PaperlayerView exact revision on arXiv

Source-linked AI summary

Ghostbuster: Detecting Text Ghostwritten by Large Language Models

Vivek Verma, Eve Fleisig, Nicholas Tomlin, Dan Klein

arXiv:2305.15047v3cs.CLcs.AI

TL;DR

AI-generated text detectors must remain reliable across domains and models while avoiding false positives. Ghostbuster combines weaker-model token probabilities through structured search and linear classification, achieving strong performance across multiple datasets and evaluating generalization and robustness. Its reliability is limited for distribution shifts, short or edited text, and underrepresented language varieties.

  • Problem

    Existing detectors can generalize poorly across datasets and disproportionately misclassify non-native English writing, motivating stronger generalization performance.

  • Method

    Ghostbuster passes documents through weaker language models, searches combinations of their probability features, and trains a linear classifier on selected features.

  • Results

    Ghostbuster achieved over 98.4 F1 across all three datasets on in-domain detection, outperforming available models.

  • Takeaways & Limitations

    Ghostbuster provides benchmarks across news, student essays, and creative writing while testing generalization across models, prompts, and domains.

  • Takeaways & Limitations

    Incorrect predictions may be particularly likely for short or edited text, distributionally distant domains, non-English or nonstandard-English text, and non-native English writing.

Abstract

from arXiv · show

We introduce Ghostbuster, a state-of-the-art system for detecting AI-generated text. Our method works by passing documents through a series of weaker language models, running a structured search over possible combinations of their features, and then training a classifier on the selected features to predict whether documents are AI-generated. Crucially, Ghostbuster does not require access to token probabilities from the target model, making it useful for detecting text generated by black-box models or unknown model versions. In conjunction with our model, we release three new datasets of human- and AI-generated text as detection benchmarks in the domains of student essays, creative writing, and news articles. We compare Ghostbuster to a variety of existing detectors, including DetectGPT and GPTZero, as well as a new RoBERTa baseline. Ghostbuster achieves 99.0 F1 when evaluated across domains, which is 5.9 F1 higher than the best preexisting model. It also outperforms all previous approaches in generalization across writing domains (+7.5 F1), prompting strategies (+2.1 F1), and language models (+4.4 F1). We also analyze the robustness of our system to a variety of perturbations and paraphrasing attacks and evaluate its performance on documents written by non-native English speakers.

1 Introduction

AI-generated text detectors are needed because language models produce fluent text that can undermine trust, while existing systems generalize poorly and can unfairly flag genuine writing. Ghostbuster addresses this need with structured search over weaker-model probabilities and linear classification.

  • Language models generate fluent text across domains, raising authenticity and trust concerns for school assignments, news, and other informative writing.Their factual errors and hallucinations further increase readers’ interest in identifying machine-generated text.
  • Existing detectors can falter on new datasets and produce false positives, including disproportionate misclassification of non-native English writing.These failures motivate detectors with stronger generalization performance.
  • 99.0 F1: Ghostbuster outperformed DetectGPT and GPTZero by an average margin of 23.7 F1 on in-domain classification.The system was evaluated across three datasets and also tested for generalization, robustness, and ablations.
  • Ghostbuster passes documents through weaker language models, searches combinations of their outputs, and trains a linear classifier on selected features.Figure 1 summarizes this training procedure.

2 Related Work

Prior work detects AI-generated text through statistical signals, watermarking, and perturbation-based methods, but these approaches face brittleness and deployment constraints. Paraphrasing attacks and unfair errors for non-native English writers remain important concerns.

  • AI-generated text differs from human writing through statistical and qualitative patterns, including type-token behavior, formality, focus, conjunction use, factuality, and repetition.Several properties can remain subtle or vary with model size and decoding strategy.
  • Watermarking can provide detection guarantees, but it requires developers to incorporate watermarks into generation models.
  • DetectGPT detects generated text using probability changes after perturbing text, while GLTR provides statistical visualizations to assist human detection.
  • Many existing detectors are brittle to paraphrasing attacks, and this paper focuses primarily on documents generated wholesale rather than adversarially edited text.Adversarial prompting and paraphrasing attacks are left for future work.
  • Commercial detectors have disproportionately misclassified essays by non-native English speakers as AI-generated.

3 Datasets

The paper introduces three human–AI text datasets spanning creative writing, news, and student essays. AI documents were paired with human texts using shared or reconstructed prompts, then divided into standard evaluation splits.

  • Three benchmark domains are covered: creative writing, news, and student essays, with ChatGPT-generated counterparts for human-authored documents.Training data used gpt-3.5-turbo-generated text.
  • The creative-writing dataset uses prompts and stories from r/WritingPrompts, drawing posts from top posters collected in October 2022.The scraped prompts were used to generate ChatGPT-written stories.
  • The news dataset is based on 5,000 Reuters articles by 50 journalists, with ChatGPT first generating headlines and then articles because original prompts were unavailable.
  • The student-essay dataset uses high-school and university essays from IvyPanda, with ChatGPT reconstructing prompts before generating corresponding essays.
  • Datasets were split into training, validation, and test sets, and human reviewers labeled subsets to check task difficulty and major artifacts.

