PaperlayerView exact revision on arXiv

Source-linked AI summary

Measuring Artifact Reliance in Machine-Generated Text Detectors

Anastasia Voznyuk, Andrey Grabovoy

arXiv:2610.13583v1cs.CL

TL;DR

Determining whether scientific documents were written by people or language models is a practical provenance problem. The paper tests how document-assembly artifacts affect benchmarks and detectors, finding that surface cues can match or exceed detector performance and that tokenizer choice affects whether a cue is exploitable.

  • Problem

    Determining whether a document was written by a person or a language model is a practical provenance problem in scientific literature.

    Source: §1 · p. 1

  • Method

    The paper introduces content-preserving format counterfactuals and a model-agnostic Artifact Reliance Score to measure detectors’ reliance on formatting.

    Source: §1 · p. 1, §5.1 · p. 4

  • Results

    A content-free surface probe matches or exceeds shared-task winners, while artifact exploitability depends on tokenizer family and formatting normalization improves cross-benchmark generalization.

    Source: §1 · p. 2, §9 · p. 8

  • Takeaways & Limitations

    The authors recommend normalizing surface form before benchmark release and publishing a surface-probe score alongside each resource.

    Source: §9 · p. 8

    The measured effects are not claimed to transfer beyond English or scientific domains, and ARSnet should not rank detectors with very unequal accuracy.

    Source: Limitations · p. 8

Abstract

from arXiv · show

Detectors of machine-generated text score almost perfectly on scientific-literature benchmarks, implying we can reliably distinguish with these detectors human and machine-generated documents. We looked at ten scientific-document subsets from six popular resources, and on several of them that apparent ease is a side effect of how the documents were put together. A logistic regression using 27 superficial features reached 0.833-0.997 macro-F1, and on the three arXiv subsets it outperformed every detector we evaluate with F1-scores 0.951-0.997. The strongest cue to the detector is the PDF extraction artifact: human texts retain their original line breaks, whereas generated texts are extracted as a single block of prose. This cue, together with three other formatting features, tell the classes apart at 0.996 AUC. To distinguish benchmarks that contain such a signal from detectors that rely on one, we introduce format counterfactuals: just re-wrapping a machine-written abstract without changing a single word reverses 20-27% of a public detector's correct decisions. Normalizing formatting before training reduces the generalization gap from 0.32 to 0.22. On format-clean benchmarks, it also raises out-of-domain macro-F1 from 0.33 to 0.65 for detectors trained on artifact-containing subsets.

1 Introduction

Scientific-text detectors report near-perfect benchmark performance, yet document assembly can create easy-to-learn formatting differences that separate human and generated texts. The paper tests these shortcuts across scientific-document subsets and introduces content-preserving format counterfactuals, alongside findings about tokenizer dependence and formatting normalization.

1 Introduction

  • In the examined arXiv subsets, human documents retain source formatting while generated documents arrive as clean text blocks, enabling a four-feature formatting classifier to reach 0.996 AUC.The paper argues that benchmark assembly accounts for much of the reported performance on several benchmarks.Source: §1 · p. 1
  • A surface-attribution analysis of ten scientific-document subsets from six resources shows that content-independent stylistic features can match or exceed the corresponding shared-task winners.The analysis also identifies the surface dimensions that carry these shortcuts.Source: §1 · p. 1
  • Format counterfactuals preserve document words while changing formatting, and the Artifact Reliance Score measures a detector’s reliance on formatting without retraining or model-internal access.The supplied passage introduces these contributions but does not give the score’s full definition.Source: §1 · pp. 1–2
  • Artifact exploitability depends on tokenizer: SentencePiece-based models discard the whitespace cue, making performance scores incomparable across tokenizer families.The cue is visible only to some tokenizer families.Source: §1 · p. 2
  • Normalizing formatting before training reduces reliance on document-construction artifacts and improves cross-benchmark generalization, including evaluation on format-clean benchmarks.The passage does not provide the size of the improvement.Source: §1 · p. 2

2 Related Work

Prior work spans several detector families, while relatively few studies examine whether benchmark construction itself creates shortcuts. Existing studies identify formatting confounds and benchmark-hardness concerns, motivating this paper’s focus on data quality.

