PaperlayerView exact revision on arXiv

Source-linked AI summary

AICD Bench: A Challenging Benchmark for AI-Generated Code Detection

Daniil Orel, Dilshod Azizov, Indraneil Paul, Yuxia Wang, Iryna Gurevych, Preslav Nakov

arXiv:2602.02079v1cs.LGcs.SE

TL;DR

As functional code generation scales, existing detection benchmarks inadequately test robustness beyond in-distribution binary classification. AICD Bench addresses this gap with a large, diverse benchmark and realistic tasks, while evaluations show current detectors remain far from practical requirements.

  • Problem

    Existing benchmarks inadequately evaluate AI-generated code detection across models, languages, domains, and hybrid or adversarial settings, despite the need for reliable detection.

  • Method

    AICD Bench provides a 2M-sample benchmark spanning 77 generators and 9 programming languages, with standardized protocols and three complementary detection tasks.

  • Results

    Current detectors generalize poorly across languages, domains, and generator families, performing particularly poorly on hybrid and adversarial code and remaining far from practical requirements.

  • Takeaways & Limitations

    AICD Bench establishes a unified evaluation suite for developing more robust AI-generated code detection methods under realistic distribution shifts.

  • Takeaways & Limitations

    The benchmark excludes some unusually verbose, complex, short, or poorly structured code and covers only nine programming languages, limiting diversity and out-of-scope generalization.

Abstract

from arXiv · show

Large language models (LLMs) are increasingly capable of generating functional source code, raising concerns about authorship, accountability, and security. While detecting AI-generated code is critical, existing datasets and benchmarks are narrow, typically limited to binary human-machine classification under in-distribution settings. To bridge this gap, we introduce $\emph{AICD Bench}$, the most comprehensive benchmark for AI-generated code detection. It spans $\emph{2M examples}$, $\emph{77 models}$ across $\emph{11 families}$, and $\emph{9 programming languages}$, including recent reasoning models. Beyond scale, AICD Bench introduces three realistic detection tasks: ($\emph{i}$)~$\emph{Robust Binary Classification}$ under distribution shifts in language and domain, ($\emph{ii}$)~$\emph{Model Family Attribution}$, grouping generators by architectural lineage, and ($\emph{iii}$)~$\emph{Fine-Grained Human-Machine Classification}$ across human, machine, hybrid, and adversarial code. Extensive evaluation on neural and classical detectors shows that performance remains far below practical usability, particularly under distribution shift and for hybrid or adversarial code. We release AICD Bench as a $\emph{unified, challenging evaluation suite}$ to drive the next generation of robust approaches for AI-generated code detection. The data and the code are available at https://huggingface.co/AICD-bench}.

1 Introduction

LLMs can generate functional, production-ready code at scale, making reliable AI-generated code detection important for integrity, plagiarism prevention, and security. AICD Bench addresses fragmented, narrow evaluations with a large benchmark and three realistic detection tasks, while current methods generalize poorly out of distribution.

  • LLMs generate syntactically and semantically correct functional code at scale, creating a critical need for reliable detection.
  • Existing datasets typically cover few languages, limited LLMs, and nonreasoning generations, restricting conclusions about real-world generalization.
  • Detectors must handle unseen models, languages, domains, and adversarial code, but existing evaluations rarely test these shifts jointly.
  • AICD Bench evaluates detection across generator families, programming languages, and adversarial strategies through robust binary classification, model family attribution, and fine-grained human–machine classification.
  • 2M samples span 77 generators and 9 programming languages, with standardized splits, protocols, and evaluation scripts for reproducible research.
  • Current methods generalize poorly in out-of-distribution settings, underscoring the benchmark’s challenge.

2 Related Work

Prior code-authorship resources largely target individual-model attribution or simplified binary detection, leaving standardized evaluation across diverse and realistic conditions insufficient. AICD Bench responds to this gap with broader dimensions of complexity and deployment-oriented tasks.

