Ghostbuster: Detecting Text Ghostwritten by Large Language Models (2024)

Abstract: We introduce Ghostbuster, a state-of-the-art system for detecting AI-generated text.Our method works by passing documents through a series of weaker language models, running a structured search over possible combinations of their features, and then training a classifier on the selected features to predict whether documents are AI-generated.Crucially, Ghostbuster does not require access to token probabilities from the target model, making it useful for detecting text generated by black-box or unknown models.In conjunction with our model, we release three new datasets of human- and AI-generated text as detection benchmarks in the domains of student essays, creative writing, and news articles. We compare Ghostbuster to several existing detectors, including DetectGPT and GPTZero, as well as a new RoBERTa baseline. Ghostbuster achieves 99.0 F1 when evaluated across domains, which is 5.9 F1 higher than the best preexisting model. It also outperforms all previous approaches in generalization across writing domains (+7.5 F1), prompting strategies (+2.1 F1), and language models (+4.4 F1). We also analyze our system’s robustness to a variety of perturbations and paraphrasing attacks, and evaluate its performance on documents by non-native English speakers.

## introduction language models such as chatgpt are capable of producing a wide range of fluent text that closely approximates human language use. however, the proliferation of these models has raised concerns about the authenticity and trustworthiness of text across a variety of domains. for example, concerns that students are submitting assignments ghostwritten by language models have led many schools to adapt by restricting the use of chatgpt in classrooms and homework assignments @xcite . meanwhile, because language models are prone to factual errors and hallucination, readers may desire to know if such tools have been used to ghostwrite news articles or other informative text when deciding whether to trust a source. several detection frameworks have been proposed to address this issue, such as detectgpt @xcite and gptzero @xcite . while these frameworks offer some level of detection, we found that their performance falters on datasets that they were not originally evaluated on (section 6). in addition, the high false positive rates of these models raise potential ethical concerns because they jeopardize students whose genuine work is misclassified as ai-generated. furthermore, previous work has indicated that text by non-native speakers of english is disproportionately flagged as ai-generated @xcite . these concerns underscore the need for ai-generated text detectors with strong generalization performance. we present ghostbuster, a method for detection based on structured search and linear classification (figure 1 ). first, ghostbuster passes paired humanauthored and ai-generated documents through a series of weaker language models, ranging from a unigram model to the non-instruction-tuned gpt-3 davinci. given the word probabilities from these models, it then searches over a space of vector and scalar functions that combine these probabilities into a small set of features. finally, it feeds these features into a linear classifier, as described in section 4. our model obtains 99.0 f1 on indomain classification, outperforming detectgpt and gptzero by an average margin of 23.7 f1. we also evaluated ghostbuster's generalization to new datasets, prompting strategies, and models (section 6) and conducted a number of ablations and robustness experiments (section 7). ghostbuster is available at ghostbuster.app; we release code for our method and replicating our experiments at github.com/vivek3141/ghostbuster. unigram trigram gpt-3 vector functions scalar functions logistic regression classifier it was a typical friday night, and i had decided to spend it at home, browsing the internet and catching up on some of my favorite shows. my roommate had gone… figure 1 : an outline of our model training procedure. first, we fed each document into a series of weaker language models to obtain token probabilities. then, we ran a structured search over combinations of the model outputs and trained a linear classifier on the selected features. ## related work language models exhibit only some statistical properties of human-authored text. @xcite found that ai-generated text adhered to heaps' type-token law less than humanauthored text, but was similar to human text in terms of unigram distribution, length, stopword usage, and adherence to zipf's rank-frequency law. @xcite found that improved decoding strategies, such as top-k sampling, fooled humans more often but introduced statistical abnormalities that made generated text easier to detect with models. ai-generated text also differs qualitatively, and often subtly, from human-authored text. @xcite found that gpt-2 responses that a model misclassified as human-authored tended to be short and contained issues of factuality, repetition, contradiction, and incoherence; @xcite found that larger models had fewer errors in areas such as factuality or coherence. @xcite also found that chatgpt answers were more formal and focused than human ones. ai-generated text also exhibits qualitative differences from human-authored text, though these are often subtle. @xcite found that gpt-2 responses that a model misclassified as human authored tended to be very short and contained issues of factuality, repetition, contradiction, and incoherence; however, @xcite had human labelers annotate ai-generated