Beyond Global Scalars: Synergizing Token-Level Statistics and Deep Semantics for Adversarial AIGC Text Detection

Peiming Li; Yifan Wang; Zhiyuan Hu; Shiyu Li; Zheng Wei; Yang Tang

Source-linked AI summary

Beyond Global Scalars: Synergizing Token-Level Statistics and Deep Semantics for Adversarial AIGC Text Detection

Peiming Li, Yifan Wang, Zhiyuan Hu, Shiyu Li, Zheng Wei, Yang Tang

arXiv:2608.28009v1Aug 28, 2026cs.CL

TL;DR

Machine-generated text detection remains vulnerable because global statistical scalars lose local signals and semantic models can overfit to manipulable fingerprints. The paper introduces MOSAIC and NeuroStat, which combine broad adversarial evaluation with token-level probabilistic and semantic representations. NeuroStat achieves state-of-the-art robustness against severe adversarial spoofing and statistical hijacking, though its evaluation remains limited in language and domain scope.

Problem
Existing training-free and training-based detectors have complementary but adversarially vulnerable reliance on global statistical scalars or semantic fingerprints.
Method
NeuroStat uses a single CausalLM backbone to extract uncompressed token-level probabilistic trajectories and deep semantic representations, fused through MSRM.
Results
NeuroStat achieves state-of-the-art robustness against severe adversarial spoofing and statistical hijacking on MOSAIC.
Takeaways & Limitations
MOSAIC establishes a full-spectrum benchmark, while NeuroStat provides a unified detection paradigm spanning probabilistic mechanics and contextual semantics.
Takeaways & Limitations
Evaluation is limited to English texts in specific domains, leaving multilingual, low-resource, code-generation, and legal-document settings unexplored.

Abstract

from arXiv · show

The rapid evolution of large language models necessitates robust machine-generated text detection. Existing paradigms typically follow two isolated tracks. Training-free methods rely on global statistical scalars such as perplexity, while training-based methods utilize semantic hidden states. Both approaches exhibit fundamental vulnerabilities in adversarial scenarios. Global scalars act as lossy compressions that obscure local probabilistic burstiness in interleaved texts, whereas pure semantic models overfit to specific fingerprints and remain susceptible to spoofing. To expose these flaws, we introduce MOSAIC, a comprehensive adversarial benchmark comprising 16000 samples across a full-granularity attack spectrum. To address these challenges, we propose NeuroStat, an end-to-end framework bridging the statistical and semantic gap. NeuroStat captures uncompressed token-level probabilistic logits alongside deep semantic hidden states from a single causal language model backbone. We fuse these heterogeneous signals through Macro-State Residual Modulation, which adaptively calibrates local convolutional features using global uncertainty indicators. Orthogonal and contrastive losses further ensure the learning of complementary representations. Extensive experiments demonstrate that NeuroStat maintains exceptional robustness on MOSAIC compared to the severe degradation of state-of-the-art methods, establishing a new standard for adversarial text detection. Code and the MOSAIC benchmark are available at https://github.com/TencentBAC/NeuroStat.

1 Introduction

Machine-generated text detection faces adversarial weaknesses in both global-statistical and semantic approaches. MOSAIC exposes these vulnerabilities, while NeuroStat combines token-level statistical trajectories with semantic representations for robust detection.

Motivation: Existing training-free methods compress token probabilities into global scalars, while training-based methods capture semantic styles vulnerable to adversarial manipulation.Interleaved human-AI writing can dilute local statistical signals, and style manipulation can disrupt semantic patterns.
Benchmark: MOSAIC provides a full-spectrum adversarial benchmark with 8 attack categories and 36 sub-methods.Its cross-allocation mechanism spans six frontier LLMs to reduce model-specific fingerprint bias.
NeuroStat: NeuroStat extracts token-level statistical trajectories and deep semantic representations from a single CausalLM backbone.The framework bridges the complementary probabilistic and semantic views used by training-free and training-based detection.
NeuroStat: Macro-State Residual Modulation dynamically amplifies local probability anomalies using global uncertainty indicators.Orthogonal and contrastive objectives encourage discriminative, non-redundant representations.
Results: NeuroStat maintains high accuracy across diverse domains, models, and attack granularities, including extreme adversarial scenarios.The authors report state-of-the-art robustness against adversarial attacks.

2 Related Work

Prior detection research separates probabilistic and semantic approaches, while adversarial benchmarks have expanded only gradually. The paper positions MOSAIC as a broader, multi-model test of adversarial robustness.

Training-Free Detection Methods: Training-free detectors use probabilistic metrics but compress sequential token dynamics into lossy global scalars.This compression makes them vulnerable to dilution in interleaved human-AI texts and statistical hijacking.
Training-Based Detection Methods: Training-based detectors capture semantic artifacts but can overfit to specific semantic fingerprints despite near-perfect in-domain accuracy.NeuroStat instead combines probabilistic trajectories with semantic representations.

