Pith. sign in

REVIEW 3 major objections 5 minor 36 references

Attacks on Machine-Text Detectors Retain Stylistic Fingerprints

T0 review · 3 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Machine text rewritten to imitate a specific author fools every tested detector on a single document, but not on several.

desk verdict New style-aware paraphrasing attack evades style detectors at N=1, but the abstract's multi-document recovery claim is not supported by the paper's own domain-specific results. read the letter →

arxiv 2505.14608 v3 pith:R2UWJLIK submitted 2025-05-20 cs.CL cs.AIcs.LG

Rafael Rivera Soto , Barry Chen , Nicholas Andrews This is my paper
classification cs.CLcs.AIcs.LG
keywords machine-textdetectionwritingstylestyle-awareparaphrasingdirectpreferenceoptimizationfew-shotauthorshipembeddingsadversarialattacksondetectorsmulti-document
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper asks whether the stylistic fingerprint of machine-generated text is a reliable basis for detection. It first confirms that optimizing a language model to fool token-level detectors, via direct preference optimization against FastDetectGPT, leaves its writing style intact, so a few-shot style-based detector still separates machine from human text with high accuracy. It then introduces a style-aware paraphraser that rewrites machine text to imitate a specific human author, and shows this attack evades every detector tested when only one document is available. The key limit is that as the number of samples grows, the human and machine distributions become separable again, which the authors take as evidence that reliable detection must use multiple documents per source.

What carries the argument

The load-bearing object is the style-aware paraphraser: a Mistral-7B model instruction-tuned to rewrite machine-generated paraphrases into the style of a target author using a few in-context exemplar pairs, and then preference-tuned with DPO against a detector trained to distinguish its own outputs from human text. The other half of the machinery is the stylistic feature space itself, authorship embeddings such as LUAR, CISR, and StyleDistance, which separate authors' writing styles and serve as the substrate for StyleDetect. The paraphraser is designed to close the gap in that space while also evading the surface-level features exploited by token-level detectors.

What would settle it

Test the paraphraser against a style detector built on a different representation, such as character n-gram stylometry or a transformer trained on function-word frequencies: if the detector reaches AUROC above 0.9 on single documents, the universality claim fails. Alternatively, train an attack that directly maximizes similarity to human exemplars in the LUAR embedding space, rather than through a general paraphraser, and check whether the human and machine distributions stay distinguishable at N=50; if they stay at chance, the multi-sample claim fails.

Watch

Extended reading notes

Core claim

Optimizing a generator against surface-level detectors does not erase the underlying style; StyleDetect, which compares a sample's authorship embedding to machine-class exemplars, keeps AUROC near 0.95-0.98 for models tuned with DPO against FastDetectGPT, and even against StyleDetect itself. The paper's new attack, a Mistral-7B paraphraser fine-tuned first to map machine paraphrases back to a target author's originals and then optimized with DPO against a detector trained on its own outputs, closes the gap in stylistic feature space. At one sample, no detector among nine, including style-based variants using LUAR, CISR, and StyleDistance, exceeds chance performance; but with 5-50 samples, the best detector's AUROC(10) climbs, showing the distributions remain statistically distinct. The central claim is that single-document detection is unreliable, while multi-document detection restores a usable signal.

Load-bearing premise

The argument that style-based detectors are robust and that the new attack is universally effective assumes that the three style embeddings tested (LUAR, CISR, StyleDistance) stand in for all useful stylistic feature spaces, and that DPO is representative of the strongest optimization an adversary can use.

Editorial extensions

If this is right

  • Single-document machine-text detection is not reliable; even detectors built on writing style can be evaded by a paraphrase that imitates a specific human author.
  • Multi-document analysis restores detectability: for the strongest attack, the best AUROC(10) rises from near chance at N=1 to well above 0.8 as N reaches 10-50, supporting source-level rather than document-level decisions.
  • Style-based detectors are robust against DPO-style optimization of the generator, but this robustness is not inherent: it disappears when the attacker also conditions on a target author's style.
  • The attack transfers to unseen domains (Amazon, Blogs) without retraining, meaning domain diversity alone is not a defense.
  • Token-level and style-level detectors are complementary: the former are easy to attack, the latter survive simple attacks but fall to style-aware imitation.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • An immediate defensive reading: if imitation succeeds from a handful of exemplars, verification systems should treat authorship claims as needing external grounding, not just stylistic similarity.
  • The universality claim is bounded by the tested attack class; an attack that directly optimizes against the style embeddings, rather than through a general paraphraser, could behave differently, so the 'universal' should be read as 'across the detectors and optimizers tested here'.
  • The multi-sample trend points to a concrete evaluation standard: report AUROC as a function of sample size, since a detector can look useless at N=1 yet be strong at N=50.
  • If style imitation keeps improving as LLMs absorb more varied writing, the long-tail assumption, that low-resource author styles are hard to imitate, may erode over time.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper studies the robustness of machine-text detectors to adversarial attacks, with a focus on stylistic features. It first shows that DPO-style optimization against zero-shot detectors such as FastDetectGPT does not degrade the performance of style-based detectors, and then introduces a style-aware paraphraser trained with supervised fine-tuning and DPO to mimic a target human author's style while evading detection. The method is evaluated on Reddit, Amazon, and Blogs against nine detectors, and the results indicate that at the single-document level the attack evades all detectors, but that detection performance improves with sample size in some settings. The paper concludes that reliable detection should move from single-document to multi-document analysis.