2 Related Work

  • Detection approaches include stylometric or statistical features, zero-shot probability scores, and fine-tuned language models, which are described as the current state of the art but require substantial labelled data.Examples cited include Gehrmann et al. (2019), Su et al. (2023), and Macko et al. (2023).Source: §2 · p. 2
  • Only a few studies examine benchmark data quality despite its direct effect on detector reliability; Gritsai et al. (2025) is cited as one such study.Fraser et al. (2025) and Wu et al. (2025) catalogue detection benchmarks.Source: §2 · p. 2
  • Dugan et al. (2024) report formatting confounds in RAID with small estimated effects, whereas the scientific subsets here show formatting cues reaching 0.996 AUC and exceeding a fine-tuned transformer.Ayoobi et al. (2025) argue that existing benchmarks over-represent easy examples and propose hardness-aware construction.Source: §2 · p. 2
  • Shared tasks release curated evaluation data across multilingual, cross-domain, and cross-generator settings, and some participants also analyze dataset construction biases and synthetic-text patterns.The passage cites Kashnitsky et al. (2022), Ayele et al. (2024), Wang et al. (2024a), and Voznyuk and Konovalov (2024).Source: §2 · p. 2

3 Benchmarks Analyzed

The study analyzes ten English scientific-document subsets drawn from six published resources. It selects binary human-versus-machine datasets with machine texts generated from scratch and includes abstracts, introductions, peer reviews, and full-paper material.

3 Benchmarks Analyzed

  • The ten subsets come from six published resources and include scientific artifacts in a binary human-versus-machine classification task, with machine texts generated from scratch rather than rewritten from human text.The selection criteria also require both classes to be present in the release.Source: §3 · p. 2
  • Six of the ten subsets descend from the M4 shared-task family, including arXiv abstracts and PeerRead-adapted peer reviews; later SemEval and COLING releases extend that data with newer generators.Each generation inherits its human counterpart from an earlier release.Source: §3 · p. 2
  • IDMGSP pairs human arXiv articles with machine-generated full papers and provides title, abstract, introduction, and conclusion fields; the study uses introductions.Introductions are selected because they are usually the longest yet representative field.Source: §3 · pp. 2–3
  • The selected GPABench2 subsets cover computer science and physics, while CHEAT pairs computer-science paper titles with human abstracts or ChatGPT abstracts generated from titles and keywords.GPABench2 includes multiple abstract-generation regimes, but the study keeps only computer science and physics subsets.Source: §3 · p. 3

4 Diagnosis

The diagnosis finds strong surface-based separability, especially from formatting in arXiv subsets, and traces that cue to differences in document collection and generation. Formatting normalization sharply affects the arXiv probe but not most other subsets.

4.1 Surface Probe

  • 0.833–0.997 macro-F1: the 27-feature probe uses no word identities, while four formatting features alone reach 0.943–0.997 AUC on the three arXiv subsets.The study uses balanced samples of up to 10,000 documents per class per subset, five-fold cross-validation, and 1,000-sample bootstrap intervals.Source: §4.1 · p. 3, §4 · p. 3
  • 0.199–0.268 macro-F1: normalizing formatting reduces the full probe’s score on the arXiv subsets, while the same normalization changes results by at most 0.027 on the other seven subsets.Lexical TF-IDF scores remain unchanged after the transformation.Source: §4.1 · p. 3
  • The study distinguishes pipeline artifacts from genuine stylistic differences: GPABench2 and CHEAT are format-clean at 0.52–0.55 FMT-ONLY AUC but remain lexically separable at TF-IDF ≥0.99.Document length is reported as a cue only in IDMGSP and M4 peer reviews.Source: §4.1 · p. 3

4.2 Nature of this Artifact

  • Human arXiv abstracts retain source line wrapping, with median line length 76 characters, while API generations are unwrapped, with median line lengths of 479–481 characters.In M4 and SemEval24, every human abstract contains a double space, versus 2.2% and 2.0% of machine abstracts; a double-space predicate classifies SemEval-2024’s arXiv subtask with 99% accuracy.Source: §4.2 · p. 3
  • The formatting gap varies by collection: COLING-2025 has no double-space gap but retains a newline gap, while IDMGSP reverses the pattern, with newlines in machine introductions but not human ones.The IDMGSP reversal is used as a control later in the paper.Source: §4.2 · p. 3

5 Method

The method uses word-preserving formatting counterfactuals to test detector reliance on formatting, with a placebo comparison and a score-based statistic. It also specifies conditions for extending the operators beyond whitespace.

