EASE: Entropy-Adaptive Distribution Shaping for Evading AI-generated Text Detectors

1. INTRODUCTION

• The paper asks whether AIGT detectors can be evaded during generation without detector feedback or model fine-tuning, requirements that some existing approaches may impose.Prior approaches include text-level modification and direct changes to generation, such as paraphrasing, preference optimization, and proxy-guided decoding.Source: §1 · p. 1
• Changes to next-token logits or sampling temperature can reduce detector AUROC, but the accompanying perplexity increase indicates potential text-quality degradation.The paper identifies fixed settings as a limitation because candidate-distribution concentration varies across decoding steps.Source: §1 · p. 1
• EASE is training-free and detector-agnostic, using top-k predictive entropy to adapt logit perturbation and sampling temperature without detector feedback or fine-tuning.Its overview also describes token-dependent logit modulation before sampling.Source: §1 · pp. 1–2, Figure 2 · p. 2
• The paper reports that both logit perturbation and temperature scaling can reduce AIGT detector performance, indicating vulnerability to decoding-time distribution changes.Figure 1 presents AUROC and perplexity under top-k logit perturbation and temperature variation, with vanilla baselines.Source: §1 · pp. 1–2, Figure 1 · p. 1
• Across three source LLMs and multiple detectors, EASE consistently reduces detection performance; on Qwen3-8B, average TPR@1%FPR falls from 0.655 to 0.339 with 0.643% generation latency overhead.The Qwen3-8B result is reported across five detectors.Source: §1 · p. 2

2. DECODING-TIME DISTRIBUTION CHANGES AFFECT DOWNSTREAM DETECTION

• The observation study adds Gaussian noise to top-k logits and varies perturbation strength at fixed τ = 1, then separately varies temperature without logit perturbation.The setup uses the observation-study configuration described in Section 4.1 with a different random seed.Source: §2 · p. 2
• Stronger logit perturbations generally reduce detector AUROC while increasing generation perplexity, and higher sampling temperatures show a similar pattern.The study varies perturbation strength at τ = 1 and temperature without logit perturbation; Fig. 1 presents these outcomes.Source: §2 · p. 2
• Because candidate-distribution concentration varies across decoding steps, the section proposes adapting both operations to predictive entropy, which quantifies concentration.Lower entropy indicates a more concentrated candidate distribution.Source: §2 · p. 2

3. ENTROPY-ADAPTIVE DISTRIBUTION SHAPING

• EASE uses predictive entropy to adapt logit perturbation and sampling temperature, reshaping the source LLM’s next-token distribution before sampling.It does so without detector feedback or model fine-tuning.Source: §3 · p. 2

3.1. Entropy-Adaptive Control

• Low-entropy distributions receive stronger perturbations and higher temperatures, while both adjustments diminish as the candidate distribution approaches uniformity.Entropy is computed from the unmodified next-token distribution renormalized over the top-k candidate set.Source: §3.1 · pp. 2–3

3.2. Token-Dependent Logit Modulation

• A sinusoidal construction assigns deterministic, context- and token-dependent modulation values that set each candidate’s logit-offset sign and relative magnitude.The construction uses fixed coefficients and requires neither learned additional parameters nor detector queries.Source: §3.2 · p. 3

3.3. Logits Distribution Shaping

• The control factor scales candidate-logit perturbations and raises sampling temperature; additive modulation can change logit rankings, while temperature changes concentration without changing their ranking.The perturbation uses base magnitude δ, and the temperature increase uses base τ and maximum increase β.Source: §3.3 · p. 3

4.1. Experimental Setup

• The evaluation uses 2,000 WikiText-103 prompts, three source LLMs for cross-detector and quality tests, and AUROC, TPR@1%FPR, PPL, BLEU, and ROUGE metrics.All later experiments use EASE-Plugin; the main comparison and ablation use Qwen3-8B.Source: §4.1 · p. 3

4.2. Comparison with Existing Evasion Methods

• Average AUROC decreases from 0.952 to 0.879 and average TPR@1%FPR from 0.655 to 0.339 with EASE-Plugin versus vanilla generation across five detectors.EASE-Plugin also has the lowest evaluated PPL at 7.752, versus 9.867–15.196 for paraphrasing baselines; EASE-Rewrite’s advantages vary by detector and metric.Source: §4.2 · pp. 3–4

4.3. Cross-Detector Evasion and Text Quality

• Across eight additional detectors, average TPR@1%FPR falls from 0.425 to 0.203 on Qwen3-8B, 0.446 to 0.146 on Llama3-8B, and 0.141 to 0.046 on Ministral-3-8B.EASE also consistently reduces AUROC and lowers or maintains TPR@1%FPR across detector–model pairs; LRR retains substantial discriminative ability in some settings.Source: Table 2 · p. 4, §4.3 · p. 4

4.4. Ablation Study and Inference Overhead

• Full EASE improves evasion over fixed-strength perturbation at similar PPL, while disabling temperature adaptation lowers PPL but weakens evasion.The complete configuration achieves the lowest detection metrics among evaluated variants, supporting the joint adaptive design.Source: Table 4 · p. 4, §4.4 · p. 4

4.3. Cross-Detector Evasion and Text Quality

• BLEU-1 and ROUGE-1 remain relatively stable across three source LLMs, while BLEU-2 and ROUGE-2 show small absolute decreases and PPL increases under EASE.These results suggest limited degradation in reference overlap.Source: §4.3 · p. 4, Table 3 · p. 4

4.4. Ablation Study and Inference Overhead

• EASE-Plugin increases mean generation time from 12.362 to 12.442 s/sample, an overhead of 0.643% in the stated Qwen3-8B benchmark.The benchmark used an RTX 3090, BF16, 50 paired samples at batch size 1, and generated 200 tokens from 30-token prompts; model loading, data I/O, and warm-up were excluded.Source: §4.4 · p. 4

• EASE is a training-free, detector-agnostic framework that uses predictive entropy to adapt logit perturbation and sampling temperature for AIGT detector evasion.Source: §5 · p. 4
• The results show that decoding-distribution changes can substantially reduce detection performance, supporting detector evaluation across diverse decoding settings.Source: §5 · p. 5

• The computational study used publicly available text data and model-generated content, involved no human or animal subjects, and required no ethical approval.Source: §6 · p. 5