  • Individual-model attribution becomes increasingly impractical as deployed LLMs proliferate, motivating scalable attribution at the model-family level.
  • Existing code-detection resources often lack standardized tasks, splits, and evaluation protocols, limiting their status as comprehensive benchmarks.
  • CodeMirage provides a benchmark but focuses exclusively on binary human-versus-AI classification, with fine-tuned CodeT5+ exceeding 80% F1 on unseen generators and paraphrased inputs.
  • The remaining gap concerns systematic evaluation across cross-model, cross-language, cross-domain, hybrid, and adversarial settings that reflect realistic deployment.

3 Motivation Behind the Task Design

AICD Bench designs three progressively realistic tasks because binary in-distribution detection misses distribution shifts, model-family attribution needs, and hybrid or adversarial code. The tasks target robustness, scalable attribution, and fine-grained authorship distinctions.

  • Together, the tasks progressively extend detection beyond the conventional human-versus-machine distinction.
  • Task 1: Robust Binary Classification: Binary detection remains fundamental, but Task 1 tests generalization across unseen languages and domains through progressively challenging out-of-distribution splits.
  • Task 2: Model Family Attribution: Task 2 attributes code to model families rather than individual models, using shared architectures and training regimes as the grouping principle.
  • Task 3: Fine-Grained Human–Machine Classification: Task 3 distinguishes fully human, fully machine-generated, hybrid, and adversarial code to capture realistic LLM-assisted development.

4 Data

AICD Bench expands prior resources with broader languages, generators, reasoning-capable models, human and hybrid samples, and standardized construction procedures. Its data support robustness testing across languages, domains, authors, and code-authorship categories.

  • AICD Bench extends DroidCollection with two additional languages, PHP and Rust, and a diverse set of newer LLMs including reasoning-oriented models.
  • 50K human-written samples come from The Heap, while 100K hybrid examples come from Swallow Code’s LLaMA 3.3 70B rewrites of human-authored programs.
  • AICD Bench improves dataset scale, generator diversity, language coverage, and coverage of reasoning-capable models relative to prior resources.
  • The dataset filters unparsable, overly simple or complex, non-code, auto-generated, and non-English files to reduce distributional artifacts.
  • Min-Hash de-duplication with a 0.8 similarity threshold is applied jointly to original and newly generated samples.
  • Task 1 uses four splits spanning seen and unseen languages and domains, while model-family attribution evaluates seen and unseen generators across 77 models.
  • The benchmark also includes four code categories—human, machine-generated, hybrid, and adversarial—and a 1M-example test set combining in-domain and out-of-domain sources.

5 Experiments and Results

Across the three tasks, detector performance is limited by distribution shift, fine-grained authorship ambiguity, and hybrid or adversarial code. Neural models generally lead on attribution and fine-grained classification, but even the strongest results remain challenging for deployment.

  • Task 1: Robust Binary Classification: Classical SVM and Logistic Regression with TF-IDF outperform deep models on the distribution-shifted binary task, while random and majority baselines score even higher.Language-independent cues such as variable naming patterns help explain TF-IDF’s effectiveness; AST features can reduce performance when paired with TF-IDF.
  • Task 1: Robust Binary Classification: Domain shift is the dominant source of error, with unseen-domain performance nearly as poor as performance under simultaneous language and domain shifts.Coding styles and conventions vary across domains, limiting transfer even when the programming language is familiar.
  • Task 2: Model Family Attribution: Model Family Attribution is the hardest task, with the lowest peak and average performance because it requires discrimination among 12 classes.Previously unseen generators are particularly difficult to attribute, indicating variation within families and limited transferability of learned stylistic signals.
  • Task 2: Model Family Attribution: ModernBERT nearly perfectly identifies human and OpenAI samples, but Gemini is often confused with Gemma and StarCoder is frequently classified as human-written.These errors are associated with low within-family variability for some classes and shared design or training characteristics for others.
  • Task 3: Fine-Grained Human-Machine Classification: Fine-grained classification remains difficult despite higher scores than the other tasks: the best Macro-F1 is 61.65, with persistent degradation on out-of-domain, hybrid, and adversarial samples.Hybrid examples are often labeled fully AI-generated, while adversarial examples are frequently classified as either AI-generated or human-written.
  • Zero-Shot LLM Experiments: Zero-shot chain-of-thought prompting consistently improves performance across tasks, but Task 2 remains highly challenging and Task 3 remains below trained detectors.Gemini with chain-of-thought prompting achieves the highest Task 1 score among the evaluated models.
  • Error Analysis: Error analysis finds asymmetric Task 1 failures, strong domain sensitivity in Task 3, and task-specific feature biases that emphasize surface templates or mixed code-documentation contexts.Codestyle mixing is the dominant signal for identifying hybrid code, while deep models overemphasize competitive-programming artifacts in Task 1.

