Mitigating Paraphrase Attacks on Machine-Text Detection via Paraphrase Inversion (2025)

Abstract: High-quality paraphrases are easy to produce using instruction-tuned language models or specialized paraphrasing models. Although this capability has a variety of benign applications, paraphrasing attacks—paraphrases applied to machine-generated texts—are known to significantly degrade the performance of machine-text detectors. This motivates us to consider the novel problem of paraphrase inversion, where, given paraphrased text, the objective is to recover an approximation of the original text. The closer the approximation is to the original text, the better machine-text detectors will perform. We propose an approach which frames the problem as translation from paraphrased text back to the original text, which requires examples of texts and corresponding paraphrases to train the inversion model. Fortunately, such training data can easily be generated, given a corpus of original texts and one or more paraphrasing models. We find that language models such as GPT-4 and Llama-3 exhibit biases when paraphrasing which an inversion model can learn with a modest amount of data. Perhaps surprisingly, we also find that such models generalize well, including to paraphrase models unseen at training time. Finally, we show that when combined with a paraphrased-text detector, our inversion models provide an effective defense against paraphrasing attacks, and overall our approach yields an average improvement of +22% AUROC across seven machine-text detectors and three different domains.

## introduction recent developments in the capabilities of large language models (llms) such as @xcite have resulted in their widespread use by a variety of users. although most users act responsibly, there is growing concern about abuses of llms, such as for plagiarism, spam, or spreading misinformation @xcite . to minimize the abuse of these systems, several machine-text detection systems have been proposed, including binoculars @xcite , fastdetectgpt @xcite , and watermarking-based algorithms @xcite . however, these systems often fail to detect text that has been paraphrased by another model @xcite , leaving a critical gap in current detection systems. to tackle this issue, a recent study has proposed jointly training a paraphraser and a machine-text detector with an adversarial objective: the paraphraser generates text to evade detection, while the detector identifies paraphrased text @xcite . another study has proposed that llm api providers cache their generations, enabling retrieval over a semantic space, where candidates with high similarity to previous generations are marked as paraphrases @xcite . unfortunately, both approaches lack generality, as they depend on training a specialized detector, or having access to all model generations. a more desirable defense would be detector agnostic, improving the performance of any detector. ideally, if the original tokens of a paraphrased text could be recovered, machine-text detectors would perform well, eliminating the need for any specialized solutions. therefore, we propose the novel task of paraphrase inversion, where the objective is to recover the original text from a paraphrased one. this approach has the added benefit of being detector agnostic. given the space of possible paraphrases and the stochastic sampling procedures commonly used, inverting paraphrased text is challenging. nonetheless, there is evidence that llms exhibit consistent biases even when the instruction implicitly or explicitly requests diversity in the responses @xcite . even if paraphrase inversion is possible, we must know when to apply it, making paraphrase detec-bleu(original, inverse) = 57 our experiments demonstrate that the proposed technique achieves state-of-the-art results in segmenting brain tumors from mri scans, demonstrating its effectiveness and potential impact in clinical applications. we show that the proposed method is able to achieve the best results in separating brain tumours from mr images, thereby demonstrating its effectiveness and its practical application. we demonstrate that our proposed technique achieves state-of-the-art results in segmenting brain tumors from mri scans, highlighting its effectiveness and potential applicability in clinical settings. (1) detecting whether text is a paraphrase, and (2) if so, (2) inverting the paraphrase back to the original text. this pipeline improves the auroc of 7 machine-text detectors across three domains by an average of +22% auroc ( to address these concerns, we propose paraphrase detection and paraphrase inversion as a pipeline to improve the performance of any machine-text detector in scenarios where texts may have been paraphrased (figure 1 ). our main contributions are as follows: ## main results this section present results for our motivating application of defending against paraphrasing attacks for machine-text detection. next, in §6, we perform further analysis of individual components of our approach, including the feasibility of paraphrase inversion as a stand-alone task, considering both inversions of paraphrased machine-generated ( §6.1) and inversions paraphrased human-written documents ( §6.2). ## conclusion summary of findings in this paper, we presented the first detector-agnostic defense against paraphrase attacks. this defense relies on the novel task of paraphrase inversion, where the goal is to recover the original tokens of paraphrased text. furthermore, we proposed two paraphrase detection schemes: one based upon a neural-classifier and another that relies on the number of edits our inversion model makes. when combined with one of the proposed paraphrase detectors, our pipeline improves the results of 7 machine-text detectors across 3 domains by an average of +22% auroc. we attribute the effectiveness of our defense to the stylistic similarity of the inverted paraphrases to the original text, which is sufficient for machine text detectors to accurately classify the inverted text. furthermore, we show that when our defense is trained on one domain, it generalizes to another, suggesting that paraphrasers exhibit consistent biases that can be exploited both for detecting paraphrased text and for learning to invert them.