PaperlayerView exact revision on arXiv

Source-linked AI summary

Ontological Instability and Statistical Amplification: The Paradox of "Humanizing" LLM-Generated Text

Claudiu Creanga, Liviu Dinu

arXiv:2610.03110v1cs.CL

TL;DR

The paper asks what supervised AI-text detectors rely on when making their decisions. It tests RoBERTa and a structural Latent Space detector under several perturbations. Mistral rewriting increased detectability, while RoBERTa also flagged many formal human texts, suggesting its robustness is feature-specific.

  • Problem

    Supervised detectors report high benchmark accuracy, but it remains unclear whether they respond to artificial content or statistical artifacts of particular generators.

    Source: §1 · p. 1

  • Method

    The authors test RoBERTa and a Latent Space structural control under paraphrasing, event-sequence changes, and homoglyph substitution, using M4 data and controlled generations.

    Source: §1 · p. 1

  • Results

    Mistral paraphrasing increased lexical diversity and detectability, while RoBERTa flagged 76.3% of formal human texts.

    Source: §9 · p. 11

  • Takeaways & Limitations

    RoBERTa behaved more like a filter for statistical complexity than a system recognizing what makes text machine-written.

    Source: §9 · p. 11

    The main experiments use one RoBERTa detector and English text, so transfer to other architectures or languages is unknown.

    Source: §10 · p. 12

Abstract

from arXiv · show

Supervised AI-text detectors report high benchmark accuracy, but it is not clear what their decisions are based on. We analyze a RoBERTa-based detector under semantic, structural, and tokenizer-level perturbations, using the M4 dataset (N = 10,000) and controlled generations (N = 300). When Mistral-7B-Instruct was asked to make machine text sound more human, Verb Diversity rose from 0.77 to 0.92 and the outputs became easier to detect. Detection scores appear to track statistical complexity, which also leads to a 76.3% false-positive rate on formal human writing. As a control, we evaluate event-based Latent Space detection. Paraphrasing changed 87% of its event sequences (Jaccard = 0.067), and homoglyphs altered 70% of the extracted verbs even though extraction still ran (Jaccard = 0.30). Its best domain AUC was 0.577. RoBERTa's robustness seems specific to the features it uses, and structural abstraction did not make detection more robust.

1 Introduction

The paper asks whether supervised detectors recognize machine-written meaning or instead respond to generator-specific statistical artifacts. It tests RoBERTa and a structural Latent Space detector under perturbations, finding that rewriting can strengthen RoBERTa’s signal while formality and character changes expose other weaknesses.

1 Introduction

  • Supervised transformer classifiers report more than 99% accuracy on standard benchmarks, but what features underlie their decisions remains unclear.The open question is whether they respond to artificial content or statistical artifacts of particular generators.Source: §1 · p. 1
  • The study tests RoBERTa and a Latent Space detector under paraphrasing, event-sequence changes, and homoglyph substitution.The Latent Space detector provides a structural point of comparison to the transformer classifier.Source: §1 · p. 1
  • Mistral rewriting raised lexical diversity while RoBERTa scores usually stayed high; formal human texts were flagged at 76.3%, and homoglyph evasion fell from 41% to 2% after Latin-character mapping.The Latent Space control was affected by both paraphrasing and character-level attacks, suggesting robustness depends on detector features rather than supervision alone.Source: §1 · p. 1

2 Related Work

  • Earlier work found paraphrasing and synonym substitution could bring detector accuracy close to chance, whereas Mistral rewriting often strengthened the signal by raising lexical diversity.The cited prior work is Krishna et al. (2023) and Sadasivan et al. (2023).Source: §2 · p. 2
  • Latent-space methods model events or discourse transitions assumed harder for generators to imitate, but this approach depended heavily on domain and was of little use outside narrative text.Tian et al. (2024) is the cited Latent Space approach.Source: §2 · p. 2

3 Methodology

The methodology compares a supervised RoBERTa detector with a structural Latent Space control on English M4 data and controlled Mistral generations. It evaluates detection and uses verb-based measures to track lexical complexity and event-sequence preservation.

