G en AI Content Detection Task 3: Cross-Domain Machine Generated Text Detection Challenge (2025)

Abstract: Recently there have been many shared tasks targeting the detection of generated text from Large Language Models (LLMs). However, these shared tasks tend to focus either on cases where text is limited to one particular domain or cases where text can be from many domains, some of which may not be seen during test time. In this shared task, using the newly released RAID benchmark, we aim to answer whether or not models can detect generated text from a large, yet fixed, number of domains and LLMs, all of which are seen during training. Over the course of three months, our task was attempted by 9 teams with 23 detector submissions. We find that multiple participants were able to obtain accuracies of over 99% on machine-generated text from RAID while maintaining a 5% False Positive Rate—suggesting that detectors are able to robustly detect text from many domains and models simultaneously. We discuss potential interpretations of this result and provide directions for future research.

## introduction the detection of ai generated text is an increasingly relevant task in the modern age. such detection can help combat misinformation @xcite , phishing attacks @xcite , and other fraudulent activities @xcite . this is particularly important given that humans struggle to detect generated text reliably @xcite and that generated text is often more persuasive than human-written text @xcite . recently there has been an increase in large scale shared tasks for ai generated text detectors @xcite @xcite . these shared tasks tend to either focus on one particular domain or hold out many domains and llm generators in the final test set. this prevents us from understanding how well a single de-tector can detect text from a large fixed set of models and domains. such a setting is important to understand as it helps us to delineate the boundaries of our detector capabilities. for example, it is clear that detectors trained on a single llm can accurately detect text from that model @xcite but does this extend to arbitrarily many llms? what about arbitrarily many domains? in particular we attempt to answer the following research questions: in order to test these research questions, we conduct this shared task using the newly released raid benchmark @xcite . raid is a dataset of over 10 million documents from 11 generative models, 8 textual domains, 4 decoding strategies, and 11 adversarial attacks. we chose raid as it is one of the largest benchmarks currently available, and it features variation across decoding strategies and adversarial attacks as well as a large variety of textual domains. crucially, the test set of raid does not include any held-out models or domains and has yet to be released publicly. therefore raid allows us to answer our research questions most effectively. we received 23 submissions to the shared task from 9 different teams, and 7 system description papers. the results of the evaluation are publicly available. 1 the two best performing teams (pangram and leidos) achieved extremely strong performance without adversarial attacks (99.3%) and with adversarial attacks (97.7%). in this paper we will summarize our general takeaways from this re- sources in the raid dataset generative models (@xmath0, gpt3, gpt4, cohere, cohere chat, mpt 30b, mpt 30b chat, mistral 7b, mistral 7b chat, chatgpt, llama 70b chat domains (@xmath1, recipes, books, reddit, news, reviews, poetry, wiki decoding strategies (@xmath2, random sampling (@xmath3, top-@xmath4, greedy + repetition penalty, sampling + repetition penalty adversarial attacks (@xmath5, homoglyph, article deletion, number swap, insert paragraphs, upper lower swap, paraphrase, synonym swap, zero width space, misspelling, whitespace addition ## related work the shared tasks most similar to ours are the se-meval24 task 8 and genai content detection task 1 @xcite . both of these tasks include outputs from many generative models and domains in both their train and test set. however, as mentioned in the introduction, these tasks hold out many domains and models in their test set to test the generalization performance of classifiers to new unseen models and domains. in our task we explicitly give all domain and model information to our participants up front and only hold out particular articles within such domains. other shared tasks in the past have also evaluated generated text detectors in specific high-risk domains such as academic essays @xcite scientific papers @xcite or news articles @xcite . previous shared tasks have also studied detection in a multilingual context @xcite @xcite @xcite . while such tasks are interesting and valuable, they do not test what we are interested in, namely the ability of single detectors to detect text from many different models and domains. finally, the recent voight-kampff task @xcite is particularly noteworthy. in their task they employ a set of builders (who build detectors) and breakers (who create adversarial datasets to fool the detectors). they are the first shared task to explicitly include adversarial constraints into their evaluation-experimenting with homoglyph attacks and different detailed prompt formulations with bullet points and summaries of the original source texts. however, they conduct their task in a pairwise manner, giving each detector two texts, one of which must be human-written, and asking the detector