3 Methodology

NeuroStat bridges probabilistic and semantic detection by extracting token-level trajectories and hidden states from one CausalLM, then fusing complementary branch representations with adaptive modulation and auxiliary objectives.

Dual-branch architecture: A single CausalLM forward pass produces the full vocabulary logit matrix and last-layer hidden states for separate statistical and semantic branches.The resulting signals support synergistic feature extraction without multiple model invocations.
Probabilistic Trajectories Branch (TF): The TF branch preserves shifted log-probability trajectories and processes them with a hierarchical 1D-CNN to detect multi-scale, position-aware anomalies.This retains local probabilistic structure instead of compressing token probabilities into a global scalar.
Macro-State Residual Modulation: MSRM uses mean entropy and mean log-rank as global uncertainty indicators to adaptively modulate local CNN features.The learned gate has a Pearson correlation of −0.62 with global entropy on held-out samples.
Semantic Artifacts Branch (TB): The TB branch applies learnable attention pooling to hidden states, assigning higher weights to semantically discriminative tokens before projection.This avoids relying solely on the last token and accommodates varying sequence lengths.
Training Objectives: Cross-entropy, supervised contrastive, and orthogonal objectives jointly train the fused classifier for discriminative and non-redundant representations.The orthogonal penalty reduces mean squared cosine similarity from 0.358 without LOrth to 0.018 with LOrth.

4 The MOSAIC Benchmark

MOSAIC is a 16000-pair adversarial benchmark designed to expose machine-generated text detector weaknesses through 36 prompts spanning eight linguistic granularities and cross-model generation.

Benchmark Construction: MOSAIC contains 16000 human-AI text pairs generated through a pipeline emphasizing multigranularity attacks and cross-model generation.
Attack Coverage: Its taxonomy includes 36 distinct adversarial prompts across eight linguistic granularities, expanding coverage beyond existing benchmarks.Existing datasets such as RAID and MIRAGE cover at most 11 attacks across two categories.
Attack Coverage: The attack spectrum includes interleaved human-AI text, statistical hijacking, translation laundering, paraphrase and polish, and prompt injection or role-playing.
Cross-model Design: MOSAIC uses random cross-allocation across six frontier LLMs to reduce generator-specific fingerprint bias.The six models are GLM-5.0, GPT-5.4, Gemini-3.1-Pro, MiniMax-M2.7, Claude-Opus-4-6, and Kimi-K2.5.
Cross-model Design: Within length strata, 36 adversarial prompts are uniformly assigned and each prompt-seed pair is allocated to one of the six LLMs.This model-agnostic design targets intrinsic human-AI distinctions rather than memorized generator styles.

5 Experiments

NeuroStat is evaluated across generalization and adversarial settings, where it maintains strong performance across diverse tasks and attacks. Qualitative analyses further show compact fused representations and improved confidence calibration.

Datasets and Tasks: NeuroStat is evaluated on MIRAGE, MOSAIC, and ImBD Test Set, covering generalization, adversarial robustness, and standard detection.MIRAGE spans Generate, Polish, and Rewrite tasks; MOSAIC covers 36 attacks across 8 categories; ImBD covers human-written and machine-polished texts across three domains.
Baselines: The evaluation compares NeuroStat with 11 state-of-the-art MGTD methods across training-free and training-based paradigms.The baselines include likelihood, entropy, DetectGPT, RoBERTa, ImBD, and DetectAnyLLM, with Binoculars additionally reported on MOSAIC.
Adversarial Robustness on MOSAIC: 72.4 robustness is maintained by NeuroStat under Character & Encoding attacks, while DetectAnyLLM falls to near-random guessing at 52.7.Overall, NeuroStat achieves 83.4 AUROC with Qwen2-0.5B and 58.1 TPR@5% with Qwen3.5-0.8B, up to 17.6 points above the previous SOTA on that metric.
Qualitative Analyses: Fused representations form highly compact, linearly separable clusters, while NeuroStat also achieves lower ECE than DetectAnyLLM.The TF branch is entangled and the TB branch partially overlaps; the fused space shows a large-margin separation, and predicted confidence more closely tracks accuracy.

6 Ablation Studies

Ablations show that NeuroStat’s gains depend on MSRM and complementary auxiliary objectives rather than simple feature concatenation. The studies examine architectural components, branch fusion, and loss design.

Component Ablation: Ablation studies evaluate AUROC across three text manipulation types on the MIRAGE DIG benchmark using Qwen2-0.5B.The experiments progressively integrate architectural modules into a baseline sequence classifier.
Component Ablation: MSRM substantially outperforms naive TF-feature concatenation on challenging text manipulations.The standard classifier performs reasonably on Generate but struggles on complex manipulations; MSRM produces substantial improvements when added progressively.
Component Ablation: MSRM’s residual gating amplifies local probability anomalies conditioned on global uncertainty, supporting detection of sophisticated text revisions.This mechanism is presented as critical beyond simple feature concatenation.
Auxiliary Losses: LSupCon enlarges discriminative margins, whereas LOrth reduces representational redundancy between the TF and TB branches.Training with Cross-Entropy alone is suboptimal, and the combined objectives produce gains exceeding their individual improvements.
Auxiliary Losses: The combination of supervised contrastive and orthogonal penalties produces a synergistic effect beyond either auxiliary loss alone.All variants use the full architecture and differ only in loss configuration.