3.1 Models Under Evaluation

  • The evaluation pairs a RoBERTa classifier trained on M4 with a Latent Space structural control that approximates event triggers using spaCy-extracted verbs.An ensemble baseline weights RoBERTa at 40%, Sample Space perplexity at 10%, and Latent Space at 50%.Source: §3.1 · p. 2

3.2 Datasets

  • The main dataset contains 10,000 English M4 samples, split evenly between validation and test and balanced across five domains; the persona test adds 300 Mistral-7B-Instruct samples.The five M4 domains are WikiHow, Wikipedia, Reddit, ArXiv, and PeerRead; persona samples cover 100 topics and Child, Neutral, and PhD prompts.Source: §3.2 · p. 2

3.3 Metrics

  • Verb Diversity is verb type-token ratio, used as a rough proxy for statistical complexity, while Event Sequence Preservation is Jaccard similarity between verb sequences before and after perturbation.Low Verb Diversity indicates repeated descriptions of the same actions.Source: §3.3 · p. 2

4 Paraphrasing and Statistical Amplification

Across iterative rewriting and persona prompts, Mistral’s attempts to make machine text sound human often increased verb diversity and did not reduce detection. Compression measures likewise distinguish machine from human text, while evasion in the reported sample involved plain repetition.

4.1 Iterative Paraphrasing with Mistral-7B

  • After three Mistral rewriting rounds, RoBERTa detected 95% of samples and Verb Diversity rose from 0.766 to 0.924, farther from the human baseline of 0.572.The reported increase was 20.6%; Table 1 compares detection before and after the three rounds.Source: §4.1 · p. 3, Table 1 · p. 3

4.2 Verb Diversity by Text Type

  • Instruction-tuned Mistral produced text more diverse than the original machine output even when prompted to sound more human.The authors suggest instruction-tuned models have difficulty reproducing repetition normal in human writing.Source: §4.2 · p. 3, Table 2 · p. 3

4.3 Persona Stress Test

  • Child-persona texts averaged 0.764 Verb Diversity and were detected 98.8% of the time, while PhD texts reached 0.948 diversity and a mean score of 1.000.Across personas, the only samples that evaded detection had Verb Diversity below 0.50; the test used 300 generated texts.Source: §4.3 · pp. 3, 5, Table 3 · p. 3

4.4 Compression Ratio

  • Machine text had a Gzip ratio of 0.587 ± 0.04 versus 0.541 ± 0.03 for human text, making it 8.5% less compressible despite lower GPT-2 perplexity.The reported perplexities were 30.2 for machine text and 40.0 for human text.Source: §4.4 · p. 5, Figure 3 · p. 5
  • The sole described Child-persona sample to evade detection used plain repetition, with Verb Diversity 0.462 and detector score 0.000.The authors state that evasion in their data required this kind of plain repetition.Source: §4.4 · p. 5

5 Tokenizer-Level Attacks

RoBERTa resists paraphrasing but remains vulnerable to character-level homoglyphs, while the event-based Latent Space detector is affected by both. The control’s performance varies by domain, and alternative detection methods did not separate the classes reliably.

5 Tokenizer-Level Attacks

  • RoBERTa handled paraphrasing well but remained sensitive to character-level noise, whereas the Latent Space detector was affected by both.The section’s control comparison indicates that structural abstraction alone did not ensure robustness.Source: §5 · p. 5, §5.3 · p. 7, §5.2 · p. 7

5.1 Homoglyph Substitution

  • At 20% homoglyph substitution, RoBERTa detection fell from 100% to 59%, and evasion leveled off beyond that rate.Even 5% substitution evaded detection in 13% of samples; the authors attribute the vulnerability to homoglyphs changing common subword tokens into rare or unknown tokens.Source: §5.1 · p. 5, Figure 4 · p. 6, Table 4 · p. 6

5.2 Control Experiment: Latent Space Detection

  • At 30% homoglyph substitution, Latent Space event extraction usually still ran but 70% of extracted events changed (Jaccard 0.30); Mistral rewriting changed them even more (Jaccard 0.067).The authors note that the detector needs both stable events and correct extraction: paraphrasing disrupts the first, while homoglyphs disrupt the second.Source: §5.2 · p. 7, Table 5 · p. 7

5.3 Performance by Domain

  • The Latent Space detector was above chance only on WikiHow (AUC 0.577), and below chance on ArXiv (0.385) and PeerRead (0.393).Technical writing’s nominalizations make event extraction unreliable; academic abstracts have similar human and machine verb distributions, while paraphrasing changes 87% of event sequences.Source: §5.3 · p. 7, Table 6 · p. 7

5.4 Lexical Entropy and Perplexity

  • Machine text was more predictable (PPLmachine = 30.2 vs. PPLhuman = 40.0) but less compressible (Ratiomachine = 0.587 vs. Ratiohuman = 0.541).The passage suggests that language models choose safe, high-probability continuations while using a wider vocabulary; RoBERTa may respond to this lexical density.Source: §5.4 · p. 8, Table 8 · p. 8

5.5 Alternative Detection Methods

  • Binoculars reached only 50.3% accuracy (AUC = 0.217), while rewrite stability (RAIDAR) did not separate the classes (AUC = 0.492).In this setting, machine text was not more stable under rewriting.Source: §5.5 · p. 8

6 Calibration and Defense

At the default threshold, RoBERTa frequently misclassified formal human writing, and raising the threshold sharply reduced machine recall. Mapping confusable characters to Latin before tokenization cut homoglyph attack success.

