may overfit their training distribution of the domains @xcite . another stream of work attempts to distinguish machine-generated from human-written texts based on statistical irregularities in the entropy @xcite , perplexity @xcite or in the n-gram frequencies @xcite . @xcite introduced hand-crafted statistical features to assist humans in detectingmachine generated texts. moreover, @xcite noted the efficacy of simple zero-shot methods for detecting machine-generated text by evaluating the per-token log probability of texts and using thresholding. @xcite observed that machine-generated texts tend to lie in the local curvature of the log probability and proposed de-tectgpt, whose prominent performance can only be guaranteed by the large size of the perturbation function and by a large number of perturbations, and thus costs more computational resources. other work explored watermarking, which imprints specific patterns of the llm-output text that can be detected by an algorithm while being imperceptible to humans. @xcite and @xcite watermarked machine-generated text using syntax tree manipulation, while @xcite required access to the llm's logits at each time step. ## improved zero-shot approaches by leveraging log-rank information in this section, we introduce the log-likelihood log-rank ratio (lrr) and the normalized perturbed log-rank (npr). lrr combines log-rank and log-likelihood as they provide complementary information about the text. npr uses the idea that the log-rank of machine-generated texts should be more sensitive to smaller perturbations. ## experimental setup in this section, we conduct comprehensive experiments to evaluate the performance of lrr and npr in comparison to several methods previously proposed in the literature. we experiment with llm sizes varying from 1.5b to 20b parameters, probing the boundary of zero-shot methods when llms continue to grow in size. we further study the impact of the perturbation function, the number of perturbations (especially for npr and detect-gpt), the decoding strategy, and the temperature. data following @xcite , we use three datasets: xsum @xcite , squad @xcite , writingprompts @xcite , containing news articles, wikipedia paragraphs and prompted stories, respectively, as human-written texts and we produce machine-generated texts using llms. these datasets are chosen to represent the areas where llms could have a negative impact. for each experiment, we evaluate 300 machine-generated and human-written texts pairs by prompting the llms with the first 30 tokens of the human-written text. we release the code for this. evaluation measure following previous work @xcite @xcite , we use the area under the receiver operating characteristic curve (auroc), which is the probability that a classifier correctly ranks the machinegenerated example higher than human-written example. since for zero-shot methods, detection rates are heavily dependent on the threshold when using discriminative statistics, auroc is commonly used to measure zero-shot detector performance, which considers the range of all possible thresholds @xcite . ## analysis of the efficiency though in ## conclusion in this paper, we proposed two simple but effective zero-shot machine-generated text detection methods by leveraging the log-rank information. the methods we proposed -lrr and npr-, achieve state-of-the-art performance within their respective category. in addition, we explored different settings such as decoding strategy and temperatures, as well as different perturbation functions and number of perturbations to better understand the advantages and the disadvantages of different zero-shot methods. then, we analyzed the computational costs of these methods, and we provided guidance on balancing efficiency and performance.