Masks and Mimicry: Strategic Obfuscation and Impersonation Attacks on Authorship Verification (2025)

Abstract: The increasing use of Artificial Intelligence(AI) technologies, such as Large LanguageModels (LLMs) has led to nontrivial improvementsin various tasks, including accurate authorshipidentification of documents. However,while LLMs improve such defense techniques,they also simultaneously provide a vehicle formalicious actors to launch new attack vectors.To combat this security risk, we evaluate theadversarial robustness of authorship models(specifically an authorship verification model)to potent LLM-based attacks. These attacksinclude untargeted methods - authorship obfuscationand targeted methods - authorshipimpersonation. For both attacks, the objectiveis to mask or mimic the writing style of an authorwhile preserving the original texts’ semantics,respectively. Thus, we perturb an accurateauthorship verification model, and achievemaximum attack success rates of 92% and 78%for both obfuscation and impersonation attacks,respectively.

## introduction recent advances in large language models (llms) have led to the generation of texts, that are almost indistinguishable from human-written texts. consequently, llms, while impressive, have exacerbated the problem of influence operations within our information ecosystem @xcite . this is because malicious actors can now generate their content at scale with little cost. we define influence operations as any form of attack (typically the spread of propaganda) that pollutes our information space with the ultimate goal of infringing upon a democracy. unsurprisingly, such covert attacks thrive in sensitive events such as elections, wars, pandemics, and periods of civil unrest @xcite . therefore to combat this obvious security risk, a computational solution is adopted -authorship analysis, which is an (automatic) approach to finding the author of a document @xcite . these authorship analysis tasks, include authorship attribution, authorship verification, forensic analysis, author profiling, etc. @xcite . while all these tasks have specific advantages and uses, we are interested in authorship verification (av) models, which answer the question: given two texts, can you predict if they are written by the same author or not? texts written by the same author are known as true trials, while texts written by different authors are false trials. using such av models, one can combat influence operations, by verifying if two randomly selected texts are written by the same author or not. this defense technique has been successfully proposed by several researchers @xcite , and we find that deep learning-based models tend to perform the best. however, we know that it is not enough to build an accurate av model, we must evaluate these mod-els under harsher constraints, such as realistic adversarial perturbations, specifically authorship obfuscation and authorship impersonation. authorship obfuscation is a type of untargeted adversarial attack, with a stronger constraint which is preserving semantics, while masking the true authorship of a document @xcite . authorship impersonation is a form of targeted adversarial attack, where a target author emulates the writing style of a source author, while preserving the semantics of the original texts. adversarial attacks in the context of machine learning are perturbations introduced to the model to cause the model to misclassify @xcite . the goal of these attacks is to perform pre-defined perturbations to achieve misclassification. see figure 1 for illustration of the authorship obfuscation and authorship impersonation problems. thus, we summarize this study into answering two research questions (rqs): rq1: can we adversarially perturb an av model using semantic preserving untargeted attacks, known as authorship obfuscation? rq2: can we adversarially perturb an av model using semantic preserving targeted attacks, known as authorship impersonation? to answer these rqs, we evaluate the adversarial robustness on a high-performing av model -bigbird @xcite , that outperformed strong baselines such as electra @xcite , longformer @xcite , and roberta (i.e., distilroberta) @xcite . next, we implement several adversarial attacksobfuscation and impersonation attacks by using open-source language models to simulate a more realistic scenario of how potential malicious actors will attack av models in this age of llms. this yields three language models for the obfuscation attacks -paraphrasers like mistral foot_0 @xcite , dipper @xcite , and pega-sus @xcite ; and three specialized impersonation attack techniques -custom-tuned mistral, langchain + rag foot_1 , and strap (gpt-2) @xcite . after probing the av model with several realistic adversarial attacks, we find these attacks have a high success rate. the obfuscation attacks achieved a maximum attack success rate of 83% and 92% for the two datasets; however, for the impersonation we achieved a maximum attack success rate of 78% when impersonating an author in the fanfiction dataset. ## methodology we evaluate the robustness of @xcite , a generalizable authorship verification (av) model which outperforms other state-ofthe-art models, such as electra @xcite , longformer @xcite , and roberta (i.e., distilroberta) @xcite . ## authorship obfuscation results we evaluate the robustness of bigbird @xcite to realistic obfuscation attacks in the age of llms. by using paraphrasers such as dip-per, pegasus, and mistral, we find that dipper and mistral preserve the semantics of the original text, as well as cause the av model to misclassify at a high rate. to evaluate the performance of these attacks, we use the metrics discussed in section 4.3. furthermore, in order to investigate the generalizability of our attacks, we test the model performance on two datasets of different domainsfanfiction, and celebrity twitter (now known as x) posts. the results for the