PaperlayerView exact revision on arXiv

Source-linked AI summary

Robust Detection of LLM-Generated Text under Contamination

Jiaxun Li, Saptarshi Chakraborty, Ambuj Tewari

arXiv:2609.29935v1stat.MLcs.LG

TL;DR

LLM-generated text can be difficult to distinguish from human writing, especially after editing or contamination. The paper models these sources and characterizes when reliable detection is possible, then studies clipping for existing detectors. Clipping improves robustness in the theory and experiments, though gains vary and may reduce clean-text detection.

  • Problem

    Editing and mixed human–machine contributions can weaken detection, raising the question of when reliable detection remains possible under contamination.

    Source: §1 · p. 1

  • Method

    The paper models text as finite-order Markov sources with Huber contamination, characterizes a detection boundary, and studies lower clipping for likelihood-ratio tests and general additive scores.

    Source: §1 · pp. 1–2, §4 · p. 5

  • Results

    The theory identifies conditions for impossible detection and for vanishing worst-case errors, while experiments show clipping can improve robustness beyond the theoretical model with gains varying by detector and modification.

    Source: §6 · pp. 10–11

  • Takeaways & Limitations

    Clipping is a simple modification that can strengthen existing detectors, but its gains depend on the detector and modification mechanism and may reduce clean-text detection.

    Source: §6 · p. 11

    The guarantees are asymptotic, rely on finite-state assumptions, leave required text lengths unresolved, and the boundary-achieving test requires knowledge of the human class and contamination level.

    Source: §6 · p. 11

Abstract

from arXiv · show

We study the detection of LLM-generated text under editing and contamination. Modeling human and machine text as finite-order Markov processes with Huber contamination, we characterize an exact boundary for reliable detection under our assumptions. Detection is impossible when contamination is sufficiently large relative to clean-source separation. Below this boundary, a collection of clipped likelihood-ratio tests achieves vanishing worst-case errors. This construction motivates clipping as a simple modification of existing statistical detectors. For a broad class of additive scores, we identify conditions under which the clipped test is consistent while the raw test's worst-case power tends to zero. We evaluate seven detectors across three datasets and three generation models, and on the RAID benchmark. Clipping improves robustness in both studies, with gains varying across detectors and contamination settings. For example, at a target false-positive rate of 5\%, clipping improves the log-likelihood--log-rank ratio (LRR) detector's true-positive rate by a median of 8.3 percentage points in the controlled study and 2.1 and 4.3 points in rate- and attack-specific RAID evaluations, respectively.

1 Introduction

The paper asks when LLM-text detection survives editing and contamination, then develops clipping as a way to make statistical detectors more robust. Its theory and experiments address different settings, with empirical gains varying by detector and modification.

1 Introduction

  • The analysis models human and machine text as finite-order Markov processes and modifications through Huber contamination, where arbitrary token distributions mix with the target LLM.The human source is a class of transition kernels, while the target LLM has a fixed kernel.Source: §1 · p. 1
  • Below the contamination boundary, combined lower-clipped likelihood-ratio tests achieve vanishing worst-case false-positive and false-negative probabilities as text length grows.At or above the boundary, contamination can make machine text reproduce an admissible human source exactly.Source: §1 · pp. 1–2
  • Clipping limits extreme token contributions; under identified conditions, clipped additive tests remain consistent while raw tests’ worst-case power tends to zero.This motivates clipping existing statistical detectors.Source: §1 · p. 2
  • At 20% replacement and a 5% target false-positive rate, clipping improves mean detection rates for all seven methods under random and tail replacement.In the controlled study, Binoculars improves by 27 percentage points under random replacement; RAID gains vary by detector and attack.Source: §1 · p. 2

1.1 Related Work

  • Prior work studies detection methods, editing attacks, and detection limits; this paper’s analysis instead treats source contamination and extends robust testing to Markov text and general additive scores.The related work distinguishes this setting from watermark detection under human edits.Source: §1.1 · p. 2

2 Preliminaries

The paper represents clean human and target-LLM text as finite-order Markov sources, then models modifications as history-dependent contamination. It evaluates detection through worst-case errors and a robust minimax Stein exponent.

