PaperlayerView exact revision on arXiv

Source-linked AI summary

RADAR: Robust AI-Text Detection via Adversarial Learning

Xiaomeng Hu, Pin-Yu Chen, Tsung-Yi Ho

arXiv:2307.03838v2cs.CLcs.AIcs.LG

TL;DR

Reliable AI-text detection is needed because LLM-generated text can be difficult to distinguish from human writing, and paraphrasing can evade existing detectors. RADAR jointly adversarially trains a paraphraser and detector, and experiments across 8 LLMs and 4 datasets report robust detection under paraphrasing with transferability across LLMs. The authors nevertheless note that RADAR can underperform the best baseline on native LLM text and can make incorrect predictions.

  • Problem

    AI-text detection remains unreliable and vulnerable to paraphrasing, creating risks involving fake content, plagiarism, and false accusations.

  • Method

    RADAR jointly trains a paraphraser and detector adversarially, using detector feedback to improve paraphrasing and paraphrased outputs to improve detection.

  • Results

    0.857 average AUROC versus 0.651 for entropy against an unseen paraphraser, while RADAR remains robust across 8 LLMs and 4 datasets.

  • Takeaways & Limitations

    RADAR’s detection capability transfers from instruction-tuned LLMs to other LLMs and generally improves when paraphrasing is present.

  • Takeaways & Limitations

    RADAR may underperform the best existing method on native LLM-generated text and can produce incorrect predictions, so evidence use requires further validation.

Abstract

from arXiv · show

Recent advances in large language models (LLMs) and the intensifying popularity of ChatGPT-like applications have blurred the boundary of high-quality text generation between humans and machines. However, in addition to the anticipated revolutionary changes to our technology and society, the difficulty of distinguishing LLM-generated texts (AI-text) from human-generated texts poses new challenges of misuse and fairness, such as fake content generation, plagiarism, and false accusations of innocent writers. While existing works show that current AI-text detectors are not robust to LLM-based paraphrasing, this paper aims to bridge this gap by proposing a new framework called RADAR, which jointly trains a robust AI-text detector via adversarial learning. RADAR is based on adversarial training of a paraphraser and a detector. The paraphraser's goal is to generate realistic content to evade AI-text detection. RADAR uses the feedback from the detector to update the paraphraser, and vice versa. Evaluated with 8 different LLMs (Pythia, Dolly 2.0, Palmyra, Camel, GPT-J, Dolly 1.0, LLaMA, and Vicuna) across 4 datasets, experimental results show that RADAR significantly outperforms existing AI-text detection methods, especially when paraphrasing is in place. We also identify the strong transferability of RADAR from instruction-tuned LLMs to other LLMs, and evaluate the improved capability of RADAR via GPT-3.5-Turbo.

1 Introduction

AI-text detection is difficult because LLM-generated writing can resemble human text and paraphrasing can evade existing detectors. RADAR addresses this gap by adversarially training a paraphraser and detector, with experiments showing robust performance across models and datasets.

  • Motivation: LLMs enable highly fluent text generation, blurring the boundary between human- and machine-written content.This creates challenges for document completion, question answering, translation, and content creation systems.
  • Motivation: Reliable AI-text detection matters because failures can enable fake content, plagiarism, and false accusations of human writers.OpenAI reported 26% true-positive identification of AI text and 9% false positives on human text in challenging English cases.
  • Research gap: LLM-based paraphrasing can evade several existing AI-text detectors, motivating debate over how to design reliable detection.Prior work reported evasion even when the original AI text was watermarked.
  • RADAR: RADAR adversarially trains a paraphraser to evade detection and a detector to distinguish human from AI text using feedback from their competing objectives.The paraphraser and detector iteratively update their parameters in an adversarial learning process.
  • Results: Across 8 LLMs and 4 datasets, RADAR is reported as the only evaluated detector with consistently high performance that is not weakened by paraphrasing.The comparison includes six supervised and unsupervised detection methods.
  • Results: RADAR detectors transfer effectively from instruction-tuned LLMs such as Vicuna-7B to other LLMs.The authors suggest this finding supports the possibility of training a universal AI-text detector based on state-of-the-art LLMs.

2 Related Work

Prior AI-text detection work uses statistical or classification-based approaches, while adversarial natural-language generation addresses the challenge of training generators over discrete token sequences.

  • AI-Text Detection: Statistical AI-text detectors use signals such as entropy, n-gram frequency, perplexity, probability, and probability rank.GLTR and DetectGPT exemplify threshold-based and perturbation-based statistical approaches.
  • AI-Text Detection: Classification methods formulate AI-text detection as binary classification and train a classifier for a target language model.OpenAI’s earlier detector used a RoBERTa-based model trained on human and machine-generated samples.
  • Adversarial Learning for Natural Language Generation: Adversarial natural-language generation is difficult because text generation samples discrete vocabulary tokens, preventing straightforward end-to-end back-propagation.Existing approaches replace discrete sampling with continuous approximations or cast generation as decision-making with policy learning.
  • Adversarial Learning for Natural Language Generation: SeqGAN treats generated tokens as states and next-token choices as actions, using discriminator-derived rewards collected through Monte Carlo search.Other work combines word- and sentence-level rewards or uses imitation learning.