6.1 Threshold Calibration

  • At threshold 0.5, 76.3% of human ArXiv abstracts were labelled machine-generated; raising it to τ = 0.9999 reduced machine recall to 1.2% and increased homoglyph attack success to 97%.The authors could not find a single threshold that worked well; the projection places formal human text inside the machine cluster while casual Reddit posts stay apart.Source: §6.1 · p. 8, Table 9 · p. 8, Figure 5 · p. 9

6.2 Confusable-Character Sanitization

  • Confusable-character mapping before tokenization reduced homoglyph attack success from 41% to 2%.NFKC normalization alone did not map look-alike characters from other scripts to Latin.Source: §6.2 · p. 9, Table 10 · p. 9

7 Other Attacks

Simplification and back-translation rarely evaded RoBERTa, and a greedy word-swap search usually failed to lower its score enough to justify substitutions.

7.1 Syntax Simplification

  • Simplification led to evasion in 6% of samples, with a mean score drop of 0.031.One sample’s score dropped by 0.997; the few successful cases had become much simpler.Source: §7.1 · p. 9, Figure 7 · p. 10

7.2 Recursive Back-Translation

7.3 Greedy Word-Swap Attack

  • In 49 of 50 samples, no greedy word substitution lowered RoBERTa’s score enough to be worth making.The result suggests that the detection signal is spread across the whole text rather than concentrated in a few giveaway words.Source: §7.3 · p. 11

8 Discussion

The discussion associates RoBERTa’s scores with lexical diversity while noting that correlated syntactic or token-level features may also contribute. It argues that detector robustness depends on feature choice, not abstraction alone.

8.1 Lexical Diversity as the Main Signal

  • RoBERTa’s scores were closely associated with lexical diversity, though correlated syntactic or token-level features may also play a role.This association is consistent with paraphrasing often strengthening the signal, homoglyphs evading it, and formal human prose being misclassified.Source: §8.1 · p. 11

8.2 Feature Choice and Robustness

  • Event-based detection did not make the detector more robust: structural features remained sensitive to paraphrasing and added extraction-error risks.The authors conclude that robustness depends on which features a detector uses; their attacker-facing discussion identifies repetition, homoglyphs, or Verb Diversity below 0.50 as routes to evasion.Source: §8.2 · p. 11

9 Conclusion and Future Work

The conclusion frames the detector as a filter for statistical complexity rather than a system that recognizes machine-written text. It reports findings on paraphrasing, homoglyphs, and formal human writing, and identifies directions for future work.

9 Conclusion and Future Work

  • Paraphrasing with Mistral increased lexical diversity and made machine texts more detectable.Source: §9 · p. 11
  • Homoglyph substitution evaded the detector in 41% of cases.Source: §9 · p. 11
  • The detector confused formality with machine generation, with a 76% false-positive rate on academic text.Source: §9 · p. 11
  • Mapping confusable characters to Latin reduced homoglyph attack success to 2%.Source: §9 · p. 11
  • The detector behaves more like a filter for statistical complexity than a system that recognizes what makes text machine-written.Source: §9 · p. 11
  • Future work should test Statistical Amplification across newer generators, languages, and architectures, and develop calibration methods that distinguish academic formality from machine generation.Source: §9 · p. 11

10 Limitations

The main experiments use a single RoBERTa detector and English text, limiting what the study can conclude about transfer to other architectures or languages.

10 Limitations

  • The main experiments use a single RoBERTa detector and English text, so transfer to other architectures or languages remains unestablished.Source: §10 · p. 12

11 Ethics Statement

The study uses public data and open-weight models, collects no private data, and involves no human participants; the authors also disclose their use of AI tools.

11 Ethics Statement

  • The study uses the public M4 dataset and open-weight models, collects no private data, and involves no human participants.Source: §11 · p. 12
  • The authors used AI tools for code, language polishing, and reference management, and reviewed and edited all outputs.Source: §11 · p. 12

Related papers

Loading 2610.03110v1…