2.1 Source and contamination model

  • Human text is a composite class of transition kernels, while the target LLM is represented by one fixed kernel; both are time-homogeneous Markov processes of order K.The history state contains the preceding K tokens needed to determine the next-token distribution.Source: §2.1 · p. 3
  • Under the alternative, each token distribution mixes the target LLM with an arbitrary history-dependent contamination distribution at rate ϵ.The contamination distribution may depend on the preceding text and need not belong to the human class.Source: §2.1 · p. 3
  • The model assumes a nonempty compact human-kernel class with shared token support and a strongly connected, aperiodic history graph.These conditions ensure that a single token cannot identify the source with certainty and that every history has positive long-run frequency under each human kernel.Source: §2.1 · pp. 3–4

2.2 Testing criterion

  • Detection is assessed by worst-case false-positive and false-negative probabilities over admissible sources and contamination strategies.The robust minimax Stein exponent describes how quickly longer texts improve detection while false alarms vanish; a larger exponent means an easier problem.Source: §2.2 · p. 4

3 Possibility and impossibility of robust detection

The section characterizes when contamination makes robust detection impossible and when clean-source separation allows the sources to remain distinguishable. It relates the boundary to a directional separation measure and motivates clipped likelihood-ratio tests.

3 Possibility and impossibility of robust detection

  • D0 measures the smallest worst-case relative excess of machine probabilities over human probabilities and equals zero exactly when the target kernel belongs to the human class.It is a directional measure of clean-source separation.Source: §3 · p. 4
  • The paper interprets 1 − e^(−D0) as the smallest replacement probability that can make machine text indistinguishable from one human source.A larger D0 means more editing is needed.Source: §3 · p. 4
  • When contamination is sufficiently large, it can make the machine source reproduce an admissible human source exactly; otherwise the sources remain distinguishable.Figure 1 illustrates this possibility–impossibility boundary.Source: §3 · p. 5, Figure 1 · p. 5
  • The boundary-achieving construction combines clipped likelihood-ratio tests for representative human sources, but implementing it requires knowledge of the human-kernel class and contamination level.This requirement motivates applying clipping to existing token-level detection scores instead.Source: §3 · p. 5

4 Robustifying existing detectors by clipping

The section studies lower clipping of additive token scores as a way to limit extreme evidence against machine generation. Under stated conditions, clipping can preserve detection where raw tests lose worst-case power, with a trade-off in retained human evidence.

4 Robustifying existing detectors by clipping

  • The paper frames clipping as a robust-testing approach and studies decision rules that average token-level scores, including likelihood- and rank-based methods, Binoculars, and LRR.Larger scores are oriented to favor machine-generated text.Source: §4 · p. 5
  • Lower clipping replaces token scores below a floor with that floor, limiting unusually negative scores that can outweigh the rest of the text.It can also remove genuine evidence of human authorship.Source: §4 · p. 6, Figure 2 · p. 6
  • The guarantees apply to additive scores under assumptions including stable average machine scores, possible low-scoring tokens, and higher average machine than human scores.The clipping bound ϕ + r is one convenient choice; other clipping levels can also ensure consistency.Source: §4 · pp. 6–7
  • When ϵ− < ϵ+, clipping restores worst-case power tending to one throughout (ϵ−, ϵ+), while the raw test’s worst-case power tends to zero if its worst-case false-positive probability vanishes.The clipped test is consistent below ϵ+; above ϵ−, the raw test loses worst-case power.Source: §4 · pp. 6–7
  • The clipping floor balances protection against contamination with loss of human evidence: guaranteed mean separation improves when ϵ > ρ0.Raising the floor to ϕ + r increases the guaranteed contamination contribution by ϵr, while increasing the largest stationary human mean by at most ρ0r.Source: §4 · p. 7

5 Experiments

Across a controlled contamination study and the RAID benchmark, clipping generally improves detection, though benefits vary by detector and modification. The experiments compare seven detectors and use separate tuning, calibration, and test sets.