to select the human-written text. while they showed that detectors can do well on this highly adversarial task (96.1 roc auc score for the top team), we target the more difficult yet more realistic version of the task, where a single document is given as input. ## submissions we received 23 submissions to the shared task from 9 different teams, and system description papers from 7 of 9 teams. in this section, we describe the systems submitted by each team in detail. in section 6 we will discuss aggregate results for the teams and in section 7 we will discuss the broader trends across our participant submissions. team luxveri [lx] (mobin and islam, 2025): this team fine-tuned both roberta-base and roberta-base-openai-detector on a subset of the raid training data for 3 epochs, using a learning rate of 2e-5, a batch size of 4, and the adamw optimizer. these trained models were then used to compute weights for ensembling based on an inverse perplexity weighting technique, which was applied to the ensemble for the adversarial task. for the non-adversarial task, they only used robertabase with the same hyperparameters. team random [ra] @xcite : this team's contributions include a pipeline that integrates xlm-roberta embeddings for enhanced text representation, domain adaptation using a domain-adversarial neural network (dann) @xcite to minimize domain-specific biases and improve generalization across diverse text domains, and adversarial robustness through incorporating adversarial attack classification to detect and mitigate manipulative techniques. team ustc-bupt [us] : this team fine-tuned roberta-large via focal loss @xcite on the raid training set by adding four samples for each human sample using synonym replacement. they then down-sampled the ai-written texts from a 10:1 ratio to a 2:1 ratio of ai to human text to form the training set. in the hyperparameters for focal loss, they set alpha to 0.65 and gamma to 2.5. they used a learning rate of 1e-6 and adamw as the optimizer. in addition to this, they also had a secondary submission where they simply finetuned roberta-base on a subset of the raid training set with learning rate of 5e-5. @xcite : this team's approach uses robust authorship style representations to distinguish between human-authored and machine-generated text (mgt) across various domains. their authorship attribution (aa) systems are trained with contrastive learning. they employ an ensemble-based aa system (alert v1.1) that integrates stylistic embeddings from two complementary subsystems: one system that focuses on cross-genre robustness with hard positive and negative mining strategies using linq-embed-mistral @xcite as backbone architecture, and a second system with semantic, lexical, clustering based hard positive and negative mining which uses qwen2-1.5b. ## broader trends across all submissions to the shared task we find the following broader trends: trend 1: text preprocessing the first clear trend we saw was the use of text preprocessing. team @xcite both trained classifiers to detect particular adversarial attacks in the dataset in order to apply preprocessing, and team [pa] simply ran all incoming text to the detector through text normalization. looking at the results, these methods seemed to be largely effective at neutralizing many of the simpler adversarial attacks such as zero-width space, upper-lower swap, insert paragraphs, whitespace insertion and alternative spelling. however, attacks such as paraphrasing, synonym swap, article deletion, and misspelling seem to be more difficult to preprocess away. such attacks, which either create or destroy vital information in the text, can be seen as fundamentally different and more difficult to defend against. ## discussion in real-world scenarios, api-based detectors can expect a majority of their text to come from a relatively small set of llms and domains. the most common frontier models (gemini pro, claude 3.5, gpt-4o) will mostly likely be used to generate text in a set of high-risk domains (academic essays, news articles, scientific papers) with potentially some paraphrasing or synonym changes applied to help avoid detection. in such cases, it is desirable for a detector to focus on optimizing performance as much as possible on this fixed set of models and domains while not caring as much about performance on other less common models. our results show that detectors can exhibit very strong performance in such constrained settings. future work should seek to further target this particular setting and replicate these findings on a much more diverse corpus. such a study would entail collecting many generations from a core set of models in high risk domains and conduct a heavy adversarial attack circuit. since prompt-based attacks are likely to be common (e.g. "write in a way that is not detectable") these should be a major focus. in addition, testing a large set of "humanizing" paraphrase models is also desirable. it is unclear whether or not our results will extend to models that have significant prompt and paraphrase finally, it is worth noting that detectors doing well in constrained settings does not imply generalization to unseen models. detectors still suffer from poor generalization across unseen models and domains as discussed in @xcite . however, this discrepancy between in-distribution and out-of-distribution performance is something that is worth highlighting as a potential source for future investigation.