text and found that larger models were less likely to produce responses that were factually incorrect, contradicted common sense, or were incoherent, while the degree of self-contradiction and redundant text varies substantially depending on the model. more re-cently, @xcite found that while volunteers often rated chatgpt answers as more helpful than human ones, chatgpt answers were still more formal, more strictly focused, and used more conjunctions. one line of work aims to ensure that aigenerated text can be detected through deliberate watermarking of ai outputs @xcite @xcite . watermarking has the benefit of providing guarantees on the probability that text is successfully detected, though it relies on devlelopers incorporating watermarks into models. several tools have been introduced to detect ai-generated text in the absence of watermarking. gehrmann et al. (2019) introduced gltr, a suite of statistical tools to aid humans in detecting aigenerated text, which include overlaying text with the text's top-k annotation in different colors. de-tectgpt @xcite used the fact that unlike human-authored text, generated text lies in regions of the probability space where nearby samples often have lower model probability. their model generates random perturbations of the text from a generic lm to detect ai-generated text, then gets probabilities of the original text and perturbations from the model that might have generated the text. recent supervised methods have used logistic regression, roberta, and t5 to distinguish between human-authored and ai-generated text @xcite @xcite . all of this should be such a joy, a wondrous time where people all around the world are brimming with love and excitement over what they might have been brought. but it's not, i'm worried, i'm borderline panicked. every single year, i've felt my anxiety grow as the temperature drops, all because of one question nagging me between the ears. am i on the naughty list this year? and there's no answer, there's never an answer because we weren't given a guideline, there's no clear line drawn in the sand that we must not cross lest we end up on the naughty list. so we're left to our own devices, trying to live our lives as best we can, but people slip… it was a sunny december morning when the annual tradition of receiving christmas presents took a peculiar turn. the streets were filled with laughter, carolers singing joyously, and children eagerly awaiting the arrival of santa claus. but this year, things were different. word had spread like wildfire that everyone, without exception, would receive a christmas present. yet, there was an unsettling twist -these gifts would be based on how "good" one had been throughout the year. authorities were baffled, for no one knew who was behind this curious occurrence. as the clock struck midnight on christmas eve, parcels began appearing on doorsteps… prompt: every authority is baffled but for the past few years everyone has been receiving a christmas present. to some delight and others horror, the gifts are based on how 'good' you've been. ## datasets we collected three new datasets for benchmarking detection of ai-generated text across the domains of creative writing, news, and student essays. for each of the three datasets, we collected chatgpt-generated text corresponding to the human-authored text. all training datasets were generated using gpt-3.5-turbo. our creative writing dataset is based on the subreddit r/writingprompts, a forum in which users share creative writing prompts and craft stories in response to these prompts. in order to avoid contamination from chatgpt-written content, we collected data from the top 50 posters in october 2022 and scraped the last 100 posts by each of these users. 1 we used the scraped prompts to generate chatgpt-written essays. our news dataset is based on the reuters 50-50 authorship identification dataset @xcite , which consists of 5000 news articles by 50 journalists. because we did not have access to ground truth headlines or summaries for these articles, we first prompted chatgpt to generate a headline for each article (see appendix a), then prompted it to write an article based on each generated headline. finally, our student essay dataset is based on essays from ivypanda, which consists of high school and university level essays across a range of disciplines. as with the news dataset, we did not have access to the original prompts for these essays, so we used chatgpt to first generate a prompt corresponding to the essay and then generate a corresponding essay that responds to that prompt. in order to avoid spurious effects of document length, for each of the three domains, we also prompted chatgpt to approximately match the length of the corresponding human-written article, as shown in additional details on the prompting process and dataset statistics are provided in appendix a. for each task, the datasets were divided into train, vali-dation, and test sets. to validate task difficulty and ensure no major artifacts remained in the datasets, we asked human reviewers to label subsets of the essays as human or ai generated (see section 5). evaluation datasets to evaluate generalization across different models and prompting strategies, we collected claude-generated text based on the original prompt in ## model given the concerns of brittleness raised for many current ai-generated text detection systems @xcite @xcite , a principal objective for ghostbuster was to train a model with strong generalization ability across a variety of distribution shifts, including different text domains, prompts, and