5.1 Detectors and evaluations

  • The evaluation uses seven statistical detectors, orienting scores so larger values favor machine-generated text and clipping token scores before averaging.LRR clips numerator and denominator contributions; Binoculars clips numerator contributions only.Source: §5.1 · pp. 7–8, Table 1 · p. 8

5.2 Controlled contamination study

  • The controlled study crosses three datasets with three generators and tests random and tail replacement; RAID covers diverse domains, generators, and attacks.Both studies use separate tuning, calibration, and test sets.Source: §5.2 · p. 8, §5.1 · p. 8, §5.3 · p. 9
  • At 20% replacement, all seven detectors improve mean TPR under both constructions; Binoculars rises from 58.8% to 85.7% under random replacement, and its curve area improves in all nine settings.Clipping lowers mean clean TPR for five detectors; under tail replacement, rank rises from 0.3% to 34.3%.Source: §5.2 · p. 9, Table 2 · p. 9, Figure 3 · p. 9

5.3 RAID benchmark

  • Across three RAID rate intervals, rank gains around 20 percentage points on average; LRR, log rank, entropy gap, and Binoculars improve in all three.Log likelihood improves only in the lowest interval, while entropy changes little.Source: Table 3 · p. 10, §5.3 · p. 10
  • For RAID attacks, all seven detectors improve under case changes; paraphrasing gains concentrate in LRR and rank, while alternative spelling benefits six detectors.Entropy gap gains 3.42 points and log rank 2.21 points under case changes; log likelihood is unchanged under alternative spelling.Source: §5.3 · p. 10

6 Conclusion

Clipping improves robustness in the experiments, with gains depending on the detector and modification and sometimes reducing clean-text detection. The paper also characterizes when reliable detection is possible under contamination and identifies limits of its guarantees.

6 Conclusion

  • Under the finite-order Markov model with history-dependent Huber contamination, detection is impossible at or above the boundary where contamination can reproduce an admissible human source.Below the boundary, lower-clipped likelihood-ratio tests achieve vanishing worst-case errors.Source: §6 · p. 10
  • For general additive scores, explicit conditions let clipping preserve consistent detection where the raw test’s worst-case power tends to zero.Source: §6 · p. 10
  • Experiments across three datasets and three generators, plus RAID, show clipping can improve robustness beyond the theoretical contamination model, with gains varying by detector and modification.The gains may come at the cost of reduced clean-text detection.Source: §6 · p. 11
  • The theoretical guarantees are asymptotic and rely on finite-state assumptions, so the text lengths needed for reliable detection remain unresolved.The boundary-achieving test also requires knowledge of the human class and contamination level.Source: §6 · p. 11

A Uniform ergodicity of the human-kernel family

The appendix establishes uniform stability for the human-kernel family and supplies the auxiliary results behind the detection proof: characterizing contamination, deriving clipped likelihood scores, and reducing human kernels to finitely many representatives.

A Uniform ergodicity of the human-kernel family

  • Every admissible human chain is irreducible, aperiodic, and uniformly geometrically ergodic, yielding uniform convergence of bounded empirical averages across kernels and initial states.The empirical-average deviation bound is a finite constant times 1/n, uniformly over human kernels and initial states.Source: A Uniform ergodicity of the… · pp. 15, 16, 18

B Proofs for Section 3

  • The Section 3 proof pairs an exact-reproduction construction for impossibility with lower-clipped likelihood-ratio scores for the possibility result.The impossibility construction reproduces an admissible human source; the possibility test uses finitely many representative human kernels.Source: B Proofs for Section 3 · p. 18