6 Conclusion and Future Work

AICD Bench expands AI-generated code detection through scale, diversity, and three realistic evaluation tasks. Experiments show that detection remains far from solved, motivating standardized evaluation and new robustness-oriented methods.

  • Conclusion: AICD Bench comprises 2M code samples from 77 generators across 9 programming languages and introduces three complementary detection tasks.The tasks cover robust binary classification under distribution shifts, model family attribution, and fine-grained human–machine classification.
  • Conclusion: Detectors struggle to generalize across programming languages, domains, and generator families, with particularly poor performance on hybrid and adversarial code.ModernBERT leads on two of the three tasks, but even the strongest models remain below practical requirements.
  • Conclusion: A simple SVM outperforms deep learning models on robust binary classification yet still performs below random guessing.This result highlights severe generalization challenges in the benchmark’s distribution-shift setting.
  • Future Work: AICD Bench provides unified tasks, splits, and protocols for reproducible comparison and systematic progress beyond in-distribution binary detection.The benchmark is intended to redirect evaluation toward realistic, deployment-driven challenges.
  • Future Work: Future work will investigate adversarial and domain-adaptive training strategies, including data augmentation, invariant representations, and curriculum-based adaptation.The authors also plan meta-models that promote generalization across languages, domains, and generator families.

Limitations

The benchmark’s validity is constrained by contamination risk, inherited dataset bias, limited code diversity, and finite language coverage. The authors propose private evaluation, broader data sources, relaxed filtering, and expanded language coverage.

  • Potential Data Contamination: AICD Bench may become saturated as models are tuned to its distributions, undermining its intended assessment of out-of-distribution robustness.The authors plan a private evaluation split with hidden labels to mitigate this risk.
  • Reliance on DroidCollection: The benchmark remains influenced by DroidCollection’s distribution, so observed trends may reflect inherited skews rather than real-world code distributions.The authors also note that Droid generators cannot be directly evaluated on AICD Bench.
  • Constraints on Code Diversity: Filtering by AST depth, line length, and code size excludes some verbose, complex, short, or poorly structured code found in practice.This may limit coverage of syntactic, structural, and stylistic variability in human-written code.
  • Constraints on Code Diversity: The benchmark covers nine programming languages, forming a finite scope that does not test generalization to less mainstream or domain-specific languages.Future iterations will expand language coverage and relax filtering thresholds.

Ethical Statement

AICD Bench is positioned as a research resource for transparent, accountable AI-assisted programming, while acknowledging privacy, bias, misuse, and licensing constraints. The dataset uses public sources, restricts usage, and avoids releasing exploit-oriented prompt details.

  • Data and Privacy: AICD Bench is constructed from public research corpora and documented model outputs without private repositories, paywalled content, or sensitive personal identifiers.The authors state that upstream licenses and original attributions are preserved where required.
  • Responsible Use: The benchmark supports research on plagiarism detection, compliance, and provenance auditing, while misuse risks include detector-evasion development.The authors therefore withhold exploit-oriented prompt details and document current detector limitations.
  • Bias: Human- and LLM-authored code may inherit biases from data availability, platform popularity, community conventions, and training corpora.Diverse sampling is used as mitigation, but perfect representativeness is not guaranteed.
  • Broader Impact: AICD Bench aims to move detection beyond oversimplified binary classification toward practical robustness and more accountable AI-assisted programming.The broader-impact goal is to support more transparent and trustworthy software engineering practices.
  • Usage: The dataset is intended exclusively for academic and research purposes, with commercial use prohibited without prior written consent.Users must follow ethical, privacy, intellectual-property, and legal constraints.

