PaperlayerView exact revision on arXiv

Source-linked AI summary

DetectLLM: Leveraging Log Rank Information for Zero-Shot Detection of Machine-Generated Text

Jinyan Su, Terry Yue Zhuo, Di Wang, Preslav Nakov

arXiv:2306.05540v1cs.CLcs.AI

TL;DR

Identifying machine-generated text is increasingly difficult and costly, while existing zero-shot detectors still leave room for improvement. This paper introduces DetectLLM-LRR and DetectLLM-NPR, two log-rank-based methods, and reports higher AUROC with an efficiency–performance analysis.

  • Problem

    Increasing volumes of LLM-generated text make manual identification impractical, while existing zero-shot methods still have substantial room for improvement.

  • Method

    The paper introduces DetectLLM-LRR, which combines log-likelihood with log-rank, and DetectLLM-NPR, which uses sensitivity to minor text perturbations.

  • Results

    The proposed methods improve over previous best zero-shot methods by 3.9 and 1.75 AUROC points absolute on average.

  • Takeaways & Limitations

    The methods achieve state-of-the-art performance in their respective categories, and the paper provides guidance for balancing detection efficiency and performance.

  • Takeaways & Limitations

    Zero-shot detection assumes access to statistics from the source LLM, which may be unavailable for closed-source models and may require local inference resources.

Abstract

from arXiv · show

With the rapid progress of large language models (LLMs) and the huge amount of text they generated, it becomes more and more impractical to manually distinguish whether a text is machine-generated. Given the growing use of LLMs in social media and education, it prompts us to develop methods to detect machine-generated text, preventing malicious usage such as plagiarism, misinformation, and propaganda. Previous work has studied several zero-shot methods, which require no training data. These methods achieve good performance, but there is still a lot of room for improvement. In this paper, we introduce two novel zero-shot methods for detecting machine-generated text by leveraging the log rank information. One is called DetectLLM-LRR, which is fast and efficient, and the other is called DetectLLM-NPR, which is more accurate, but slower due to the need for perturbations. Our experiments on three datasets and seven language models show that our proposed methods improve over the state of the art by 3.9 and 1.75 AUROC points absolute. Moreover, DetectLLM-NPR needs fewer perturbations than previous work to achieve the same level of performance, which makes it more practical for real-world use. We also investigate the efficiency--performance trade-off based on users preference on these two measures and we provide intuition for using them in practice effectively. We release the data and the code of both methods in https://github.com/mbzuai-nlp/DetectLLM

1 Introduction

LLM-generated text is increasingly difficult and costly to identify manually, motivating flexible zero-shot detectors that can adapt as models proliferate. The paper introduces two log-rank-based methods and examines their performance–efficiency trade-offs.

  • Motivation: Manual identification of machine-generated text is difficult at scale and impractical for real-time applications such as social media.The motivation includes mitigating potential negative impacts from plagiarism, misinformation, and propaganda.
  • Limitations of Existing Methods: Existing black-box supervised detectors require retraining to recognize outputs from new LLMs, making them increasingly expensive and impractical.Third parties also cannot reliably use source-model recording or watermarking when access is API-only.
  • Approach: The paper studies zero-shot detection in a white-box setting, using the source LLM to extract statistics such as per-token log probability or token rank.These statistics are compared with a threshold to make a prediction without additional training.
  • Approach: The proposed methods exploit log-rank information through Log-Likelihood Log-Rank ratio (LRR) and Normalized perturbed log rank (NPR).DetectLLM-LRR is perturbation-free, whereas DetectLLM-NPR applies minor rewrites to assess sensitivity.
  • Results: 3.9 and 1.75 AUROC points absolute are the average improvements over previous best zero-shot methods reported for the two proposed approaches.The contribution statement reports these gains without assigning each value to a specific named method.
  • Analysis: The paper investigates efficiency–performance trade-offs to guide method choice according to users’ preferences for performance or efficiency.It reports comprehensive experiments examining these trade-offs as LLM sizes increase from 1.5 to 20 billion.