B.1 Auxiliary lemmas

  • A next-token distribution is contamination-admissible exactly when each probability is at least the retained machine probability, (1 − ϵ)p1(x | s).This coordinatewise condition characterizes the distributions attainable by mixing the target LLM with arbitrary contamination.Source: §B.1 · p. 18
  • The closest admissible contaminated distribution has probabilities max{(1 − ϵ)p1(x | s), cP0(s)p0(x | s)}, yielding the clipping form used by the likelihood score.The normalizing cP0(s) is chosen so the probabilities sum to one.Source: §B.1 · p. 19
  • When D0 > −log(1 − ϵ), finitely many representative human kernels suffice to ensure at least one representative has a uniformly negative stationary score mean for every human kernel.The representatives and threshold are fixed before observing the text and do not depend on its length.Source: §B.1 · pp. 20–21

B.2 Proof of Theorem 3.1

The proofs establish the Section 3 detection boundary and develop clipped-score guarantees for Section 4. They also describe a contamination strategy that depresses the raw score by placing contaminating mass on its lowest-scoring tokens.

B.2 Proof of Theorem 3.1

  • When D0 ≤ −log(1 − ϵ), admissible contamination can reproduce a human kernel exactly, making the hypotheses indistinguishable for every text length and every test.The induced text distributions coincide, so the test's worst-case errors cannot reliably separate the sources.Source: §B.2 · p. 21
  • When the detection condition holds, the finite-representative clipped test has exponentially vanishing worst-case errors, with the proof establishing a positive error exponent.The bound is at most e^(-cn) for sufficiently large n, for some c > 0.Source: §B.2 · p. 22

C.1 Proof of Theorem 4.1

  • For clipped scores, γ(a) lower-bounds source separation over ϕ ≤ a ≤ ϕ + r; when positive, a threshold between the human and contaminated-machine bounds separates the sources asymptotically.The lemma gives γ(a) − γ(ϕ) ≥ (ϵ − ρ0)(a − ϕ).Source: §C.1 · pp. 23–24
  • A contamination strategy that places all contaminating mass on a minimum-score token bounds the raw score's conditional mean, providing the adversarial construction used in the raw-test analysis.The selected token minimizes ϕ(x | s) at each history.Source: §C.1 · p. 25

C.2 Discussion of the contamination interval

The contamination-interval discussion identifies when clipping floors preserve detection consistency and when an admissible range exists. Finite-state simulations examine these conditions and detection performance under contamination.

C.2 Discussion of the contamination interval

  • The two detection regimes overlap under the stated sufficient condition, with endpoints satisfying 0 < ϵ− < ϵ+.The condition is favored by a clear clean-score gap, limited history variation, and clipping that affects few human tokens; simulations find it holds for all four scores in the mild profile.Source: §C.2 · pp. 26–27
  • When ϵ ≤ ρ0, the raw test is already consistent, and clipping anywhere in [ϕ, ϕ + r] preserves consistency.For ϵ > ρ0, a qualifying floor must exceed the displayed lower bound; admissible floors always exist near the upper end of the band.Source: §C.2 · p. 27

C.3 Finite-state simulations

  • The simulations use order-K Markov chains with mild, larger, and tail-heavy profiles, comparing raw and lower-clipped averages of four machine-probability-based scores.Clipping bands and contamination levels were selected from clean-source probabilities before performance evaluation.Source: §C.3 · p. 28
  • In finite-state simulations, the interval was nonempty in 40 of 48 configurations, including all four scores under larger history variation despite the proposition’s condition failing.After clipping, the lower bound on the machine mean exceeded the clipped human mean in all 40 tested configurations.Source: §C.3 · p. 28

D Statistical methods

  • The appendix outlines procedures for data splitting, clipping-bound selection, threshold calibration, and paired source-level confidence intervals.The supplied overview points to Appendix D.1–D.4 for those procedures.Source: D Statistical methods · p. 29

D.1 Data splitting and score direction

This section describes how the experiments separate fitting, calibration, and testing, and how they select detector directions and clipping bounds. It also outlines the experimental datasets, models, scoring, and uncertainty procedures.