3 RADAR: Methodology and Algorithms

RADAR jointly trains a detector and paraphraser through an adversarial loop: AI text is generated, paraphrased, and used with human text to update the detector until validation AUROC stops improving.

  • High-Level Methodology: RADAR uses a frozen target LM, a tunable detector, and a tunable paraphraser as its three language-model components.The target LM generates AI-text data but receives no parameter updates.
  • High-Level Methodology: The framework first builds an AI-text corpus by applying document completion with the target LM to prefixes from a human-text corpus.This produces corpus M from human-text corpus H.
  • Training Loop: The paraphraser rewrites AI-text into paraphrased samples, then uses detector feedback as a reward to update its policy with PPO.The detector output represents the predicted likelihood that the paraphrased text is human-written.
  • Training Loop: The detector is updated with logistic loss on human text, original AI text, and paraphrased AI text.A coefficient λ adjusts the proportion of AI-text components to mitigate the two-to-one AI-to-human sample imbalance.
  • Training Loop: Paraphraser and detector updates repeat until validation AUROC no longer improves, encouraging robustness to both original and paraphrased AI text.The adversarial competition is intended to make the detector robust to the paraphraser’s evolving outputs.
  • Paraphraser Training: RADAR’s paraphraser uses clipped PPO with an entropy penalty to balance detector-reward optimization against diverse generation.Clipping limits the importance ratio, while the entropy term encourages exploration of more diverse policies.

4 Experiments

RADAR is evaluated against existing AI-text detectors across eight LLMs, four datasets, and multiple paraphrasing settings. It maintains strong detection under paraphrasing, transfers across models, and produces improved paraphrasers, while accepting a trade-off on unperturbed text.

  • Experimental setup: Experiments cover eight LLMs, four human-text datasets, and without, seen, and unseen paraphrasing settings.The target LLMs include four open-source models and their instruction-tuned versions; GPT-3.5-Turbo is the default unseen paraphraser.
  • Performance evaluation: Without paraphrasing, RADAR reaches AUROC 0.856, compared with 0.904 for the best existing detector, log rank.The authors attribute RADAR’s slightly lower unperturbed performance to a trade-off favoring robustness to paraphrasing.
  • Performance evaluation: RADAR attains the best detection performance on every dataset against paraphrasing, with average AUROC 0.857 versus 0.651 for entropy against the unseen paraphraser.Existing methods generally degrade under paraphrasing, with AUROC drops ranging from 10.4% to 81.7%.
  • Transferability: Instruction-tuned source models transfer better than corresponding untuned models; for Vicuna-7B to LLaMA-7B, transferability reaches 95.0% versus 68.2% in the reverse direction.The top three detectors by holistic transferability are all trained with instruction-tuned LLMs, and instruction tuning has a stronger effect than model size.
  • Transferability: Paraphrasing increases average holistic detection transferability by 11.6%, with improvements for six LLMs ranging from 2.4% to 47.6%.LLaMA-7B and GPT-J-6B are exceptions, declining by 3.8% and 1.4%, respectively.
  • Transferability: Five of eight RADAR detectors outperform OpenAI’s RoBERTa on GPT-4 generations, including a Camel-5B-trained detector reaching AUROC 0.915.Three RADAR detectors achieve detection AUROC above 0.8 on GPT-4 generations.

5 Conclusion

RADAR is a robust AI-text detector training framework that uses adversarial learning to jointly train a detector and paraphraser. Experiments across 8 LLMs and 4 datasets validated its effectiveness and demonstrated strong transferability across LLMs.

  • RADAR jointly trains an AI-text detector and paraphraser through adversarial learning.
  • Experiments across 8 LLMs and 4 datasets validated RADAR’s effectiveness.
  • RADAR demonstrated strong transferability across LLMs.

6 Limitations and Ethical Considerations

RADAR is designed to remain robust against paraphrased AI-text, but its detection is imperfect and can underperform the best baseline on native LLM-generated text. The authors therefore recommend discretion and further validation when using its predictions as evidence.

  • Limitations: RADAR can show degraded detection performance on native LLM-generated text compared with the best existing detection method.This limitation concerns texts without paraphrasing, whereas RADAR is more robust to paraphrasing than existing baselines across 4 datasets.
  • Ethical Considerations: RADAR can give incorrect predictions in some cases, so detection results used as evidence require further validation.The authors recommend using the tool to assist with identifying AI-written content at scale and with discretion.
  • Detection Setting: RADAR’s detector assigns AI-text probability from a supervised model’s logits over two labels, AI-text and human-text.The detector’s scalar output is equivalent to a logistic regression task.
  • Training Process: RADAR’s training process jointly updates a paraphraser and detector until their validation losses stabilize.The paraphraser uses detector predictions as rewards with PPO, while the detector updates using logistic loss on human-text and AI-text.