C Data Distribution

The dataset’s code exhibits properties associated with structured real-world projects, while its distribution and classifier prompts cover multiple origins and model families. The supplied materials also define prompts and heuristic signals for origin classification.

  • Code Properties: Most AST-depth values fall between 10 and 15, indicating structured but not overly nested control flow.The dataset’s alphanumeric fraction peaks at 0.65, and average line length clusters between 20–60 characters.
  • Classification Prompts: The binary classifier prompt asks for a one-word Human-or-AI origin decision.The family-attribution prompt instead selects among human and named generator families.
  • Classification Prompts: The fine-grained prompt distinguishes Human, AI, Hybrid, and Adversarial origins.Adversarial code is described as generated to mimic human code and fool detectors.
  • Heuristic Signals: Origin classification uses signals from language and libraries, structure, naming, comments, type annotations, formatting, boilerplate, and code artifacts.The listed cues contrast template-like or verbose patterns with partial implementations, TODOs, inconsistent styles, and pragmatic hacks.
  • Heuristic Signals: Candidate profiles associate generator families with characteristic coding patterns, while human code is described through mixed styles, partial implementations, TODOs, and pragmatic hacks.The profiles are used as best-fit heuristics rather than as formal guarantees.

D Task 1 Detailed Performance

Task 1 performance is strongly affected by domain shift and training-distribution mismatch. Classical models can generalize through language-independent stylistic cues, while deep models show sharper out-of-distribution degradation.

  • Distribution shifts: Domain shift harms performance more than language shift, and unseen-domain performance degrades markedly.When both domain and language are unseen, performance is no worse than with only the domain unseen.
  • Distribution shifts: Deep models achieve near-perfect in-distribution accuracy but drop sharply out of distribution, even when only the language is unseen.Classical models exhibit a smaller performance gap across these settings.
  • Language-wise performance: Models generally perform best on Python, while PHP yields the lowest performance because its syntax differs from the other languages.Python is the most prevalent language in the training set.
  • Classical baselines: TF-IDF SVM generalizes well to unseen languages by capturing stylistic regularities rather than language-specific syntax.AI code tends to use verbose prompt-echoing identifiers, whereas human code uses shorter organic identifiers.
  • Model comparison: Classical models achieve nearly zero macro F1-score on out-of-domain generators, while ModernBERT performs best among the deep models.TF-IDF is the strongest classical representation across the reported comparisons.

F Task 3 Detailed Performance

Task 3 exposes substantial weaknesses in fine-grained human-machine classification. Deep models perform well in-domain but poorly out-of-domain, while adversarial and hybrid samples remain difficult to distinguish.

  • Performance: Deep models exceed 71% in-domain performance but fall below 25% out of domain.CatBoost is the only classical model reported to use AST features effectively in at least in-domain settings.
  • Confusion patterns: Classical models mostly predict a single class, whereas deep models more often learn correct class assignments.The classical-model failure is reflected in their confusion matrices.
  • Confusion patterns: Adversarial samples are often classified as human- or AI-written, while hybrid samples are frequently classified as AI-generated.These errors show difficulty separating similar fine-grained categories.
  • Failure cases: Task 3 errors concentrate on boilerplate code and on confusions among AI-generated, hybrid, and adversarial categories.These examples are presented as recurring baseline failure modes.

H SHAP analysis

The SHAP analysis uses token-level visualizations to compare correct and incorrect predictions in Tasks 1 and 3. The figures emphasize prediction-attribution patterns, including hybrid-class cases in Task 3.

  • Task 1: Task 1 SHAP visualizations compare token-level attributions for correct and incorrect predictions.The comparison is presented as representative of broader attribution patterns.
  • Task 3: Task 3 SHAP visualizations compare correct and incorrect predictions for the hybrid class.The analogous hybrid-case comparison is shown in Figure 11.
  • Scope: The analysis reports no useful attribution findings for the other tasks and classes.Additional examples were manually inspected alongside the displayed figures.
Loading 2602.02079v1…