models. two of our baselines, a perplexityonly model and a roberta-based model, represent the extremes that ghostbuster aims to avoid (see baselines in section 5). the simplest approach, using document perplexity alone to distinguish ai-generated and human-authored text, resulted in a brittle and insufficiently expressive model with particularly poor performance on domain and style shifts, including worse-than-random accuracy on some out-of-domain tasks and on some nonnative english speaker data (see section 6). however, we also found that highly expressive models such as roberta can exhibit catastrophic worstcase performance, performing even worse than the perplexity-only baseline for certain domain shifts (up to 21.3 f1 drop). we designed ghostbuster to take a middle path, using combinations of features based on the probabilities of documents under a series of language models that are weaker than the target model. this combination of operations provides a comparatively simple way to add model capacity without creating a fully neural architecture, which is more likely to overfit. ## baselines we evaluated ghostbuster's performance relative to multiple existing methods, including unsupervised and supervised detectors, and conducted human evaluation to validate task difficulty. we compared our model to detectgpt @xcite , an unsupervised method that generates random perturbations of the text from a generic lm to detect ai-generated text, then gets probabilities of the original text and perturbations from the model that might have generated the text. however, detectgpt is known to perform poorly when the scoring and target models differ, making it less suitable for detection of text generated from commercial models like chatgpt or claude that do not surface token probabilities. following the implementation in @xcite , we used gpt-2 xl as the scoring model for detectgpt. we also compared with gptzero @xcite , a commercial model that uses a mixture of approaches, including supervised training, perplexity, variance in perplexity, and internet search. because neither detectgpt nor gptzero are trained on our datasets, their in-domain and ood results do not differ, and the generalization experiments provide the fairest comparison to ghostbuster. for both detectgpt and gptzero, we also performed oracle thresholding, where we set the distributions of predicted labels to match those of our test sets for a fairer comparison. however, we did not perform oracle thresholding on the precision-only evaluation in section 9, since it would trivially result in perfect accuracy. we also did not perform oracle thresholding on ghostbuster or any of the supervised baselines discussed below. our simplest supervised baseline is a linear classifier trained only on the perplexities of humanauthored and ai-generated documents, as measured by davinci; this classifier learns a single threshold parameter based on its training set. in addition, we fine-tuned a supervised roberta-based model on the same data, similar to the robertabased approaches in @xcite al. (2020), guo et al. (2023), and chen et al. (2023) . we employed roberta-large with a logistic regression head, and fine-tuned with early stopping. ## analysis to understand the performance of ghostbuster in more depth, we performed ablations that suggest the structured search and use of probabilities from a neural llm are crucial to performance (section 7.1). we also ran experiments on robustness to editing essays under different perturbations, finding that most global edits do not significantly affect performance and numerous local edits are required to fool the model. analyzing performance on shorter documents, we found that ghostbuster's perfor-mance improved with document length, and was generally more reliable on documents with more than 100 tokens. ## conclusion we introduced ghostbuster, a model for detecting ai-generated language that uses structured search on token probabilities from weaker models to identify whether a given document was aigenerated. we validated ghostbuster by evaluating its performance on datasets from three domains (news, student essays, and creative writing), as well as through generalization experiments on text generated by different models and using different prompts. we also release our three datasets as benchmarks for evaluating performance on detecting ai-generated text. ghostbuster achieved over 98.4 f1 across all datasets on in-domain detection of ai-generated text, representing substantial progress over currently available models. future work could examine tradeoffs between the false positive and false negative rates of aigenerated text detectors for different applications. for detection of ai-generated student essays, lowering the risk of false positives is a key priority to avoid false accusations of student misconduct. in other settings, however, false positives are less concerning. for example, if detectors are used to prevent ai-generated text from being used in language model training data, or to flag potentially ai-generated content on the web, the ideal model calibration may differ. other avenues for future work include improving robustness to perturbations of ai-generated outputs, such as lightly editing to avoid detection, and different task formulations, including detection at the paragraph level for documents that combine human-authored and ai-generated text. finally, future ai-generated text detectors could provide additional explanations for classification decisions, so that human users can use their own judgment when evaluating the decisions of these systems.