Counter T uring Test ( CT 2): AI -Generated Text Detection is Not as Easy as You May Think - Introducing AI Detectability Index ( ADI ) (2023)

Abstract: With the rise of prolific ChatGPT, the risk and consequences of AI-generated text has increased alarmingly. This triggered a series of events, including an open letter, signed by thousands of researchers and tech leaders in March 2023, demanding a six-month moratorium on the training of AI systems more sophisticated than GPT-4. To address the inevitable question of ownership attribution for AI-generated artifacts, the US Copyright Office released a statement stating that “if the content is traditional elements of authorship produced by a machine, the work lacks human authorship and the office will not register it for copyright”. Furthermore, both the US and the EU governments have recently drafted their initial proposals regarding the regulatory framework for AI. Given this cynosural spotlight on generative AI, AI-generated text detection (AGTD) has emerged as a topic that has already received immediate attention in research, with some initial methods having been proposed, soon followed by the emergence of techniques to bypass detection. This paper introduces the Counter Turing Test (CT2), a benchmark consisting of techniques aiming to offer a comprehensive evaluation of the robustness of existing AGTD techniques. Our empirical findings unequivocally highlight the fragility of the proposed AGTD methods under scrutiny. Amidst the extensive deliberations on policy-making for regulating AI development, it is of utmost importance to assess the detectability of content generated by LLMs. Thus, to establish a quantifiable spectrum facilitating the evaluation and ranking of LLMs according to their detectability levels, we propose the AI Detectability Index (ADI). We conduct a thorough examination of 15 contemporary LLMs, empirically demonstrating that larger LLMs tend to have a lower ADI, indicating they are less detectable compared to smaller LLMs. We firmly believe that ADI holds significant value as a tool for the wider NLP community, with the potential to serve as a rubric in AI-related policy-making.

## proposed ai-generated text detection techniques (agtd) -a review recently, six methods and their combinations have been proposed for agtd: (i) watermarking, (ii) perplexity estimation, (iii) burstiness estimation, (iv) negative log-likelihood curvature, (v) stylometric variation, and (vi) classifier-based approaches. this paper focuses on critiquing their robustness and presents empirical evidence demonstrating their brittleness. watermarking: watermarking ai-generated text, first proposed by @xcite , entails the incorporation of an imperceptible signal to establish the authorship of a specific text with a high degree of certainty. this approach is analogous to encryption and decryption. @xcite (w v1 ) were the first to present operational watermarking models for llms, but their initial proposal faced criticism. @xcite shared their initial studies suggesting that paraphrasing can efficiently eliminate watermarks. in a subsequent paper @xcite ) (w v2 ), the authors put forth evidently more resilient watermarking techniques, asserting that paraphrasing does not significantly disrupt watermark signals in this iteration of their research. by conducting extensive experiments (detailed in section 3), our study provides a thorough investigation of the dewatermarking techniques w v1 and w v2 , demonstrating that the watermarked texts generated by both methods can be circumvented, albeit with a slight decrease in de-watermarking accuracy observed with w v2 . these results further strengthen our contention that text watermarking is fragile and lacks reliability for real-life applications. ## design choices for ct and adi study this section discusses our selected llms and elaborates on our data generation methods. more details in appendix a. ## reliability of perplexity and burstiness as agtd signals in this section, we extensively investigate the reliability of perplexity and burstiness as agtd signals. based on our empirical findings, it is evident that the text produced by newer llms is nearly indistinguishable from human-written text from a statistical perspective. the hypothesis assumes that ai-generated text displays a higher frequency of clusters or bursts of similar words or phrases within shorter sections of the text. in contrast, humans exhibit a broader variation in their lexical choices, showcasing a more extensive range of vocabulary. moreover, sentence-wise human shows more variety in terms of length, and structure in comparison with aigenerated text. to measure this we have utilized entropy. the entropy p i logp i of a random variable is the average level of surprise, or uncertainty. ## negative log-curvature (nlc) in section 1, we discussed the nlc-based agtd hypothesis @xcite . our experimental results, depicted in fig. 1 , demonstrate that we are unable to corroborate the same nlc pattern for gpt4. to ensure the reliability of our experiments, we performed 20 perturbations per sentence. fig. 1 (bottom) presents a comparative analysis of 20 perturbation patterns observed in 2000 samples of optgenerated text and human-written text on the same topic. regrettably, we do not see any discernible pattern. to fortify our conclusions, we compute the standard deviation, mean, and entropy, and conduct a statistical validity test using bootstrapping, which is more appropriate for non-gaussian distributions @xcite . the purpose of authorship attribution. our investigation, which differs from the study conducted by @xcite , represents the first attempt to explore the stylometric variations between humanwritten text and ai-generated text. specifically, we assign 15 llms as distinct authors, whereas text composed by humans is presumed to originate from a hypothetical 16 th author. our task involves identifying stylometric variations among these 16 authors. after examining other alternatives put forth