Source-linked AI summary
Raidar: geneRative AI Detection viA Rewriting
Chengzhi Mao, Carl Vondrick, Hao Wang, Junfeng Yang
TL;DR
Detecting machine-generated text is challenging when current methods rely on numerical outputs unavailable from black-box LLMs. Raidar prompts an LLM to rewrite text and measures editing distance; it improves benchmark detection by up to 29 points across domains.
Problem
Many current detection methods rely on LLM numerical outputs or high-dimensional features that may be unavailable for black-box models or prone to spurious correlations.
Source: §1 · p. 1Method
Raidar prompts an LLM to rewrite input text and uses symbolic output modifications, including editing distance, to detect machine-generated text.
Source: §1 · pp. 1–2, §3.1 · p. 3Results
Across six datasets and domains, Raidar improves established paragraph-level detection benchmarks by up to 29 points and remains robust to unseen language models and tailored evasion prompts.
Source: §1 · p. 2Takeaways & Limitations
The findings indicate that LLMs' inherent structure can provide useful information for detecting text generated by those models.
Source: §5 · p. 9A sophisticated adversary might craft prompts that make rewritten GPT text undergo significant changes, thereby evading detection.
Source: §4.4 · p. 8
Abstract
from arXiv · showhide
We find that large language models (LLMs) are more likely to modify human-written text than AI-generated text when tasked with rewriting. This tendency arises because LLMs often perceive AI-generated text as high-quality, leading to fewer modifications. We introduce a method to detect AI-generated content by prompting LLMs to rewrite text and calculating the editing distance of the output. We dubbed our geneRative AI Detection viA Rewriting method Raidar. Raidar significantly improves the F1 detection scores of existing AI content detection models -- both academic and commercial -- across various domains, including News, creative writing, student essays, code, Yelp reviews, and arXiv papers, with gains of up to 29 points. Operating solely on word symbols without high-dimensional features, our method is compatible with black box LLMs, and is inherently robust on new content. Our results illustrate the unique imprint of machine-generated text through the lens of the machines themselves.
1 INTRODUCTION
Recent LLMs make machine-generated text harder to detect, while many existing methods rely on numerical outputs unavailable from black-box models. Raidar detects machine-generated text by prompting an LLM to rewrite it and measuring the resulting edits.
1 INTRODUCTION
- Existing detection methods increasingly struggle with recent LLMs, and many rely on numerical outputs or high-dimensional features unavailable in black-box models or prone to spurious correlations.Detecting and auditing machine-generated text is motivated by potential risks including misinformation, academic dishonesty, and insecure code.Source: §1 · p. 1
- Raidar prompts an LLM to rewrite input text and detects machine generation by measuring character editing distance between the original and rewritten text.The authors observe that machine-generated text is altered less frequently than human-written text during rewriting.Source: §1 · pp. 1–2, Figure 1 · p. 2
- Raidar uses symbolic word output rather than deep neural features, allowing black-box LLM integration and detection without access to the original generating model.Its feature-agnostic design is presented as reducing irrelevant and spurious correlations.Source: §1 · p. 2
- Up to 29 points: Raidar improves established paragraph-level detection benchmarks across six datasets and domains, including for text from unseen language models and adversarial prompts.The reported models include Ada, Text-Davinci-002, Claude, and GPT-3.5.Source: §1 · p. 2
2 RELATED WORK
Prior detection work faces challenges from high-quality LLM text, unavailable model scores, and paraphrase-based evasion. Raidar's rewriting-based signals contrast with score-dependent approaches and ordinary task prompting.