E Complete Experimental Results

The evaluation results are reported in three tables covering detection without paraphrasing, with a RADAR-Unseen paraphraser, and with a RADAR-Seen paraphraser.

  • Evaluation results are reported as AUROC without a paraphraser, with a RADAR-Unseen paraphraser, and with a RADAR-Seen paraphraser.

F Case Study for RADAR

The case study evaluates RADAR on generated and paraphrased texts from 8 instruction-tuned LLMs, selecting examples with the highest and lowest machine-generation confidence. An easy case reaches 0.9999 probability, while a difficult case reaches 0.0031 because the AI-text is nearly identical to the human-text with appended words.

  • Sample Selection: The case study samples human texts from four evaluation datasets and generates completions with 8 instruction-tuned LLMs.
  • Sample Selection: 64 AI-texts are collected: 32 completions and 32 GPT-3.5-Turbo paraphrases.
  • Case Selection: Each text is evaluated with the RADAR detector trained for its source model, and cases with the largest and smallest machine-generation confidence are selected.
  • Analysis: 0.9999 machine-generation probability identifies an easy-to-detect case, while 0.0031 identifies a difficult-to-detect case.The difficult case is detectable only when the threshold drops below 0.0031.
  • Analysis: The difficult misclassification is explained by AI-text that is nearly identical to the original human-text except for several appended words.

G Effectiveness of Ensembling Detectors from RADAR

RADAR evaluates detector ensembling by combining base and augmented predictions, while examining performance across text lengths and paraphrasing conditions. Results indicate that ensemble effectiveness depends on the ensemble model and ratio, and RADAR remains comparatively strong under paraphrasing.

  • Ensemble results: Ensembling effectiveness varies with both the selected ensemble model and the ensemble ratio.A ratio of 0 means no ensembling, while a ratio of 1 corresponds to transfer detection.
  • Ensemble setup: Ensembling combines base model A’s and augmented model B’s prediction probabilities to detect A’s generated text.The ensemble ratio β ranges from 0 to 1.
  • Text length: Without paraphrasing, log probability, rank, log rank, and DetectGPT are not strongly sensitive to text length.Their performance increases with longer texts when paraphrasing is applied.
  • Text length: Without paraphrasing, entropy, OpenAI (RoBERTa), and RADAR detect longer texts better, but their performance degrades on longer paraphrased AI-text.RADAR still outperforms other methods by a large margin and appears especially strong for short-text detection.

I Detection on Dipper Paraphrasing

RADAR is evaluated against Dipper, an advanced paraphraser, using the same seen and unseen paraphrasing setup. Its detection performance remains high, whereas other detectors show varying robustness across paraphrasers.

  • Dipper evaluation: RADAR’s detection AUROC on Dipper reaches 0.9.The evaluation uses Dipper’s L60-O60 version and follows the RADAR-Seen and RADAR-Unseen paraphrasing setups.
  • Dipper evaluation: Dipper is generally less destructive to the evaluated detectors than GPT-3.5-Turbo, except for DetectGPT.This is reflected by green bars being much higher than red bars in the augmented figure.
  • Baseline comparison: OpenAI (RoBERTa) performs well under Dipper paraphrasing but is not considered robust because other paraphrasers can bypass it.The cited bypasses include RADAR-Seen and RADAR-Unseen paraphrasing.

J Sensitivity Analysis of RADAR on the Hyperparameter λ

The sensitivity analysis varies λ from 0.1 to 1.0 in RADAR models trained with Vicuna-7B. It compares unperturbed and paraphrased detection performance against baselines across four datasets.

  • λ sensitivity: RADAR models trained with Vicuna-7B are evaluated across λ values ranging from 0.1 to 1.0.The comparison uses Vicuna-7B’s four evaluation datasets.
  • λ sensitivity: The analysis compares AUROC for unperturbed and paraphrased AI-text against other baselines.The horizontal and vertical axes represent unperturbed and paraphrased AI-text AUROC, respectively.

K Detection on GPT-4 Generated Texts

RADAR detectors trained on weaker LLMs are evaluated on GPT-4-generated texts using four datasets. The broader experiments also assess the language-generation capability of RADAR’s adversarially trained paraphrasers with GPT-3.5-Turbo.

  • GPT-4 transfer detection: RADAR detectors trained on weaker LLMs, including Vicuna-7B and Camel-5B, are used to detect GPT-4-generated text.GPT-4 is prompted to complete text, and evaluation uses Xsum, SQuAD, WP, and TOFEL.
  • GPT-4 transfer detection: Figure A5 reports RADAR detection performance on GPT-4 using detectors trained with a source model.The evaluation is measured on texts generated from GPT-4.
  • Paraphraser evaluation: After RADAR training, the framework produces both a detector and a paraphraser.GPT-3.5-Turbo scores the paraphrasers’ generations and compares them with the initial T5-large version on a 100-sample WebText subset.
Loading 2307.03838v2…