Source-linked AI summary
DNA-GPT: Divergent N-Gram Analysis for Training-Free Detection of GPT-Generated Text
Xianjun Yang, Wei Cheng, Yue Wu, Linda Petzold, William Yang Wang, Haifeng Chen
TL;DR
Detecting increasingly capable LLM text is difficult, especially when detectors lack adaptability, token probabilities, or explanatory evidence. DNA-GPT addresses this with training-free continuation analysis in black-box and white-box settings. Across the reported evaluations, it outperforms supervised baselines while providing evidence and robustness under revised text.
Problem
Rapidly improving LLMs make generated-text detection difficult, while existing methods can lack flexibility, access to token probabilities, and explanatory evidence.
Method
DNA-GPT truncates a passage, regenerates continuations from its prefix, and compares the original and regenerated remainders using n-gram or probability-based analysis.
Results
DNA-GPT consistently outperforms GPTZero and OpenAI’s classifier across reported evaluation settings and provides explainable evidence for its decisions.
Takeaways & Limitations
The method supports zero-shot detection in black-box and white-box settings, with reported robustness to revised text and capability for model sourcing.
Takeaways & Limitations
Evaluation is limited to decoder-only-like models and texts between 1000 and 2000 characters, and misclassification remains possible.
Abstract
from arXiv · showhide
Large language models (LLMs) have notably enhanced the fluency and diversity of machine-generated text. However, this progress also presents a significant challenge in detecting the origin of a given text, and current research on detection methods lags behind the rapid evolution of LLMs. Conventional training-based methods have limitations in flexibility, particularly when adapting to new domains, and they often lack explanatory power. To address this gap, we propose a novel training-free detection strategy called Divergent N-Gram Analysis (DNA-GPT). Given a text, we first truncate it in the middle and then use only the preceding portion as input to the LLMs to regenerate the new remaining parts. By analyzing the differences between the original and new remaining parts through N-gram analysis in black-box or probability divergence in white-box, we unveil significant discrepancies between the distribution of machine-generated text and the distribution of human-written text. We conducted extensive experiments on the most advanced LLMs from OpenAI, including text-davinci-003, GPT-3.5-turbo, and GPT-4, as well as open-source models such as GPT-NeoX-20B and LLaMa-13B. Results show that our zero-shot approach exhibits state-of-the-art performance in distinguishing between human and GPT-generated text on four English and one German dataset, outperforming OpenAI's own classifier, which is trained on millions of text. Additionally, our methods provide reasonable explanations and evidence to support our claim, which is a unique feature of explainable detection. Our method is also robust under the revised text attack and can additionally solve model sourcing. Codes are available at https://github.com/Xianjun-Yang/DNA-GPT.
1 INTRODUCTION
The paper addresses the growing difficulty of detecting high-quality LLM text and the need for practical, explainable, robust detection. DNA-GPT uses differences in continuation distributions to support zero-shot detection in black-box and white-box settings.
- AI-generated text detection is lagging behind rapidly advancing LLMs and remains difficult as generated text quality improves.
- Existing detectors may lack flexibility across domains, fail without token probabilities, or provide predictions without supporting evidence.
- DNA-GPT develops zero-shot detection algorithms for both black-box and white-box settings from the observed machine–human distribution difference.
- LLMs tend to generate similar continuations from the same preceding text, whereas human-written continuations follow a more diverse distribution.
- The method reports superior performance against learning-based baselines, including non-English robustness, revised-text robustness, and model sourcing.
2 RELATED WORK
Prior work includes feature-based, supervised, and training-free detectors, but evolving LLMs create adaptation and access challenges. DNA-GPT instead exploits differences in continuation patterns and provides detection evidence.
- Earlier detectors used rare-bigram, n-gram-frequency, or top-k-word features to identify machine-generated text.
- Training-based detectors require periodic retraining to keep pace with new LLM updates.
- DetectGPT represents a training-free approach based on the observation that machine-generated passages occupy regions with negative log-probability curvature.
- DNA-GPT identifies GPT-generated text through continuation-pattern differences and supplies evidence beyond a classifier-only prediction.
3 METHODOLOGY
DNA-GPT truncates a passage, regenerates its remainder from the prefix, and compares regenerated outputs with the original remainder. It supports black-box n-gram similarity and white-box probability-based scoring.