2 RELATED WORK
- Recent detection methods can require probability or loss outputs unavailable from GPT-3.5 and GPT-4, while other scoring models may require access to target-model documents or share the target model.The cited work also identifies nuisance features, spurious correlations, and adversarial manipulation as robustness concerns.Source: §2 · p. 2
- Earlier detection methods predate LLMs, while high-quality recent generation makes detection challenging and machine text may carry distinctive but difficult-to-detect signals.Machine-generated text detection was studied before LLMs emerged (Bakhtin et al., 2019; Gehrmann et al., 2019; Ippolito et al., 2019).Source: §2 · p. 2
- Figure 2 contrasts human and GPT text in rewriting invariance, reverse-transformation equivariance, and output uncertainty on 4,000 Yelp Review samples.The caption reports greater machine-text invariance and equivariance, and more stable GPT input.Source: Figure 2 · p. 3
- Paraphrasing can evade detectors and break watermarks, whereas the authors state that their rewriting-based detection can be robust to rephrasing.The cited evasion work includes DetectGPT, GLTR, and other zero-shot methods (Krishna et al., 2023; Sadasivan et al., 2023).Source: §2 · p. 3
- Unlike zero-shot prompts that directly ask GPT to identify GPT-generated text, Raidar uses rewriting prompts to probe properties of the input.The authors note that searching for better prompts is left for future work (Zhou et al., 2022).Source: §2 · p. 3
3 DETECTING MACHINE GENERATED TEXT BY REWRITING
Raidar detects machine-generated text by prompting an LLM to rewrite it and measuring how much the text changes. It uses rewriting behavior to define invariance, equivariance, and output uncertainty, then turns symbolic changes into classifier features.
3.1 REWRITING TEXT VIA LANGUAGE MODELS AND PROMPTS
- Invariance measures the modification distance between an input and its rewrite, while equivariance compares rewriting after a transformation and its reversal with direct rewriting.The paper describes transformations as prompts, with the reversal implemented by another prompt.Source: §3.1 · pp. 3, 5
- The method uses manually written prompts to elicit rewriting behavior, including requests to polish, rewrite, or refine text.The authors leave automatic prompt generation for future work.Source: §3.1 · p. 4
- Output uncertainty measures variation across multiple rewrites, using distances between outputs rather than comparing them with the original input.The authors assume LLM-generated text will be more stable across repeated rewrites than human-written text.Source: §3.1 · p. 5
3.2 MEASURING CHANGE IN REWRITING
- Raidar represents rewriting changes symbolically and uses measured invariance, equivariance, and uncertainty as features for a binary classifier.Its discrete-token design requires minimal LLM access and is compatible with black-box models that expose tokens but not probability values.Source: §3.2 · pp. 5–6
- Over 22 points of improvement over the established state-of-the-art in out-of-distribution paragraph detection; in-domain results show over 8 points of improvement.The reported comparisons are F1 scores; Table 2 uses logistic regression for Raidar in the out-of-distribution setting.Source: Table 2 · p. 6, Table 1 · p. 6
4 RESULTS
The experiments compare paragraph-level detection with prior methods and examine robustness to evasion, generator models, rewriting models, prompts, and input length. Raidar improves on prior methods across the reported benchmarks.