2 Related Work

Prior machine-generated-text detectors include supervised classifiers, statistical irregularity methods, zero-shot likelihood thresholding, perturbation-based detection, and watermarking. These approaches differ in training requirements, model access, computational cost, and deployment flexibility.

  • Supervised Detection: Supervised detectors fine-tune classifiers on machine- and human-written text, but models trained for one generator may not transfer directly to new LLM outputs.Examples include GPT2 Detector and ChatGPT Detector, both based on RoBERTa fine-tuning.
  • Statistical and Zero-Shot Methods: Statistical approaches distinguish texts using irregularities in entropy, perplexity, n-gram frequencies, hand-crafted features, or per-token log probability.Simple zero-shot methods evaluate per-token log probability and apply thresholding.
  • Efficiency Limitations: Perturbation-based methods can require large perturbation functions and many perturbations, increasing computational-resource demands.Their performance advantages are therefore coupled to higher computational cost and longer runtime.
  • Watermarking: Watermarking embeds detectable patterns into generated text, but some approaches require access to the LLM’s logits at each time step.The cited approaches include syntax-tree manipulation and logit-based watermarking.

3 Improved Zero-Shot Approaches by Leveraging Log Rank Information

The paper introduces DetectLLM-LRR and DetectLLM-NPR, two zero-shot detectors that exploit log-rank information in complementary ways. LRR combines log-likelihood with log-rank, while NPR measures the sensitivity of log rank to small perturbations.

  • 3.1 Log-Likelihood Log-Rank Ratio (LRR): LRR combines log-rank and log-likelihood to capture complementary information about evaluated text.Log-likelihood represents absolute confidence for the correct token, while log-rank represents relative confidence.
  • 3.1 Log-Likelihood Log-Rank Ratio (LRR): DetectLLM-LRR uses the LRR detection feature to distinguish machine-generated from human-written text.The paper reports that LRR is generally larger for machine-generated text and is a better discriminator than either component alone.
  • 3.2 Normalized Log-Rank Perturbation (NPR): NPR normalizes the log rank of perturbed texts against the log rank of the original target text.Perturbations are minor rewrites, such as replacing some words.
  • 3.2 Normalized Log-Rank Perturbation (NPR): NPR relies on machine-generated text being more susceptible than human-written text to small perturbations.Both types of text show increased log-rank scores after perturbation, but the increase is larger for machine-generated text.

4 Experimental Setup

The experiments evaluate LRR and NPR against existing zero-shot methods across multiple language-model sizes, datasets, and experimental conditions. Performance is measured with AUROC, while methods are grouped by whether they require perturbations.

  • Experimental Scope: Experiments probe zero-shot detection as LLM sizes vary from 1.5B to 20B parameters.The study also examines perturbation functions, perturbation counts, decoding strategies, and temperature.
  • Datasets: Evaluation uses XSum, SQuAD, and WritingPrompts, representing news articles, Wikipedia paragraphs, and prompted stories.Each experiment evaluates 300 machine-generated and human-written text pairs.
  • Evaluation Measure: AUROC measures the probability that a classifier ranks a machine-generated example above a human-written example.Because zero-shot detection rates depend heavily on thresholds, AUROC considers all possible thresholds.
  • Zero-Shot Method Groups: Perturbation-free methods query the LLM only for statistics about the target text x.This group includes log p(x), Rank, Log-Rank, Entropy, and LRR.
  • Zero-Shot Method Groups: Perturbation-based methods query the LLM for the target text and perturbed versions, including DetectGPT and NPR.They generally perform better but are more time-consuming, so they are compared within their own group.
  • Additional Detectors: The study also experiments with RoBERTa-base and RoBERTa-Large supervised detectors, reporting their results in Appendix B.These supervised detectors are not central to the paper's narrative.

5 Evaluation Results

The evaluation compares LRR and NPR with baseline zero-shot detectors across datasets, language models, perturbation settings, decoding strategies, and temperatures. NPR is generally stronger than DetectGPT and can retain performance with fewer perturbations, while detector performance also depends on decoding and temperature.