7 Conclusion

The paper presents NeuroStat as an end-to-end bridge between statistical and semantic detection paradigms, preserving token-level probabilistic trajectories while using MSRM for fusion. It also introduces MOSAIC as a fine-grained adversarial benchmark and reports state-of-the-art robustness.

Conclusion: NeuroStat bridges Training-Free and Training-Based paradigms by preserving uncompressed probabilistic trajectories and using MSRM to capture local probability anomalies.The framework avoids lossy global-scalar compression while combining statistical and semantic signals.
Conclusion: MOSAIC provides 36 fine-grained attacks across 8 categories and 6 frontier LLMs for adversarial machine-generated text detection.The benchmark is designed to evaluate robustness against severe adversarial spoofing and statistical hijacking.
Conclusion: NeuroStat achieves state-of-the-art robustness against severe adversarial spoofing and statistical hijacking.The paper frames this result as a new paradigm for synergizing statistical mechanics and semantic artifacts in AIGC detection.

Limitations

The evaluation is limited to English texts in selected domains, while closed-source APIs require surrogate scoring and the full-logit design adds computational overhead.

Evaluation is constrained to English texts from news, creative writing, and biomedical abstracts, leaving multilingual and specialized domains unexplored.The authors specifically identify low-resource languages, code generation, and legal documents as future evaluation settings.
Closed-source generators that expose no full log-probability distributions require a local open-source surrogate backbone for probabilistic scoring.The main MOSAIC evaluation includes this surrogate setting for four closed-source generators.
The surrogate setting produces a 3 to 7 AUROC-point gap between open and closed generators, although NeuroStat still surpasses the strongest baseline on every closed-source target.
Full-vocabulary logit storage and processing add roughly 10% latency and memory overhead relative to DetectAnyLLM.The authors suggest vocabulary truncation or top-k logit approximation as possible ways to reduce deployment costs.

Ethics Statement

The paper uses licensed, non-PII datasets and safety-constrained adversarial prompts, while acknowledging detector dual use and documenting benchmark construction and evaluation procedures.

Human-written source datasets contain news articles, scientific abstracts, and creative stories without PII or potentially harmful material.The datasets are used according to their original licenses and intended research purposes.
MOSAIC prompts test statistical and semantic robustness through transformations such as paraphrasing, synonym swapping, and formatting without eliciting toxic or offensive content.
The study uses open-source models and commercial APIs in compliance with terms permitting AI-safety and detection research.
Because false positives can cause unjust punitive actions, NeuroStat is intended as an assistive research signal rather than sole evidence for disciplinary decisions.
The paper documents implementation, benchmark construction, non-adversarial evaluation, ablations, sample sensitivity, surrogate deployment, and computational-cost analyses.
MOSAIC construction yields 16,000 human-AI pairs from filtered, length-stratified seeds rewritten by six frontier LLMs across 36 attack sub-methods.The protocol uses a four-stage filtering pipeline and balanced allocation rather than a full cross-product.
Postnormalization performance remains separated, with DetectAnyLLM at 61.4 AUROC and NeuroStat at 74.9 after controlling for Unicode noise.

E Training-Sample Sensitivity

Training-sample sensitivity shows that NeuroStat generalizes to unseen MOSAIC attacks with relatively few clean training pairs, while performance saturates at larger budgets.

The 500-pair budget matches ImBD’s training size for fair comparison rather than representing an assumed absolute sufficiency.
NeuroStat is trained only on clean, non-adversarial ImBD pairs and never observes MOSAIC’s 36 attack types during training.The authors attribute MOSAIC robustness to the architecture’s inductive bias rather than attack-specific exposure.
Performance saturates around 2,000 to 5,000 pairs, indicating diminishing returns beyond the 500-pair main-experiment setting.
NeuroStat improves MOSAIC AUROC by 6.3 points and TPR@5% by 17.6 points over DetectAnyLLM.

G Computational Cost Analysis

The computational analysis measures NeuroStat against representative training-free and training-based baselines under a fixed GPU, batch-size, sequence-length, and training-budget configuration.

Measurements use one NVIDIA H20 GPU with batch size 8, sequence length 512, and five training epochs on 500 pairs.Reported metrics include trainable parameters, peak memory, per-sample latency, throughput, and training time.
NeuroStat adds 0.6GB peak memory and 2.7ms per-sample latency relative to DetectAnyLLM, roughly 10% overhead on both metrics.The added cost mainly comes from the 1D-CNN branch and MSRM module.