Navigating the Shadows: Unveiling Effective Disturbances for M odern AI Content Detectors (2024)

Abstract: With the launch of ChatGPT, large language models (LLMs) have attracted global attention. In the realm of article writing, LLMs have witnessed extensive utilization, giving rise to concerns related to intellectual property protection, personal privacy, and academic integrity. In response, AI-text detection has emerged to distinguish between human and machine-generated content. However, recent research indicates that these detection systems often lack robustness and struggle to effectively differentiate perturbed texts. Currently, there is a lack of systematic evaluations regarding detection performance in real-world applications, and a comprehensive examination of perturbation techniques and detector robustness is also absent. To bridge this gap, our work simulates real-world scenarios in both informal and professional writing, exploring the out-of-the-box performance of current detectors. Additionally, we have constructed 12 black-box text perturbation methods to assess the robustness of current detection models across various perturbation granularities. Furthermore, through adversarial learning experiments, we investigate the impact of perturbation data augmentation on the robustness of AI-text detectors. We have released our code and data at https://github.com/zhouying20/ai-text-detector-evaluation.

## introduction with the rise of llms @xcite @xcite , concerns about the misuse of generated content have been growing @xcite @xcite , making ai-text detection a topic of significant attention from the research community. several methods for detecting ai-generated text have recently been proposed, including finetuned classifiers @xcite , statistical approaches @xcite , watermarking @xcite , and retrieval techniques @xcite . additionally, online education service providers such as copyleak foot_0 and gptzero @xcite have introduced ai text detection services. however, criticisms regarding misclassification results from various users have surfaced. simultaneously, in domains like essay writing, there is a demand from users to bypass ai text detection using perturbation methods, whereas numerous open-source tools like gptzzz foot_1 and aitextdetectionbypass foot_2 have emerged. recent efforts have begun to explore the vulnerabilities of current detection models @xcite @xcite @xcite , utilizing methods such as rewrite and substitution to modify ai-generated content, rendering it indistinguishable from human-authored text. this underscores the importance of investigating and identifying potential weaknesses in current detectors before their deployment, ensuring their robustness and mitigating potential risks. simultaneously, more comprehensive work has started to summarize the issues with current detection methods and propose corresponding robustness enhancement techniques, such as radar @xcite and retrieval @xcite . despite enhancing the models' defense against specific types of text perturbations to some extent, these works still face two major limitations. firstly, these efforts primarily focus on ai text detection in specific writing scenarios. secondly, they typically involve only one type of perturbation, i.e., paraphrasing. in practical applications, detectors are likely to encounter a more complex and diverse set of scenarios, involving various application contexts and potential text perturbations. to this end, our work aims to investigate and analyze the accuracy and robustness of various ai text detection algorithms in simulating real writing scenarios. specifically, within three categories of ai text detection methods, we evaluate six representative off-the-shelf models on data generated by chatgpt. to simulate users' writing demands, we categorize ai-generated text into professional and informal writing scenarios and test detection accuracy accordingly. as expected, current text detection models exhibit lower accuracy in professional writing scenarios. furthermore, following an exploration of current text perturbation methods, we devise 12 types of text perturbations across four granularities. we apply these perturbations to the test data, generating 120,000 adversarial samples to investigate the robustness of current detection systems. the results reveal that, apart from the extensively studied paraphrase methods, word-level perturbations also significantly reduce ai text detection rates. building on earlier work, we further delve into exploring the minimum budget for adversarial learning to train robust text detectors. additionally, we conduct preliminary investigations into transfer learning in the context of adversarial text detection. our work can be summarized into three parts: 1) we validate the detection accuracy of three types of current detection models in both professional and informal writing scenarios. this analysis identifies a lack of generalization performance in current detection systems. 2) we systematically and hierarchically design ai-text perturbation methods. the results demonstrate that perturbations at various granularities significantly reduce detection per-formance. additionally, we observe inconsistent performances of different detection models when faced with perturbations. 3) budget and transfer experiments provide references and suggestions for future efforts to enhance the robustness of ai-text detectors. ## experimental setup in this section, we first survey the current state-ofthe-art ai-text detection methods. subsequently, considering the presence of intentional or unintentional perturbation attacks in real-world applications that can impact the performance of detection models, we synthesize and implement 12 black-box perturbation methods. here, "black-box" refers to attacking algorithms lacking access to internal information of detectors, such as gradients or hidden states. meanwhile, building upon the scoring-based configuration of existing detectors, we investigate the challenges associated with metric selection and threshold determination in evaluation. ## conclusions in this paper, we study two real-world application scenarios for ai text detection: professional writing and informal writing. we evaluate the current sota detection performance in both scenarios using three categories of detection methods and six representative models. furthermore, we introduce and design a set of 12 text perturbation methods, demonstrating the vulnerability of current detection models at different levels of granularity. finally, we apply adversarial learning in the context of perturbed data augmentation, validating the minimum budget and transferability of enhancing classifier models. in future work, we plan to extend our evaluations to include more llm-generated data, such as vicuna @xcite and mistral @xcite .