Kill two birds with one stone: generalized and robust AI -generated text detection via dynamic perturbations (2025)

Abstract: The growing popularity of large language models has raised concerns regarding the potential to misuse AI-generated text (AIGT). It becomes increasingly critical to establish an excellent AIGT detection method with high generalization and robustness.While, existing methods either focus on model generalization or concentrate on robustness.The unified mechanism, to simultaneously address the challenges of generalization and robustness, is less explored. In this paper, we first empirically reveal an intrinsic mechanism for model generalization and robustness of AIGT detection task.Then, we proposed a novel AIGT detection method (DP-Net) via dynamic perturbations introduced by a reinforcement learning with elaborated reward and action.Experimentally, extensive results show that the proposed DP-Net significantly outperforms some state-of-the-art AIGT detection methods for generalization capacity in three cross-domain scenarios.Meanwhile, the DP-Net achieves best robustness under two text adversarial attacks.

## introduction recently, the emergence of large language models (llms) has significantly enhanced the capabilities of natural language generation. with continuous improvements in model parameters, data scale, and ai-human alignment techniques, these llms are now capable of generating text that is grammatically correct, semantically coherent, and very similar to human-written text, making it difficult for humans to distinguish between machine-generated and human-written content. as powerful tools for streamlining content creation, llms are widely used across various domains, including journalism, academia, and social media. however, the threats posed by ai-generated text (aigt), such as academic dishonesty @xcite , fake news @xcite , and false comments @xcite have raised significant concerns. to prevent the llm abuse with malicious purpose, numerous aigt detection methods have been proposed, utilizing the specific feature differences between human-written text and ai-generated text. mainstream aigt detection methods typically fall into one of two categories: white-box or blackbox detection, depending on whether the generator's parameters are accessible. while some whitebox methods @xcite @xcite achieve high-precision detection by extracting textual features from the generator's output logits, black-box aigt detection methods @xcite @xcite are gaining increasing attention for their ability to operate without accessing the model's parameters, making them particularly relevant in the context of many closed-source commercial llms. current black-box aigt detection methods learn deep features on large annotated datasets, preforming well when training and testing samples are independent and identically distributed (i.i.d). however, the detection of out-of-distribution (ood) samples is inevitable in real-world application scenarios. therefore, some researchers are concentrated on enhancing generalization capacity for cross-domain detection @xcite . these methods aim to enhance generalization in unknown target domains through different feature alignment strategy. some studies @xcite introduce zero-shot learning methods to achieve domain-generalization aigt detection in unpredictable target distributions by extracting effective domain-invariant features. to evade detection, users may attempt to modify the generated text when using ai tools. however, current aigt detectors face challenges in detecting minor adversarial perturbations @xcite . therefore, some research has explored robust aigt detection methods @xcite . despite the good generalization ability of existing aigt methods, they are vulnerable for text adversarial attacks. meanwhile, some robust detection method can not achieve good generalization for ood data. an interesting and challenging problem is how to construct a comprehensive framework that exhibits high generalization and robustness against text adversarial attack. in this paper, we argue that model generalization and robustness are intrinsically linked. both concepts can be viewed as responses to variations introduced in the source domain. specifically, robustness is often validated by introducing minor perturbations within the source domain, while ood data can be understood as changes in the distribution resulting from more substantial and specific disturbances. the analysis spontaneously induce an evident thinking: can adding elaborated perturbations simultaneously improve generalization and robustness of aigt detection network? in order to exploring the rationality of the above thinking, we first empirically reveal an intrinsic mechanism for model generalization through making quantitative and qualitative experiments. then, in light of the intrinsic mechanism, we propose a novel aigt detection method via dynamic perturbations (called dp-net). the crux of dp-net is that dynamic perturbations, added into embedding matrix in training phase, are yielded by a reinforcement learning with elaborated reward and action. extensive experiments demonstrate that the proposed dp-net can significantly improve the generalization and robustness for aigt detection task. our contributions are as follows: in other words, adding slight perturbations into source domain can effectively simulate the domain shift between source and target domains. ## conclusion we have proposed a novel aigt detection method via dynamic perturbations (dp-net) to simultaneously improve the model generalization and robustness against text adversarial attack. the dp-net combines rl with a noise-enhanced training strategy. it adaptively introduces noise-enhanced samples to train the encoder, enhancing model generalization and robustness. experiments show that the dp-net performs excellently in robustness tests, maintaining high average detection accuracy under attacks in cross-domain situations. by continuously adjusting the distribution through rl, the introduction of gaussian noise enables the model to achieve better generalization and robustness compared to uniform noise.