4 Model

Ghostbuster converts documents into weaker-model probability features, searches a structured space of interpretable combinations, and trains a regularized classifier on selected and handcrafted features. The design targets generalization without a fully neural architecture.

  • The approach adds model capacity through structured operations while avoiding a fully neural architecture that is more likely to overfit.
  • Ghostbuster uses three stages: token-probability computation, structured feature selection, and classifier training.The final classifier combines selected probability-based features with manually selected features.
  • Token probabilities come from a unigram model, a Kneser–Ney trigram model, and untuned GPT-3 ada and davinci models.All component models are weaker than the target model.
  • 4.2 Feature Selection: Structured search combines probability vectors with vector and scalar operations, using maximum depth 3 and forward feature selection to produce interpretable scalar features.An example feature compares unigram, ada, and davinci probabilities before applying variance.
  • 4.3 Classifier Training: The classifier combines structured-search features with seven handcrafted features based on word length and largest token probabilities.These heuristics are intended to capture qualitative patterns in AI-generated text.

5 Baselines

Ghostbuster is compared with unsupervised and supervised detectors, with human evaluation used to assess task difficulty.

  • 5 Baselines: Ghostbuster is evaluated against DetectGPT, a perturbation-based unsupervised detector, and a supervised RoBERTa model.The study also includes human evaluation to validate the difficulty of distinguishing human-authored from AI-generated documents.
  • 5 Baselines: Table 2 compares F1 across in-domain and held-out-domain settings for news, creative writing, student essays, and all domains.Out-of-domain results train on two domains and evaluate on the third, providing the fairest comparison with unsupervised methods.
  • 5 Baselines: 59% average human accuracy, with participant accuracy averaging 58.1 ± 11.1%, indicates that the detection task is difficult for humans.The first evaluation involved six students labeling 50 documents; a larger interface-based evaluation included 233 participants.

6 Results

Ghostbuster maintains strong performance across domains, prompting strategies, and target models, though generalization to an unseen model remains more difficult.

  • 6.1 In-domain Classification: 99.0 F1 across all three datasets outperforms GPTZero by 5.9 F1 and DetectGPT by 41.6 F1 in-domain.RoBERTa reaches 98.1 F1 in-domain but performs inconsistently in generalization experiments.
  • 6.2 Generalization Across Domains: 97.0 F1 out-of-domain exceeds DetectGPT by 39.6 F1 and GPTZero by 7.5 F1, while surpassing RoBERTa on every domain except creative writing.RoBERTa’s average out-of-domain performance is 13.8 F1 lower, and one non-native-English dataset showed a performance drop potentially related to shorter documents.
  • 6.3 Generalization Across Prompts: 99.5 F1 across prompt variants exceeds RoBERTa’s 97.4 F1 and GPTZero’s 96.1 F1.The prompt variants include natural variation and requests for styles intended to avoid detection.
  • 6.4 Generalization Across Models: 92.2 F1 on Claude-generated essays remains highest among tested approaches but reflects a 6.8 F1 decrease from Ghostbuster’s other performance.Generalization to a different target model without training on its data remains more challenging.

7 Analysis

Ghostbuster’s analysis shows that structured search and neural-language-model probabilities are central to performance, while robustness depends on document length and perturbation type.

  • 7.2 Robustness: Most global edits did not significantly affect performance, whereas numerous local character- and word-level edits were required to fool Ghostbuster.The robustness experiments covered both local and global perturbations.
  • 7.1 Ablations: Search depth below 3 tended to underfit, while depths above 3 plateaued or degraded, making depth 3 the effective setting.This result was reported in the structured-search ablation.
  • 7.1 Ablations: 27.8 F1: removing ada and davinci probabilities reduced out-of-domain performance by up to 27.8 F1, underscoring their importance for generalization.The corresponding in-domain decrease reached 10.8 F1.
  • 7.2 Robustness: The detector was fooled less than half the time by Undetectable AI, despite paraphrasing attacks potentially causing more misclassifications than random perturbations.The paraphrasing experiment used a commercial detection-evader service.
  • 7.3 Non-Native English Speaker Data: 74.7 F1: Ghostbuster’s score on the 91 TOEFL essays was comparable to out-of-domain performance on similarly short documents.The 91 essays had a median length of 104 words, while the Lang8 median was 77 words and also showed a performance drop.
  • 7.2 Document Length: Performance degraded substantially on documents with ≤100 tokens and improved with length, affecting both in-domain and out-of-domain evaluation.Performance levels off with ≥500 tokens.

8 Conclusion

The conclusion presents Ghostbuster as a structured-search detector evaluated across domains, models, and prompts, alongside three released detection benchmarks. It reports strong in-domain performance while identifying robustness, scope, and calibration issues for future work.