fanfiction and celebtwitter datasets are in tables 2 and 3 , respectively. for the fanfiction dataset, we observe that our method -m istral zeroshot achieved the highest asr, outperforming the second best obfuscator -dipper by 3%. however, dipper was able to achieve highest semantic consistency scores on all three metrics, suggesting that it was able to generate obfuscated texts that more closely resemble the original, semantically. dipper's superior performance, compared to the other baseline -pegasus (which underperformed significantly) and mistral prompts -m istral vanilla , m istral stepback , and m istral ap is because dipper is the only model that was trained with the objective of paraphrasing, while pegasus was trained for abstractive summarization. next, for the other mistral prompts, only m istral vanilla achieved a low asr -23%, however, was still able to preserve the semantics decently. the other prompts performed well, achieving nontrivial asr of 50% and 57% for m istral stepback , and m istral ap , respectively. however, we observe more exaggerated performances by mistral on the celebtwitter dataset in ## authorship impersonation results the goal of authorship impersonation is to modify the writing style of an author such that the original author of a document is detected as a particular target author. in obfuscation, we are going from ## discussion our results highlights the vulnerabilities of av models when subjected to adversarial attacks through authorship obfuscation and authorship impersonation techniques using llms. see examples of perturbed texts using these methods in tables 7 and 8 for the obfuscation and impersonation techniques, respectively. while prior studies have demonstrated the effectiveness of deep learning-based av models @xcite @xcite in distinguishing between different authors, our results reveal significant weaknesses in these models when they encounter realistic, semantic, and context-preserving adversarial perturbations. traditional methods like homoglyph substitution @xcite , backtranslation @xcite ., method obfuscated texts original as harry potter bravely confronts the dark lord in there ultimate battle at hogwarts, a blinding burst of light engulfs voldemort and his death eaters, making them vanish. dipper harry potter confronts the dark lord in the final battle at hogwarts. blinding light consumes voldemort and his death eaters and they vanish. pegasus as harry potter bravely confronted the dark lord in the ultimate battle at hogwarts, a blinding burst of light made them disappear. m istral_vanilla in the climactic showdown at hogwarts, harry fearlessly faces off against the dark lord and his minions. suddenly, a brilliant flash of light descends upon them, causing them to evaporate. m istral_zeroshot harry potter bravely faces the dark lord in their ultimate hogwarts fight, causing the enemy's demise. m istral_stepback harry potter fearlessly faces the dark lord in their dramatic confrontation at hogwarts, a brilliant flash erupts, engulfing voldemort and his death eaters and causing them to disappear without a trace. m istral_ap with unwavering courage, harry potter took on the dark lord in their final showdown at hogwarts. suddenly, a brilliant flash of light enveloped voldemort and his death eaters, erasing them from existence. in parallel, the authorship impersonation task, which represents a more challenging targeted attack, seeks to manipulate text to mimic the style of a target author while preserving the original semantics. our rag pipeline successfully transfers stylistic elements from a target author to source author. this multi-step rag process first retrieves the stylistic properties from a target author's previous writings through chain-of-thought prompting to refine these stylistic transformations while maintaining the original meaning. our evaluation demonstrates that llm-driven impersonation can deceive even the most robust av models, achieving high success rates in flipping false trials to true trials. this effectively makes a target author's writing indistinguishable from that of a source author. such vulnerabilities raise serious security concerns in areas like academic authorship, forensic linguistics, and online misinformation detection. lastly, we observe the strength of the obfuscation and impersonation attacks on the fanfiction datasets by plotting a det curve' using the misclassification rate as a function of false alarm rate on a normal log scale. see figure 6 . each line summarizes the performance of a system across a range of thresholds for a given test set. the closer these lines are to the lower-left corner, the better the system's performance. thus, we observe that dip-per & m istral_zeroshot for obfuscation and mistral & mixtral for impersonation are able to push the verification scores farther away from the unperturbed texts scores, such that the av model misclassifies at a high rate, achieving a successful attack. ## conclusion we evaluated the adversarial robustness of a highperforming av model -bigbird @xcite on adversarial attacks such as obfuscation (untargeted) and impersonation (targeted) attacks. for the obfuscation attack, we perturbed the first pair of accurately predicted true trials (i.e., sameauthor documents). therefore, a successful obfuscation attack, flips a true trial label to false trial. we achieved high attack success rates with dip-per, a paraphraser llm and various prompts used to guide mistral. next, for the impersonation attack, we aim to perturb the first pair of accurately predicted false trials (i.e., not-the-same author), such that the label is flipped to true trial. finally, our results expose an alarming security risk which author identification models such as av models have. we are especially alarmed by the results of the impersonation attacks, as these are realistic scenarios in which malicious actors can use to launch devastating security attacks.