  • Zero-Shot Results: NPR consistently outperforms DetectGPT on all but one dataset–model case, averaging gains of 0.90, 2.03, and 2.32 AUROC points on XSum, SQuAD, and WritingPrompts.The comparison uses the same perturbation function and number of perturbations.
  • Zero-Shot Results: 4.23 AUROC points separate LRR from DetectGPT on SQuAD, while LRR exceeds NPR by 2.20 AUROC points there.These comparisons show that LRR can outperform perturbation-based methods in some cases.
  • Comparing DetectGPT to NPR: NPR reaches 85 and 95 performance points with approximately 10 perturbations on SQuAD and WritingPrompts, whereas DetectGPT requires around 100.With equal perturbation counts, NPR consistently performs better than DetectGPT.
  • Comparing DetectGPT to NPR: Replacing T5-3B with smaller perturbation models harms both NPR and DetectGPT, and 100 perturbations with T5-large remain worse than 10 with T5-3B.Increasing the number of perturbations does not mitigate the performance degradation from using smaller models.
  • Different Decoding Strategy and Temperature: Top-k and top-p sampling generally improve most zero-shot methods over temperature sampling, with Log Rank and Log Likelihood favoring top-p sampling.The decoding-strategy results are averaged across four language models.
  • Different Decoding Strategy and Temperature: Temperature has minor effects on DetectGPT, improves NPR, and can make perturbation-free methods outperform perturbation-based methods below 0.95.The temperature comparison reports different effects for perturbation-free and perturbation-based detectors.

6 Analysis of the Efficiency

The efficiency analysis quantifies the computational costs of perturbation-free and perturbation-based detectors and examines how model size and perturbation count affect performance. LRR is substantially faster, while NPR’s value depends on available memory, perturbation resources, and the desired performance level.

  • Computational Cost: Perturbation-based methods require at least 50 times longer per sample than Log Likelihood, Rank, Log Rank, and Entropy methods.They calculate statistics for the target text and perturbed samples, whereas LRR runs approximately twice as long as simple statistics.
  • Computational Cost: For perturbation-free methods, computation is approximately t_m for simple statistics and 2 · t_m for LRR; perturbation-based methods require n · t_p + (n + 1) · t_m.Here t_p is the time to perturb one sample, t_m is the time to calculate one sample’s statistics, and n is the perturbation count.
  • Perturbation Function Choice: T5-small and T5-base perform worse than LRR even with 50 to 100 perturbations, suggesting LRR can be at least 50 to 100 times faster while achieving better performance.The paper recommends LRR when only these smaller perturbation functions are affordable.
  • Perturbation Function Choice: T5-3B has a higher performance upper limit than T5-large, making it preferable when memory and perturbation time permit and performance is prioritized.The comparison evaluates LRR against NPR using T5-large and T5-3B perturbation functions.
  • Perturbation Function Choice: Using T5-large requires more than twice as many perturbations as T5-3B for the same performance, while its perturbation time is less than twice as short.The paper therefore characterizes larger perturbation functions such as T5-3B as more efficient, with memory as the main concern.
  • Choosing Between LRR and NPR: A validation-set rule recommends setting NPR to 10 perturbations, then choosing LRR if it outperforms NPR and NPR otherwise.The paper presents this as a practical threshold for balancing efficiency and performance.

7 Conclusion

The paper proposes LRR and NPR as log-rank-based zero-shot detectors and evaluates their performance, settings, and computational costs. It concludes with guidance for balancing detection performance and efficiency.

  • Conclusion: The paper proposes LRR and NPR as simple, effective zero-shot machine-generated-text detectors leveraging log-rank information.LRR and NPR achieve state-of-the-art performance within their respective categories.
  • Conclusion: The analysis studies decoding strategy, temperature, perturbation functions, and perturbation counts to characterize zero-shot detectors’ advantages and disadvantages.These experiments support guidance on balancing efficiency and performance.

8 Limitations and Future Directions

Zero-shot detection assumes access to statistics from the source model, which may be unavailable for closed-source models and costly to obtain locally. The paper identifies weak supervision using other accessible models as a future direction.