  • 8 Conclusion: Ghostbuster achieved over 98.4 F1 across all three in-domain datasets, representing substantial progress over available models.The datasets cover news, student essays, and creative writing.
  • 8 Conclusion: The system uses structured search over weaker-model token probabilities to detect AI-generated documents and was validated across domains, models, and prompting strategies.The paper also releases the three datasets as detection benchmarks.
  • 8 Conclusion: Future work should address false-positive versus false-negative tradeoffs, robustness to edits, paragraph-level detection, and explanations for classification decisions.The conclusion frames these as application- and task-dependent research directions.

9 Ethics and Limitations

The paper cautions that Ghostbuster’s training data cover limited writing distributions and that errors may increase under substantial shifts in length, domain, language variety, authorship, or editing.

  • 9 Ethics and Limitations: Ghostbuster’s datasets are not representative of all writing styles or topics and predominantly contain British and American English.The authors identify distributional shift as a source of potentially incorrect predictions.
  • 9 Ethics and Limitations: Incorrect predictions may be particularly likely for short text, unfamiliar domains, non-American or non-British English, non-English text, non-native speakers, and edited or paraphrased AI text.The paper lists these as practical boundaries for real-world use.
  • 9 Ethics and Limitations: The authors discourage automatically penalizing students or other writers based on Ghostbuster predictions without human supervision.They recommend cautious use with additional factors when classification could harm a person.
  • 9 Ethics and Limitations: The datasets use generated documents matched approximately to human-document length, with news and creative-writing documents generated from prompted headlines or writing prompts.These construction choices define the evaluation setting rather than all possible writing conditions.

C Additional Implementation Details

The implementation details describe brute-force feature generation with pruning, handcrafted probability- and length-based features, and dataset-specific validation of selected features.

  • C Additional Implementation Details: The feature algorithm enumerates combinations of vector functions up to a maximum depth, then applies scalar functions to produce candidate features.It prunes features that apply the same function twice.
  • C Additional Implementation Details: Unigram and trigram models use the GPT-3 tokenizer vocabulary, with Brown Corpus counts for training and Kneser-Ney discount δ = 0.9.The models are configured to produce vectors of identical length.
  • C Additional Implementation Details: Pruning commutative combinations reduced the feature space by about two-thirds, leaving 2534 features at depth 3 and 322 at depth 2.The optimization avoids double-counting equivalent vector combinations.
  • C Additional Implementation Details: Ghostbuster adds handcrafted features based on token-probability outliers, differences between davinci and ada probabilities, and word lengths.These features supplement those selected through structured search.
  • C Additional Implementation Details: The best features were selected through validation separately for each dataset.The selected-feature sets are presented in Figure 5.

F Additional Benchmarks

The paper introduces benchmarks that vary the framing and difficulty of AI-text detection, including author, document, and paragraph-level tasks. These benchmarks target practical settings such as student assignments and support evaluation on human-only and generated datasets.

  • Evaluation Datasets: Table 5 organizes each domain around 5,000 ChatGPT-generated documents, including same-prompt training data and 4,000-document generalization sets.Human-authored documents and same-prompt ChatGPT documents are split for Ghostbuster training, validation, and testing.
  • Evaluation Datasets: The paper also evaluates non-native English datasets using only the original human-authored data, without generating parallel AI text.This isolates performance on human text from these datasets rather than creating matched generated examples.
  • Benchmark Tasks: Three benchmark framings test author identification, document-level detection, and paragraph-level localization of AI-generated text.The tasks increase in difficulty from using an author’s writing history to identifying generated paragraphs within a document.
  • Practical Motivation: The benchmark settings reflect practical cases where instructors may have author histories, no writing history, or only partial AI assistance to assess.These correspond respectively to author identification, document-level detection, and paragraph-level detection.

G Qualitative Analysis of Trends in Token Probabilities

The qualitative analysis examines how token-probability trends differ between human and ChatGPT documents across writing domains. It finds similar overall entropy-rate trajectories but a growing late-document predictability gap that Ghostbuster can exploit.

  • Measurement: At token position i, entropy rate is computed as the average log conditional probability assigned by GPT-3 to the ith token across documents.The paper uses “entropy rate” for this trend while noting that the definition differs from the classic information-theoretic meaning.
  • Entropy-Rate Trends: Both human and ChatGPT documents show a sharp entropy-rate decline at the beginning, followed by a plateau or gradual decline toward the end.This pattern is reported across the analyzed documents and is consistent with the trend described in prior work.
  • Feature Selection: The selected feature sets differ by domain and outperform randomly chosen features and manually selected features alone.Figure 5 lists the forward-selected features, while Table 4 is cited as establishing the performance advantage.
  • Entropy-Rate Trends: ChatGPT documents are more predictable than human documents, with the difference becoming more pronounced toward the ends of documents.Figure 6 examines Writing Prompts, Reuters, and IvyPanda under GPT-3 Ada and Davinci.
Loading 2305.15047v3…