Are AI -Generated Text Detectors Robust to Adversarial Perturbations? (2024)

Abstract: The widespread use of large language models (LLMs) has sparked concerns about the potential misuse of AI-generated text, as these models can produce content that closely resembles human-generated text. Current detectors for AI-generated text (AIGT) lack robustness against adversarial perturbations, with even minor changes in characters or words causing a reversal in distinguishing between human-created and AI-generated text. This paper investigates the robustness of existing AIGT detection methods and introduces a novel detector, the Siamese Calibrated Reconstruction Network (SCRN). The SCRN employs a reconstruction network to add and remove noise from text, extracting a semantic representation that is robust to local perturbations. We also propose a siamese calibration technique to train the model to make equally confident predictions under different noise, which improves the model’s robustness against adversarial perturbations. Experiments on four publicly available datasets show that the SCRN outperforms all baseline methods, achieving 6.5%-18.25% absolute accuracy improvement over the best baseline method under adversarial attacks. Moreover, it exhibits superior generalizability in cross-domain, cross-genre, and mixed-source scenarios. The code is available at https://github.com/CarlanLark/Robust-AIGC-Detector .

## introduction large language models (llms) such as gpt-4 @xcite have shown great promise in producing text that closely mimics human language @xcite @xcite . however, concerns about the misuse of ai-generated text (aigt) have arisen in various areas, including the spread of fake news @xcite , academic dishonesty ## related work in recent years, large language models (llms) like gpt-2 @xcite and @xcite have shown impressive performance in various natural language generation tasks @xcite @xcite @xcite . however, the advent of more advanced models such as gpt-4 @xcite has raised concerns about the potential misuse of ai-generated texts (aigt) in areas like fake news @xcite , academic cheating @xcite , and ingroup bias @xcite . this highlights the importance of robust detection mechanisms to ensure the security and reliability of applications using llms. to differentiate between human-written and aigenerated texts, various aigt detection methods have been developed @xcite @xcite @xcite . these methods fall into two categories: metric-based and model-based. metric-based methods use a language model to generate scores for the text and create statistical features from them, such as probability score @xcite , rank score @xcite , and entropy score @xcite . model-based methods, on the other hand, employ neural network architectures and supervised learning to train detectors end-to-end using labeled text. for example, openai trained a roberta model to detect gpt-2-generated text @xcite , while @xcite developed a chat-gpt detector based on question-answer text from various domains. however, research shows that both metric-based and model-based detectors are susceptible to adversarial perturbations @xcite , such as synonym replacement @xcite . this means that minor word changes can lead to incorrect classification of aigenerated texts in various fields, including news, education, and finance. @xcite while robust methods have been introduced in related areas like sentiment analysis @xcite and speech recognition @xcite , a comprehensive analysis of the resilience of aigt detectors against adversarial perturbations remains lacking. in this work, we aim to explore the robustness of existing detectors against adversarial perturbations, both in-domain and out-of-domain. ## conclusion while ai-generated text (aigt) detection is promising for various applications, it struggles with the robustness of current methods against adversarial perturbations. to tackle this, we introduce the siamese calibrated reconstruction network (scrn). scrn uses a reconstruction network to model text perturbations and employs siamese calibrated training to improve inference robustness. experiments demonstrate scrn's effectiveness in defending against adversarial perturbations in four aigt scenarios, highlighting its practical utility in addressing real-world aigt detection challenges.