in previous studies such as @xcite , we encountered difficulties in drawing meaningful conclusions regarding the suitability of these methods for agtd. therefore, we focus our investigations on a specific approach that involves using perplexity (as a syntactic feature) and burstiness (as a lexical choice feature) as density functions to identify a specific llm. by examining the range of values produced by these functions, we aim to pinpoint a specific llm associated with a given text. probability density such as l plx our experiment yielded intriguing results. given that our stylometric analysis is solely based on density functions, we posed the question: what would happen if we learned the search density for one llm and applied it to another llm? to explore this, we generated a relational matrix, as depicted in fig. 7 . as previously described and illustrated in fig. 5 , the llms can be classified into three groups: (i) easily detectable, (ii) hard to detect, and (iii) not detectable. fig. 7 demonstrates that le cam's lemma learned for one llm is only applicable to other llms within the same group. for instance, the lemma learned from gpt 4 can be successfully applied to gpt-3.5, opt, and gpt-3, but not beyond that. similarly, vicuna, stablelm, and llama form the second group. fig. 4 offers a visual summary. ## ai detectability index (adi) as new llms continue to emerge at an accelerated pace, the usability of prevailing agtd techniques might not endure indefinitely. to align with the ever-changing landscape of llms, we introduce the ai detectability index (adi), which identifies the discernable range for llms based on sota agtd techniques. the hypothesis behind this proposal is that both llms and agtd techniques' sota benchmarks can be regularly updated to adapt to the evolving landscape. additionally, adi serves as a litmus test to gauge whether contemporary llms have surpassed the adi benchmark and are thereby rendering themselves impervious to detection, or whether new methods for ai-generated text detection will require the adi standard to be reset and re-calibrated. among the various paradigms of agtd, we select perplexity and burstiness as the foundation for quantifying the adi. we contend that nlc is a derivative function of basic perplexity and burstiness, and if there are distinguishable patterns in nlc within ai-generated text, they should be well captured by perplexity and burstiness. we present a summary in fig. 4 that illustrates the detectable and non-detectable sets of llms based on adi scores obtained using stylometry and classification methods. it is evident that the detectable llm set is relatively small for both paradigms, while the combination of perplexity and burstiness consistently provides a stable adi spectrum. furthermore, we argue that both stylistic features and classification are also derived functions of basic per- when confronted with a random input text, it is difficult to predict its resemblance to humanwritten text on the specific subject. therefore, to calculate adi we employ the mean perplexity (µ plx h ) and burstiness (µ brsty h ) derived from human-written text. furthermore, to enhance the comparison between the current text and human text, le cam's lemma has been applied using precalculated values (l plx h and l brsty h ) as discussed in section 6. to assess the overall contrast a summation has been used over all the 100k data points as depicted here by u. lastly, comparative measures are needed to rank llms based on their detectability. this is achieved using multiplicative damping factors, δ 1 (x) and δ 2 (x), which are calculated based on µ ± rank x × σ . initially, we calculate the adi for all 15 llms, considering δ 1 (x) and δ 2 (x) as 0.5. with these initial adis, we obtain the mean (µ) and standard deviation (σ ), allowing us to recalculate the adis for all the llms. the resulting adis are then ranked and scaled providing a comparative spectrum as presented in fig. 4 . this scaling process is similar to z-score normalization and/or min-max normalization @xcite . however, having damping factors is an easier option for exponential smoothing while we have a handful of data points. finally, for better human readability adi is scaled between 0 -100. from the methods we considered, it is unlikely that any of them would be effective for models with high adi, as shown by our experiments and results. as llms get more advanced, we assume that the current agtd methods would become even more unreliable. with that in mind, adi will remain a spectrum to judge which llm is detectable and vs. which is not. please refer to appendix f for more discussion. the adi spectrum reveals the presence of three distinct groups. t0 and t5 are situated within the realm of detectable range, while xlnet, stablelm, dolly, and vicuna reside within the difficult-to-detect range. the remaining llms are deemed virtually impervious to detection through the utilization of prevailing sota agtd techniques. it is conceivable that forthcoming advancements may lead to improved agtd techniques and/or llms imbued with heightened human-like attributes that render them impossible to detect. regardless of the unfolding future, adi shall persist in serving the broader ai community and contribute to ai-related policy-making by identifying non-detectable llms that necessitate monitoring through policy control measures. ## conclusion our proposition is that sota agtd techniques exhibit fragility. we provide empirical evidence to substantiate this argument by conducting experiments on 15 different llms. we proposed ai detectability index (adi), a quantifiable spectrum facilitating the evaluation and ranking of llms according to their detectability levels. the excitement and success of llms have resulted in their extensive proliferation, and this trend is anticipated to persist regardless of the future course they take. in light of this, the ct 2 benchmark and the adi will continue to play a vital role in catering to the scientific community.