5 Method

  • The three arXiv subsets lose 0.20-0.27 F1 after format normalization, while the other subsets lose nothing.Table 1 distinguishes macro-F1 before and after normalization from AUCs for formatting-only and length-only features.Source: Table 1 · p. 4

5.1 Format Counterfactuals

  • Admissible transformations alter formatting or punctuation but preserve every word, with machine-checkable verification of word identity.The whitespace operator rewraps lines and adjusts spacing and punctuation using separately measured human and machine profiles for each subset.Source: §5.1 · p. 4
  • The Artifact Reliance Score compares reversals under a human-format counterfactual against a placebo edit that does not move text toward the human class.Both edits are evaluated on the same initially correct machine documents, and their difference is tested with a paired bootstrap.Source: §5.1 · p. 4
  • The primary score statistic uses machine-score drops across all machine documents to avoid selection inflation, while low machine-class recall leaves little probability mass to move.The method reports machine-class recall alongside the statistics; the threshold-free statistic is comparable across detector families.Source: §5.1 · pp. 4–5
  • The operator framework can cover formatting dimensions beyond whitespace when changes are machine-checkable, class profiles are estimable, and transformations work in both directions.Whitespace is used where the probe selects it; mean word length on abstract collections is lexical and has no admissible operator.Source: §5.1 · p. 5

6 Experimental Setup

The experiments evaluate representative fine-tuned and zero-shot detectors using balanced training and held-out test samples for each subset.

6 Experimental Setup

  • The study uses DeBERTa-v3-base as its representative fine-tuned model.It also uses Binoculars (Hans et al., 2024) and Fast-DetectGPT (Bao et al., 2024) as representative zero-shot likelihood methods.Source: §6 · p. 5
  • Binoculars and Fast-DetectGPT require no fine-tuning, avoiding the need to train a detector for every domain and generator.Fast-DetectGPT is described as an efficient variant of DetectGPT (Mitchell et al., 2023).Source: §6 · p. 5
  • Each subset uses up to 20,000 balanced training documents and 1,000 balanced held-out test documents, subject to availability.The surface-probe and counterfactual experiments use the samples and operators specified in Sections 4.1 and 5.1.Source: §6 · p. 5

7 Results

Results show that formatting artifacts affect detector performance and artifact reliance, with exploitability depending on tokenizer family. Normalizing formatting before training improves transfer from artifact-containing subsets to format-clean benchmarks.

7.1 Baseline Detectors

  • Across the arXiv subsets, the best detector reached 0.868, below the surface probe’s 0.951–0.997 macro-F1.Table 2 reports three baseline detectors across ten subsets under a random split; its columns characterize surface separability, perturbation behavior, and detector difficulty rather than providing a single dataset verdict.Source: §7.1 · p. 5, Table 2 · p. 5

7.2 Artifact Reliance

  • 42–58% of chatgpt-detector-roberta’s correct decisions on machine-written arXiv abstracts reversed after re-wrapping, relative to placebo; its unconditioned margin was +0.20 to +0.27.The conditioned ARSnet was consistently larger than the placebo-corrected ∆net. The HC3 detector relied most on formatting, OpenAI’s GPT-2 detector less, and RADAR showed no reliance on arXiv subsets (−0.004).Source: §7.2 · p. 5, Table 3 · p. 6
  • On IDMGSP, chatgpt-detector-roberta reversed sign (−0.171, CI [−0.206, −0.138]); imposing the machine profile flipped 41.8% of correct decisions, versus 7.9% for the human profile.CHEAT, whose classes do not differ in formatting, showed a null result (−0.010, CI spanning zero); imposing the machine profile on correctly classified human documents flipped at most 2% for any detector.Source: §7.2 · pp. 5–6

7.3 Meaning of Diagnostic

  • The probe’s macro-F1 correlated with chatgpt-detector-roberta’s ARSnet (ρ = 0.939, p = 0.0001), but diagnostics did not predict cross-benchmark degradation (probe macro-F1 ρ = −0.164, p = 0.65).Formatting-only AUC also correlated with ARSnet (ρ = 0.770, p = 0.0092), while lexical TF-IDF did not (ρ = −0.552, p = 0.098); surface separability and transfer failure are distinct benchmark properties.Source: §7.3 · p. 6

7.4 Transfer and Normalization

  • 0.995–0.997 in-domain on arXiv but 0.333 on every format-clean benchmark, RoBERTa’s raw-text results contrast with DeBERTa’s inability to represent whitespace cues.DeBERTa’s SentencePiece tokenizer collapses whitespace runs and discards newlines; its performance is at the level of a probe without formatting features (0.729–0.752).Source: §7.4 · p. 7, Table 4 · p. 7
  • 0.320 to 0.216, normalization reduced the decontaminated generalization gap; on arXiv-to-four-format-clean transfers, mean macro-F1 rose from 0.333 to 0.652.On subsets without formatting artifacts, performance barely changed, including CHEAT (0.958 to 0.964) and GPABench2 CS (0.995 to 0.995).Source: §7.4 · p. 7
  • Cluster-aware splitting cost RoBERTa 0.005 macro-F1 and DeBERTa 0.006; observed duplication did not measurably inflate reported scores.The experiments excluded test documents sharing a near-duplicate with training data.Source: §7.4 · p. 7
  • On arXiv subsets, surface-bias reweighting collapsed to majority-class prediction (0.333±0.000) and degraded in-domain and out-of-domain results; it helped where the bias model was informative but unsaturated.For example, GPABench2 CS out-of-domain performance rose from 0.733 to 0.748, while arXiv reweighting degraded from 0.981 to 0.836 in-domain and 0.662 to 0.657 out-of-domain.Source: §7.4 · p. 7