- The task is binary classification of whether a sequence comes from a known machine distribution or a human distribution.
- The method splits a sequence into prefix X and remainder Y0, then samples K continuations from the language model conditioned only on X.
- The likelihood-gap hypothesis states that machine-generated remainders have higher conditional log-likelihood than human-generated remainders.
- The classifier converts similarity into a score and applies a threshold that balances false-positive and true-positive rates.
- Black-box detection compares n-gram overlap between regenerated outputs and Y0, while white-box detection uses available model probabilities.
- Overlapped n-grams serve as interpretable evidence, although even substantial evidence can still accompany misclassification.
4 EXPERIMENTS
The experiments evaluate DNA-GPT across multiple datasets, models, metrics, baselines, and prompt-availability scenarios. The design also considers model-access differences and practical detection conditions.
- Datasets: The study uses newly collected Reddit-ELI5 and Nature scientific-abstract datasets to reduce concerns about language-model memorization.
- Models and algorithms: Experiments include text-davinci-003, gpt-3.5-turbo, GPT-4, and open-source models with differing access to token probabilities.
- Metrics: The evaluation considers AUROC and TPR because AUROC values near 1.0 may not fully capture differences in user experience.
- Baselines: DNA-GPT is compared with GPTZero and OpenAI’s classifier as supervised training-based baselines.
- Detection scenarios: The experiments evaluate both known-prompt and unknown-prompt detection scenarios, reflecting different practical settings.
5 RESULTS AND ANALYSIS
DNA-GPT consistently outperforms supervised baselines across settings and datasets, while remaining robust to model changes, decoding variation, text revision, and non-English evaluation. Its experiments also examine practical choices such as truncation ratio and regeneration count, and extend detection to explainability and model sourcing.
- Overall Results: DNA-GPT consistently achieves higher AUROC and TPR than GPTZero and OpenAI’s Classifier across the evaluated methods and datasets.Table 1 reports TPR at 1% FPR; black-box performance can improve with a golden question prompt, although the best result sometimes occurs without one.
- Truncation Ratio: A truncation ratio of 0.5 consistently yields the most favorable detection performance across the tested datasets and models.Performance first rises and then declines as the ratio varies, with very short prompts allowing greater generation diversity and near-complete prompts constraining generation.
- Number of Re-generations: Using 10 black-box or 5 white-box re-generations reaches AUROC saturation, while TPR improves until approximately five re-generations.The authors therefore regard 5–10 re-generations as a reasonable cost-performance range.
- Decoding Temperature: DNA-GPT remains competitive as decoding temperature changes, although its AUROC and especially TPR decrease at higher temperatures.GPTZero and OpenAI’s classifier show a significant performance drop and are described as highly sensitive to decoding temperature.
- Revised Text: Under heavy revision, DNA-GPT maintains stable detection and its AUROC decreases only from 99.09 to 98.48 when approximately half the text is revised.GPTZero and OpenAI’s classifier deteriorate dramatically when the revision ratio exceeds 0.3.
- Explainability and Extensions: DNA-GPT provides N-gram evidence, outperforms baselines on open-source models, and supports model sourcing beyond human-versus-machine classification.The method is evaluated on GPT-NeoX-20B and LLaMa-13B, while model sourcing ranks candidate models using the same truncation-then-regeneration pipeline.
6 CONCLUSION
The authors argue that DNA-GPT addresses weaknesses of existing detectors by remaining effective across settings and domains while providing interpretable evidence.
- Training-based classifiers may fail under revision attacks and perform poorly on non-English text.
- DNA-GPT is a zero-shot detector designed to overcome adaptation and explanation drawbacks in both black-box and white-box scenarios.
- DNA-GPT provides explainable evidence alongside detection decisions across various domains.
ETHICS STATEMENT
The paper limits its claims to decoder-only language models and texts in a moderate tested length range, while acknowledging that detection errors may still occur.
- The evaluation covers language models resembling the GPT decoder-only architecture, not non-decoder-only models.
- The method was tested on texts between 1000-2000 characters, so substantially shorter or longer texts may be inaccurate.
- The authors acknowledge that the detector might still make mistakes and advise users to exercise caution.
A THEORETICAL ANALYSIS
The theoretical analysis attributes detectability to a likelihood gap between machine and human continuation distributions. DNA-GPT estimates this difference by re-prompting continuations and measuring their distances under stated concentration assumptions.