  • Limitations: White-box zero-shot methods require statistics from the source model, creating access and local-computation constraints.These statistics may not be provided for closed-source models, and running the source model locally requires sufficient resources.
  • Future Directions: Weak supervision is proposed for settings where the source LLM is unknown.Other LLMs can provide weak supervision, including smaller open-source models, relaxing the need to run an extremely large target model locally.

A Experimental Details and Baselines

The experiments compare zero-shot detectors based on log likelihood, rank, log rank, entropy, and perturbations across language models ranging from 1.5B to 20B parameters. The appendix documents the model configurations, computational resources, and supervised-method result tables.

  • Baselines: The baseline suite includes Log Likelihood, Rank, Log Rank, Entropy, and DetectGPT zero-shot detectors.These methods use source-model statistics or perturbations to distinguish machine-generated from human-written text.
  • Language Models: The main experiments use 7 LLMs ranging from 1.5B to 20B parameters.GPT2-xl is the 1.5B model, while NeoX-20B is the largest listed model.
  • Experimental Details: Experiments require 1, 3, or 4 NVIDIA A100 GPUs depending on model size.Small models use one 40G GPU, larger models use three GPUs, and NeoX-20 uses four GPUs totaling 160G.
  • Results Tables: The appendix provides complete supervised-method results and comparisons using AUROC scores.Table 6 reports complete supervised results, while Table 7 covers top-k and top-p sampling.

B Supervised Methods

The proposed zero-shot methods compare favorably with supervised RoBERTa detectors across datasets and decoding conditions. NPR can outperform roberta-base and, on WritingPrompts, exceed roberta-large, while temperature affects both method families.

  • Main Comparison: On average, the best zero-shot method exceeds roberta-base, with LRR best on SQuAD and NPR best on XSum and WritingPrompts.Against roberta-large, DetectGPT and NPR outperform it on WritingPrompts by 0.55% and 2.87%, respectively.
  • Decoding Strategy: NPR can outperform roberta-base while remaining comparable to roberta-large under top-p and top-k decoding.The supervised comparison finds top-p decoding performs better than top-k for the evaluated supervised models.
  • Temperature: Lower temperature improves supervised performance and narrows the roberta-base versus roberta-large gap.At low temperature, Log Rank and Log Likelihood may exceed supervised methods.
  • Perturbation Comparison: NPR outperforms DetectGPT in nearly all evaluated dataset-and-model combinations as perturbation counts increase.The exception is GPT-j on XSum; on SQuAD with Llama-13B, DetectGPT is abnormal while NPR improves stably.
  • Perturbation Function: With T5-large perturbations, NPR often outperforms DetectGPT and matches or exceeds its 100-perturbation performance using 10 perturbations.The stated exception is Llama-13B on SQuAD.

D Alternative Sampling Strategies and Temperature

Sampling strategy and temperature substantially affect zero-shot detection. Perturbation-free methods tend to benefit from lower temperature, whereas NPR is more suitable at higher temperature and remains more informative than DetectGPT under alternative sampling strategies.

  • Alternative Sampling Strategies: NPR provides a clearer machine-generated-text signal than DetectGPT under both top-k and top-p sampling.The complete comparison covers four language models and evaluates perturbation-based methods under alternative decoding strategies.
  • Alternative Sampling Strategies: Top-p and top-k sampling generally improve zero-shot performance relative to temperature sampling, with Log Rank and Log Likelihood favoring top-p.The passage notes that the other two compared methods show different sampling preferences.
  • Temperature: Lower temperature improves all perturbation-free zero-shot methods, and Log Rank and Log Likelihood can reach approximately 100 points detection accuracy.These methods can exceed NPR when temperature drops.
  • Temperature: NPR usually improves as temperature decreases, while DetectGPT shows no clear temperature trend.The paper suggests perturbation-based methods suit high temperature, whereas perturbation-free methods suit low temperature.
  • Computational Cost: Computational time is estimated over 10 samples, using T5-3b and 50 perturbations for perturbation-based methods.This setting matches the main results and estimates the cost of achieving high performance.
Loading 2306.05540v1…