8 Discussion

On the three arXiv subsets, content-free surface features outperform a fine-tuned transformer, while tokenizer visibility can make that cue unevenly available. The authors recommend normalizing surface form before release and reporting surface-probe results.

8 Discussion

  • 0.18-0.31 macro-F1 is the surface-feature logistic regression’s advantage over a fine-tuned transformer on the three arXiv subsets.The authors argue these benchmarks can be played without access to lexical content.Source: §8 · p. 7
  • Only some tokenizer families expose the cue, so system comparisons may reflect whether a model erases exploitable artifacts rather than detector quality alone.The authors are unaware of benchmarks documenting which tokenizer family the artifact advantages.Source: §8 · pp. 7–8
  • Normalize human documents to the same surface form as generated text before release, and ship the surface-probe score and per-feature AUCs.The authors attribute the defect to document processing.Source: §8 · p. 8

9 Conclusion

The authors audited ten scientific-document subsets from six resources and found that document assembly can make benchmarks separable through content-free surface cues. They recommend normalizing surface form and publishing a surface-probe score alongside each resource.

9 Conclusion

  • Across ten scientific-document subsets from six resources, the authors found that document assembly can create benchmark difficulty artifacts detectable through content-free surface features.On arXiv subsets, whitespace inherited from human-document collection is the dominant cue.Source: §9 · p. 8
  • A logistic regression over content-free surface features matches or exceeds the corresponding shared-task winners, with whitespace dominant on the arXiv subsets.The whitespace cue is inherited from how human documents were collected.Source: §9 · p. 8
  • The authors recommend normalizing surface form before release and publishing a surface-probe score alongside every resource.Source: §9 · p. 8

Limitations

The paper’s scope is ten English scientific subsets from six resources, and it does not claim effects transfer to other languages or domains. Its implementation uses seeded random and cluster-aware splits, and Table 6 supplies shared-task comparison scores.

Limitations

  • The study covers ten subsets from six resources, all English and scientific, and does not claim transfer beyond those domains or languages.The formatting artifact is specific to collection pipelines rather than machine-generated text itself; the authors believe its cause is common because the pipeline is widely used.Source: Limitations · p. 8
  • ARSnet should not rank detectors with very unequal accuracy, and correlations across ten subsets support qualitative rather than precise conclusions.The measured detectors’ machine-class recall ranges from 0.20 to 0.978, shrinking the score denominator as recall falls.Source: Limitations · p. 8
  • The fine-tuned baseline is one architecture at one size, and the counterfactual operators cover whitespace and punctuation style only.The authors cannot exclude higher scores from a larger or better-tuned model; other structural operators are future work.Source: Limitations · p. 8

A Implementation and Hyperparameters

  • Implementation uses shared split seed 0, three training seeds, random or cluster-aware splits, and excludes transfer tests with training near-duplicates.The surface probe uses 27 features and five-fold stratified cross-validation; counterfactual runs use 500 documents per class per subset in four variants, while the fine-tuned detector is DeBERTa-v3-base for three epochs.Source: A Implementation and Hyperparameters · pp. 10–11

B Evaluation results of competitions

C Intra-Benchmark Duplication

Near-duplicate groups are substantial in some subsets, but cluster-aware splitting did not measurably inflate in-domain scores. The subset construction details describe the scientific documents and their human and machine counts.

C Intra-Benchmark Duplication

  • Replacing random splits with cluster-aware splits changed in-domain macro-F1 by 0.005/0.006, with inconsistent signs across subsets; authors found no measurable effect and characterize duplication as not a source of score inflation.M4 arXiv, at 35% duplication, moved from 0.740 to 0.687, within seed variance. The authors describe duplication as a defect in effective dataset size and in interpreting a nominally balanced split.Source: C Intra-Benchmark Duplication · p. 11

D Subset Construction Details

  • The ten subsets are English scientific documents with machine texts written from scratch; Table 8 reports human and machine counts, median length, and generator counts.M4 scientific subsets were isolated by domain field, and documents under five whitespace tokens were dropped.Source: D Subset Construction Details · p. 11, Table 8 · p. 12
Loading 2610.13583v1…