- The analysis uses Le Cam’s lemma to relate detection error to total variation distance between machine and human text distributions.
- A Likelihood-Gap Hypothesis posits that machine generation has expected log-likelihood exceeding human generation by a positive gap Δ.
- The black-box method can use n-gram distance, while the white-box method can use relative entropy as the distance function.
- DNA-GPT re-prompts the preceding text to generate continuations and measures their closeness to the observed remaining text.
- Under sub-Gaussian distance assumptions, the estimator achieves n^-1/2 consistency through concentration arguments.
- The theory predicts a gap between human and machine DNA distances, supporting discrimination when the distributions differ sufficiently.
B.2.1 ON THE DATASETS FOR DETECTION
The section examines dataset suitability for AI-text detection, emphasizing memorization, prompt availability, and evaluation conditions. It reports challenges on WikiText-103 and discusses alternative datasets and detection settings.
- Dataset limitations: WikiText-103 is problematic for detection because models may reproduce memorized training text verbatim.The authors report that text-davinci-003 produced identical continuous tokens spanning three sentences in 13 of 100 sampled validation examples.
- Dataset limitations: 13 of 100 sampled WikiText-103 examples from text-davinci-003 contained identical continuous tokens spanning three sentences.
- Dataset criteria: The authors recommend datasets with moderate length, recent collection dates, and limited prior use in training current LLMs.They state that short texts are harder to differentiate and that unseen evaluation data is preferable.
- Evaluation datasets: Experiments use datasets spanning biomedical, fake-news, English, German, and question-answering domains, with prompts tailored to each dataset.Examples include PubMedQA, XSum, WMT16, and Reddit ELI5.
- Evaluation settings: The method is also evaluated across changing model versions, unknown source models, and mixed human-machine passages using proxy or sliding-window strategies.
- Prompt availability: Detection can be affected when prompts are unavailable, although inverse prompt inference recovered similar questions in 14 of 20 manually checked Reddit ELI5 cases.The authors leave broader exploration of inverse prompt inference for future work.
B.8 PARAMETER SENSITIVITY ANALYSIS
The sensitivity analysis studies truncation and N-gram weighting choices. It selects settings that balance AUROC and TPR across models and datasets while retaining detection under system-prompt changes.
- Starting N-grams: Setting the starting N-gram index n0 to 4 balances AUROC and TPR across models and datasets.The authors report that both very small and large values, such as 1 or 6, hurt performance.
- Weighting function: Using f(n)=n log(n) as the weighting function gives the reported results when AUROC and TPR are considered together.The tested alternatives range from log(n) and n to exponential and quadratic forms.
- System prompts: A large system-prompt deviation decreases AUROC by 1.02 points and TPR by 4.50 points.The authors state that DNA-GPT still maintains high detection results under this change.
C RESULTS ON ADDITIONAL METRICS
Additional metrics evaluate DNA-GPT beyond AUROC and TPR across representative models and black-box or white-box settings. The reported results are better across almost all scenarios, while extreme temperatures reduce detector performance.
- Evaluation examples: The additional-metric results are presented for Reddit with GPT-3.5-turbo and PubMedQA with text-davinci-003 among other examples.
- Additional metrics: DNA-GPT achieves much better F1, false-negative, true-negative, and accuracy results across almost all reported scenarios.The evaluations include GPT-3, GPT-3.5-turbo, GPT-4-0314, and LLaMa under black-box and white-box settings at 1% FPR.
- Temperature effects: Extremely high decoding temperatures cause a significant performance drop for all detectors.At T=1.8, the generated text becomes nonsense; the authors suggest that increasing re-prompting instances may help at T=1.0 or T=1.4.
D EXPLAINABILITY
The explainability analysis shows how regenerated text overlaps can support DNA-GPT’s classifications. Larger overlapping N-grams provide stronger evidence for AI-generated text, while the authors caution against treating that evidence as definitive.
- Supporting evidence: Truncating candidate text and regenerating continuations produces different N-gram-overlap characteristics for human-truncated and AI-truncated text.Examples are provided for high- to low-level overlaps.
- Evidence construction: DNA-GPT’s black-box method reports overlapping N-grams between each regenerated text Yk and the original continuation Y0 as detection evidence.