Smaller Language Models are Better Zero-shot Machine-Generated Text Detectors (2024)

Abstract: As large language models are becoming more embedded in different user-facing services, it is important to be able to distinguish between human-written and machine-generated text to verify the authenticity of news articles, product reviews, etc. Thus, in this paper we set out to explore whether it is possible to use one language model to identify machine-generated text produced by another language model, in a zero-shot way, even if the two have different architectures and are trained on different data. We find that overall, smaller models are better universal machine-generated text detectors: they can more precisely detect text generated from both small and larger models, without the need for any additional training/data. Interestingly, we find that whether or not the detector and generator models were trained on the same data is not critically important to the detection success. For instance the OPT-125M model has an AUC of 0.90 in detecting GPT4 generations, whereas a larger model from the GPT family, GPTJ-6B, has AUC of 0.65.

## introduction with the rapid improvement in fluency of the text generated by large language models (llms), these system are being adopted more and more broadly in a wide range of applications, including chatbots, writing assistants, and summarizers. generations from these models are shown to have human-like fluency @xcite , making it difficult for human readers to differentiate machine-generated text from human-written text. this can have significant ramifications, as such llm-based tools can be abused for unethical purposes like phishing, astroturfing, and generating fake news @xcite . as such, we need to be able to reliably and automatically detect machine generated text. while there has been work on training specialized classifiers for distinguishing between machinegenerated text of specific models and human-written text @xcite , such approaches are not always applicable as access to training data might be limited, the classifier might overfit to a given model's generation, and it would need to be constantly updated to account for distribution shifts. as such, zero-shot methods are developed that can detect machine generated text without any training, using the generator model and its likelihood distribution over tokens @xcite @xcite . in practice, however, we often need to detect machine-generations in situations where we do not know which model could have been used as the text generator -and even if we do know the generator, we might not have white-box access to it or its logits, or access might be behind a paywall (e.g. gpt3). therefore, in this paper we set out to explore the zero-shot detection of machine-generated text without any knowledge of the generator, or access to it. we do this by exploring whether it is possible to use signals from one language model (a detector model) to identify machine-generated text generated by another language model (the generator). we use surrogate detector models, whose likelihood functions we do have access to, and run zero-shot tests using different signals such as likelihood, rank, log rank, and curvature of the detector model over text @xcite @xcite to distinguish between machine-generated and human written text. we call this cross-detection. we conduct an extensive empirical analysis by experimenting on a slew of models with different sizes (from tens of millions to billions of parameters), architectures (gpts, opts, pythias) and pre-training data (webtext and the pile). our main finding is that zero-shot cross-detection can come very close to self-detection and non-zeroshot oracle in terms of distinguishablity, with smaller models being the best universal detectors, regardless of the generator architecture or training data. for instance for gpt4 the auc of using opt-125m as a cross-detector is 0.90, whereas opt 6.7b's auc is 0.71. we then further in-human written text ## methodology and experimental setup figure 1 shows the methodology of our work, where for a given target pool of sequences (with a 50%/50% composition of machine-generated/human-written text), the task is to determine if each sequence is human-written or machine-generated by running a detection test using the likelihood surface of a surrogate detector model. detection test. we try various detection test-based zero-shot methods that rely on the predicted tokenwise conditional distributions of the generator model for detection. however, these methods were originally intended for self-detection (i.e. detecting text from a known, available generator using the model itself), whereas we test them in a cross-detection setup (i.e. using the surrogate detector model). we use four different signals for our detection tests. (1) log-likelihood: average token-wise log probability, with the intuition that sequences with higher log probability are more likely to be machine-generated. ( 2 ) & (3) rank and logrank (solaiman et al., 2019) which is the average observed rank or log-rank of the tokens based on the detector model, with the intuition that machine generated text tends to have lower rank. (4) curvature @xcite , which uses the localoptimality of a point with respect to its neighbors (i.e. perturbations), in the likelihood surface of the detector model. the intuition is that if the likelihood of a point is much higher than most of its neighbors, then it is more likely to be machine-generated. for all these signals, the detection test places a threshold on the value and determines human-written vs. machine generated based on that. we compare results to an oracle, non-zero shot baseline, which is the openairoberta-base model, a classifier specifically trained by openai to detect machine-generated text. success metric. we evaluate the success of the detector by measuring the area under the roc curve (auc), i.e. the false positive vs. true positive rate curve. the higher the auc, the more distinguishing power the detection mechanism has. we use this measure as it is threshold independent and measures the true power of the method. ## does cross-detection work? in this section we present our experimental results and show that cross-detection can perform as well as self-detection and come very close to a non-zero shot oracle baseline. we also experiment with partially trained checkpoints of different detector models, and find that for larger models, partially trained checkpoints are better cross-detectors than fully trained ones. we provide extensive heatmaps, ablations of choosing the neighborhood, and a study of the performance of detection under a paraphrasing attack in appendix b . ## related work the problem of machine-generated text detection has already been studied for multiple years using a variety of different approaches @xcite al., 2020; jawahar et al., 2020; uchendu et al., 2020, 2021): both gehrmann et al. (2019) and dugan et al. ( 2022 ) have found that humans generally struggle to distinguish between human-and machine-generated text, thereby motivating the development of automatic solutions. among those, some methods aim to detect machinegenerated text by training a classifier in a supervised manner @xcite , while others perform detection in a zero-shot manner @xcite . there is also a line of work that relies on bot detection through question answering @xcite , which is outside the scope of this paper. most recently, @xcite introduced the zero-shot method detectgpt, which is based on the hypothesis that texts generated from a llm lie on local maxima, and therefore negative curvature, of the model's probability distribution. other strategies have been proposed to enable the detection of machinegenerated text in the wild. one such method is watermarking, which injects algorithmically detectable patterns into the released text while ideally preserving the quality and diversity of language model outputs. watermarks for natural language have already been proposed by @xcite and have since been adapted for outputs of neural language models @xcite . notable recent attempts for transformer based language models include work by @xcite , who propose an adversarial watermarking transformer (awt). while this watermarking method is dependent on the model architecture, @xcite propose a watermark that can be applied to texts generated by any common autoregressive language model. relationship to membership inference attacks. prior work @xcite demonstrated that the same optimality test can be used to distinguish between training set members and non-training members, i.e. as a membership inference attack. as our experiments showed, when models size up the detection power (i.e. distinguishablity between machine-generated and human-written text) decreases. for mia, however, prior work demonstrate inverse scaling, as in larger models demonstrate higher distinguishing power @xcite . we attribute this to the higher memorization capablities of these models, as shown by @xcite , making it easier for them to recognize their training data. ## conclusion with the increasing prevalence of llms it becomes crucial to differentiate between text written by humans and text generated by machines so as to avoid fake news and impersonations. as such, we set out to explore the possibilities of using existing models to detect generations from unknown sources, and distinguish them from human written text. we find that when using zero-shot detection methods, smaller models are overall better at detecting generations, and larger models are poor detectors. our results offer hope of robust general purpose protection against llms used with nefarious intentions.