D.1 Data splitting and score direction

  • Human documents, machine counterparts, and modified versions stay together in one split; tuning selects bounds and directions, calibration sets thresholds, and testing measures performance.This grouping prevents related texts from appearing in both fitting and testing.Source: §D.1 · p. 29
  • For learned-direction detectors, tuning data determine whether higher or lower scores favor machine text; LRR and Binoculars retain their original fixed directions.Entropy’s learned direction varies across settings because it measures prediction uncertainty rather than the probability assigned to the observed token.Source: §D.1 · p. 30

D.2 Choosing clipping bounds

  • Candidate clipping bounds are selected by maximizing 0.8 AUROC(H, Mmix; c) + 0.2 AUROC(H, Mclean; c) in the controlled study; RAID selection uses detection at a target 5% FPR.Source: §D.2 · p. 30
  • The clipping-selection objective has no additional FPR penalty or hard clean-AUROC limit, and its clean-TPR term does not guarantee clean-test TPR preservation.Candidate bounds and score directions are set before the cross-fitted comparison; independent calibration and test sets do not enter the candidate objective.Source: §D.2 · p. 30

D.3 Setting detection thresholds

  • Human calibration scores set separate raw and clipped thresholds for each target FPR; test FPR can differ from the calibration target.The controlled study uses 1% and 5% targets; RAID uses 5% and calibrates separately by domain.Source: §D.3 · p. 31

D.4 Confidence intervals

  • The reported confidence intervals use paired source-cluster resampling with fitted directions, bounds, and thresholds held fixed.They are pointwise intervals without multiple-comparison adjustment, and the across-setting means are descriptive rather than newly pooled estimates.Source: §D.4 · p. 31

E Experimental details

  • The experiments cover three English datasets and three generators, while RAID supplies existing outputs and attacks across multiple domains.In the controlled study, the generator provides single-model detector scores and Falcon models provide Binoculars scores; prompt tokens supply context but are not scored.Source: §E.1 · p. 32, §E.2 · p. 32

E.3 Controlled contamination construction

The controlled study creates random and tail replacements in generated continuations, while the RAID study uses benchmark-provided attacked texts. The appendix also describes how modification rates and complete results are reported.

E.3 Controlled contamination construction

  • Controlled contamination replaces approximately nr tokens at rates from 5% to 50%, either in randomly placed windows or at the continuation’s end.Random replacement creates three variants per rate; tail replacement selects human passages with high mean surprisal under the generator and replaces the ending.Source: §E.3 · p. 33

E.4 RAID selection, attacks, and modification rates

  • RAID comparisons use complete machine families with eleven attacks, and measure modification rate as token-level edit distance divided by the longer sequence length.Rate-specific fitting assumes a modification-rate interval; attack-specific fitting assumes the attack mechanism is known, and the benchmark’s clean counterpart and attack label may be unavailable for new documents.Source: §E.4 · pp. 33–34

F Controlled contamination study: complete results and secondary diagnostics

  • The complete controlled-study results report TPR and FPR alongside normalized TPR–replacement-rate area, with averages weighted equally across nine dataset–generator combinations.Random and tail results share the same clean baseline.Source: F Controlled contamination study:… · p. 35

F.1 Clean operating points and robustness at target 5% FPR

The appendix reports controlled-study operating points and dose-response results, including a comparison across thresholds and details on selected clipping specifications. It also summarizes the scope and uncertainty of the RAID comparisons.