4.1 DATASET
- The six datasets cover creative writing, news, student essays, Python code, Yelp reviews, and arXiv abstracts.The news and creative-writing machine text comes from text-davinci-003; code, Yelp reviews, and arXiv abstracts are generated with GPT-3.5-turbo.Source: §4.1 · pp. 6–7
4.2 BASELINES
- Baselines include GPT zero-shot detection, GPTZero, DetectGPT, and Ghostbuster, with DetectGPT and Ghostbuster described as state-of-the-art methods.DetectGPT thresholds input curvature; Ghostbuster uses probabilistic LLM outputs as classifier features.Source: §4.2 · p. 7
4.3 MAIN RESULTS
- Raidar outperforms Ghostbuster by up to 29 points and improves by up to 32 points in the out-of-distribution experiment.The OOD setup trains the detector on one dataset and evaluates it on another.Source: §4.3 · p. 7
4.4 ANALYSIS
- Single-prompt training can be bypassed by adversarial rephrasing, while multi-prompt training improves robustness and reaches up to 93 F1 on unseen evasive prompts.The reported exception is Yelp, where multi-prompt training performs worse than single-prompt training; the authors suspect prompt-related data differences.Source: Table 3 · p. 7, §4.4 · p. 8
4.3 MAIN RESULTS
- With GPT-3.5-Turbo rewriting, Raidar reaches up to 96 F1 in-distribution and up to 91 F1 out-of-distribution across generator models.On Claude-generated student essays, it achieves an F1 score of 57.80.Source: §4.4 · pp. 8–9, Table 4 · p. 8
4.4 ANALYSIS
- GPT-3.5-Turbo achieves the highest detection performance among the tested rewriting models, and larger rewriting models enhance performance.The alternatives tested are Ada and Text-Davinci-002.Source: Table 5 · p. 8, §4.4 · p. 9
- Prompt choice affects detection, no single prompt performs best across data sources, and a single rewriting prompt can yield up to 90 detection F1.The comparison covers prompts across three datasets.Source: §4.4 · p. 9, Figure 6 · p. 9
- Longer Yelp inputs generally improve detection, while Raidar achieves 74 detection F1 on inputs as short as ten words.The figure’s dot size represents the number of data points.Source: §4.4 · p. 9, Figure 5 · p. 9
5 CONCLUSION
Raidar uses rewriting edit distance to detect machine-generated text and improves detection across benchmarks, including for novel language models and evasion-oriented prompts. The findings support using LLM structure as a signal for detecting text generated by those models.
5 CONCLUSION
- Raidar detects machine-generated text using rewriting editing distance.The conclusion describes improved detection performance across benchmarks and state-of-the-art methods.Source: §5 · p. 9
- The method remains effective on text from novel language models and text generated with prompts aimed at bypassing detection.The conclusion reports improved detection performance across several benchmarks and state-of-the-art methods.Source: §5 · p. 9
- The findings suggest that LLMs’ inherent structure can provide useful information for detecting text generated by those models.The authors describe this as opening a direction for machine-generated-text detection.Source: §5 · p. 9
A.1 DATA CREATION
The appendix describes how the paper assembled AI-generated examples for code, Yelp reviews, and arXiv abstracts, alongside the selected datasets’ motivations.
A.1 DATA CREATION
- Dataset selection includes news, creative writing, essays, code, Yelp reviews, and arXiv abstracts to address prior-work continuity and concerns about AI-generated content in these domains.The authors cite Verma et al. (2023) for the news, creative-writing, and essay data and discuss code, reviews, and academic writing as emerging concerns.Source: §A.1 · p. 13
- For the code dataset, GPT turns HumanEval code specifications into descriptions, then uses those descriptions and specifications to generate Python code.The generated code is intended to follow each task’s input-output format and specifications.Source: §A.1 · p. 13
- For Yelp, GPT-3.5 generates concise synthetic reviews from original reviews using a short-review prompt.The authors report that this prompt produced more effective, succinct examples than asking for a review based on the original.Source: §A.1 · p. 13
- For arXiv, GPT generates abstracts from each paper’s title and the first 15 words of its original abstract.The authors report that this prompt produced realistic abstracts aligned with the titles.Source: §A.1 · p. 13
A.2 DATASET STATISTICS
The appendix reports dataset size and text-length statistics, with lengths measured in words and the analysis focused on short, challenging paragraph-level text.
A.2 DATASET STATISTICS
- The dataset statistics report size, median, minimum, and maximum length for human-written and machine-generated examples.The statistics are presented in Tables 6 and 7.Source: §A.2 · p. 13
- Text length is measured by word count.Source: Table 6 · p. 13
- The study focuses on paragraph-level text, which the authors characterize as generally shorter and more challenging.Source: Table 6 · p. 13
A.3 ALGORITHM
The appendix identifies three algorithm variants—invariance, equivariance, and uncertainty—and denotes their learned classifier as C.
A.3 ALGORITHM
- The appendix presents algorithms based on invariance, equivariance, and uncertainty.The learned classifier is denoted C.Source: §A.3 · p. 13
A.4 ANALYSIS
The analysis examines text quality, robustness across writing backgrounds and model changes, and variations in rewriting-based detection. It reports strong transfer to non-native English writing, while other findings depend on dataset or input length.
Quality of machine-generated content
- Human participants generally rated human-written texts as similar or higher quality than machine-generated texts in the Yelp and Arxiv study.Three participants assessed 20 examples per dataset; the passage also reports that LLMs tended to prefer machine-generated texts and make fewer edits.Source: §A.4 · pp. 13–14, Table 8 · p. 14
Robustness to LLM fine-tuning
- Across experiments on GPT-3.5-Turbo and GPT-4-Turbo, the method remains above the established state-of-the-art zero-shot detector despite a drop in detection performance, showing robustness to LLM fine-tuning.Source: §A.4 · p. 14
Robustness to non-native English authors
- 81.16 F-1 is achieved on ASAP after training on Arxiv, less than 1 point below the Arxiv result.The study describes ASAP essays as non-native English writing at an eighth-grade level.Source: §A.4 · p. 15
Combining rewrites from multiple LLMs
- Combining rewrites from multiple LLMs improves Arxiv detection, but not Yelp detection.Table 11 reports F1 scores for combining rewrites across two datasets.Source: §A.4 · p. 15
Edit distance between rewrites
- Adding edit distance between rewrites from different LLMs improves detection performance.Table 12 reports F1 scores for this additional feature.Source: §A.4 · p. 15
Combining features
- Combining invariance, equivariance, and uncertainty features does not further improve performance on the two studied datasets.Table 13 reports the combined-feature experiment.Source: §A.4 · p. 15
Detection performance by input length
- Longer inputs help detection on News and Creative Writing, while student-essay inputs longer than 125 words degrade performance.Figure 8 reports the student-essay length boundary.Source: Figure 8 · p. 16, Figure 7 · p. 16
Statistical significance of edits
- The number of edits between human and machine-generated texts differs significantly according to a one-sided two-sample t-test.The reported p-value is much smaller than 0.05.Source: §A.4 · p. 16
A.5 IMPLEMENTATION DETAILS
The implementation uses logistic regression for most experiments, with dataset-specific training and testing splits and a different classifier for student essays. The appendix also documents evaluation setups for model transfer, non-native writing, feature combinations, and input length.
Classifier and training/testing setup
- Logistic regression is used for all experiments except student essays, where XGBoost performs better.For Table 2, News trains on Creative Writing, Creative Writing trains on News, and Student Essay trains on News.Source: §A.5 · p. 16
Detection performance by input length
- For the two datasets described in Figure 9, detection is high on shorter inputs but drops for longer ones.The figure caption does not identify those datasets by name in the supplied passage.Source: Figure 9 · p. 17
Robustness to LLM fine-tuning
- The GPT-3.5-Turbo-trained detector is tested on GPT-4-Turbo text using the older GPT-3.5-Turbo rewriting model, and still outperforms the published state-of-the-art zero-shot detector.The detector was never trained on GPT-4-Turbo data, although detection effectiveness drops.Source: Table 9 · p. 17
Robustness to non-native English authors
- Training on Arxiv and testing on ASAP yields an F-1 detection score of 81.16, less than 1 point below the Arxiv result.Table 10 evaluates non-native English authors using ASAP essays.Source: Table 10 · p. 17
Additional feature experiments
- Tables 11–13 cover combining LLM rewrites, adding inter-rewrite edit distance, and combining invariance, equivariance, and uncertainty features.Their captions specify F1 scores for Tables 11 and 12 and detection performance for Table 13.Source: Table 11 · p. 17, Table 12 · p. 18, Table 13 · p. 18
Significance and classifier comparisons
- Table 14 reports one-sided two-sample t-test p-values for edit-count differences, and Table 15 compares logistic regression with XGBoost classifiers.Table 14 corresponds to Figure 2.Source: Table 14 · p. 18, Table 15 · p. 18