F.1 Clean operating points and robustness at target 5% FPR

  • The table reports clean TPR, actual FPR, and area change, with raw/clip and random/tail labels; area summarizes TPR versus replacement rate, evaluated at requested rates from 0% through 50%.Source: §F.1 · p. 35

F.2 Secondary operating points at target 1% FPR

  • The secondary controlled-study comparison uses a 1% target FPR and reports achieved test FPR alongside TPR because calibration and test FPR can differ.With 500 human calibration texts, the calibration rule permits at most five false positives.Source: §F.2 · p. 37

F.3 Detection across different thresholds

  • For Binoculars, clipping changes clean AUROC from 90.2 to 87.3, random-replacement AUROC from 39.9 to 67.5, and tail-replacement AUROC from 45.3 to 61.4.These reported results indicate a contamination benefit across thresholds, alongside a slight reduction in clean performance over this range.Source: §F.3 · p. 38

F.4 Clean detection and false-positive rates

  • The appendix separately reports clean-test FPRs and clean-machine TPR changes for raw and clipped rules calibrated to a 5% target FPR.The clean TPR change is clipped minus raw, in percentage points, with pointwise 95% intervals from paired source-cluster bootstrap resamples.Source: §F.4 · p. 39

F.5 Selected directions and clipping specifications

  • Selected clipping specifications list score directions and detector-specific bounds; document-level thresholds are set separately during calibration.LRR caps contributions to both its numerator and denominator, whereas Binoculars caps only the numerator.Source: §F.5 · p. 40

F.6 Full dose-response atlas

  • The dose-response atlas organizes TPR by dataset, generator, detector, replacement rate, and raw-versus-clipped method at 1% or 5% target FPR.Its panels use a common vertical scale from 0 to 1.Source: §F.6 · p. 42, Figure 5 · p. 42, Figure 6 · p. 43

G RAID: complete numerical results

  • The RAID appendix reports rate-specific, attack-specific, and universal comparisons at a 5% target FPR, with pointwise paired bootstrap intervals and fitted rules fixed.The comparisons use the same held-out pool of 5,149 source groups, and intervals are not adjusted for multiple comparisons.Source: G RAID: complete numerical results · pp. 47–48

G.1 Comparison with the published RAID results

Raw Binoculars TPRs closely match published RAID values. Further analyses report clipping across rate- and attack-specific fits, clean performance, universal rules, selected bounds, edit rates, and sample composition.

G.1 Comparison with the published RAID results

  • Raw Binoculars TPRs differed from published values by at most 0.53 percentage points across seven RAID conditions, with achieved human FPR 4.62%.The comparison uses the selected sample and calibrated threshold.Source: Table 11 · p. 48, §G.1 · p. 48

G.2 Rate-specific detection

G.3 Attack-specific detection

  • Attack-specific rules are fitted without restricting modification rate and evaluated on 5,149 attacked test texts per attack; a tailored bound is not guaranteed to outperform a broader-population bound.The fitting objective also includes clean TPR.Source: §G.3 · p. 50

G.4 Clean detection and false positives

  • For synonym-fitted Binoculars, attacked TPR rose from 43.58% to 49.85%, while clean TPR fell from 80.00% to 70.69% and human FPR rose from 4.62% to 5.59%.The weighted fitting objective permits this trade-off and imposes no hard clean-performance or test-FPR constraint.Source: §G.4 · p. 52

G.5 Secondary universal comparisons

  • A narrower universal fitting set did not ensure better all-attack TPR: eligible-universal entropy gap and Binoculars declined, while full-universal entropy gap was unchanged and Binoculars improved slightly.Source: §G.5 · p. 56

G.6 Selected directions and clipping bounds

  • The appendix reports 119 fitted specifications; clipping bounds act on oriented token evidence, and the NLL cap bounds −log pi while LRR also caps log ri, rather than setting decision thresholds.Source: §G.6 · p. 60

G.7 Modification rates and text truncation

  • Homoglyph and zero-width-space attacks have median edit rates of 0.963 and 0.984, and truncate 87.3% and 99.4% of outputs at the 512-token scoring limit.Their full-token edit distance exceeds scored-window distance in 87.1% and 99.4% of cases, respectively.Source: §G.7 · p. 64

G.8 Sample composition

  • The selected sample comprises 12,871 sources, including 6,507 greedy outputs and 6,364 sampled outputs; generator and decoding-method sample sizes differ because selection was within source.Source: §G.8 · p. 64
Loading 2609.29935v1…