Significance. If the results are reproducible, the paper makes a valuable empirical contribution by introducing a strong new attack that closes the stylistic gap between machine and human text more effectively than prior paraphrasing baselines, and by demonstrating that style-based detectors are not inherently immune to optimization. The evaluation is broad in scope, covering three domains, nine detectors, multiple baselines, and ablations over key hyperparameters M, P, and the DPO stage. The main weaknesses are that the key multi-document recovery claim is not consistently supported across domains and is based on point estimates without uncertainty quantification, and the universality of the single-sample attack is not fully demonstrated at the per-detector level in all domains.

major comments (3)
  1. [Abstract and §5.1] The abstract states that 'as the number of samples available for detection grows, the human and machine distributions become distinguishable,' and the conclusion repeats that 'there is a point at which the distributions ... become separable, but it requires a large sample.' However, §5.1 reports that the proposed attack 'remains robust up to 50' on Reddit, and 'transfers well to Amazon,' with recovery observed only in the Blogs domain, where it 'becomes detectable with just 5 samples.' Thus the recovery claim is supported by only one of three domains, and the Blogs recovery occurs at a small sample size, contradicting the 'large sample' phrasing. The abstract and conclusion should be qualified by domain, or additional evidence of recovery in other domains should be provided.
  2. [§5.1, Figure 2] The AUROC(10) curves are reported as point estimates without confidence intervals or significance tests, and the figure plots the maximum AUROC(10) across nine detectors selected on the same test set. Consequently, the observed Blog recovery at N=5 and the flat Reddit/Amazon curves cannot be distinguished from noise, and the selection over detectors may inflate the apparent detectability. The paper should provide error bars or statistical comparisons across repeated test samples, and ideally a held-out procedure for selecting the detector whose curve is reported.
  3. [§5.1, Appendix Figures 7–14] The claim that the attack is 'universally effective across all detectors considered' is based on the maximum AUROC(10) curve, but the per-detector breakdown in the appendix is not clearly labeled by dataset. If Figures 7–14 are only for Reddit, the cross-domain universality of the attack against each individual detector is not demonstrated. Please clarify the dataset for each appendix figure, or provide per-detector results for Amazon and Blogs.
minor comments (5)
  1. [Table 1 caption] The word 'variatns' appears to be a typo for 'variants.'
  2. [§5.1] The sentence 'even in domains for which it was not trained (Amazon and Reddit)' is incorrect because Reddit is the training domain; it should say 'Amazon and Blogs.'
  3. [Appendix A] The captions for Figures 7–14 do not specify the dataset(s) shown; please add the dataset name to each caption.
  4. [§4.3] The inference procedure is described only briefly; please state the number of iterations and the candidate count used in the main evaluation for reproducibility.
  5. [Title] The title in the paper header ('Language Models Optimized to Fool Detectors Still Have a Distinct Style (and How to Change It)') differs from the arXiv title ('Attacks on Machine-Text Detectors Retain Stylistic Fingerprints'); please ensure consistency.

Circularity Check

1 steps flagged · score 2.0 of 10

No derivation-level circularity; the only notable issue is that Section 2's style-robustness claim is established with the authors' own StyleDetect detector.

  1. self citation load bearing [Section 2, paragraph after Table 1]
    "When optimizing against StyleDetect, we observe no significant degradation in the performance of StyleDetect. These results suggest that the features indicative of writing style are distinct from those used by detectors that use features derived from the predicted conditional distributions."

    The paper's Section 2 conclusion that 'the features indicative of writing style are distinct' and that style-based detectors are robust to DPO is based entirely on StyleDetect, a detector proposed by the same authors (Soto et al. 2024) and built on LUAR (Rivera-Soto et al. 2021), also from the same group. The 'stylistic feature space' is instantiated by the authors' own representation, so this result is an evaluation of a self-defined detector rather than an independent test of the general claim. The later StyleDetect-CISR and StyleDetect-SD results (Figure 2) are tested only against the new paraphrasing attack, not against DPO, so the Section 2 generalization to the stylistic feature space rests on the authors' own detector.

full rationale

This is an empirical paper rather than a derivation: no equation reduces to a fitted parameter, and no 'prediction' is equivalent to its input by construction. The DPO stage trains a detector on the system's own outputs, but that is a legitimate attack-training procedure, not a disguised prediction. The only circularity-adjacent issue is the Section 2 generalization from StyleDetect (the authors' own detector) to 'style-based detectors' more broadly; because the paper does not test DPO robustness against the independent CISR or StyleDistance style representations in that section, the general robustness claim leans on a self-citation chain. Separate from circularity, the abstract's unqualified claim that multi-document analysis makes human and machine distributions 'distinguishable again' is not fully supported by the paper's own Figure 2 results (Reddit and Amazon remain undetectable up to N=50, with recovery only in Blogs at N=5); this is a correctness/generalization concern, not a circularity.

Assumptions & free parameters 6 free parameters · 4 assumptions · 0 invented entities

The paper introduces no new theoretical entities such as particles or forces; the style-aware paraphraser is a concrete model artifact, not a postulated entity. The main assumptions are empirical domain assumptions about the validity of style embeddings and the representativeness of the detector set, plus standard DPO machinery.

free parameters (6)
  • M (target exemplars) = 16
    Number of in-context exemplars from the target author used at inference; ablation shows higher M improves stylistic similarity, so the value is a tuning choice, not derived.
  • P (paraphrases per exemplar) = 5
    Number of LLM-generated paraphrases per human original used to build the training context; ablation shows higher P improves style similarity.
  • DPO beta = 5
    Preference optimization temperature; chosen by hand, not derived from first principles.
  • LoRA rank/alpha/dropout = r=32, alpha=64, d=0.1
    Standard LoRA hyperparameters chosen without extensive search; affect training but not central conclusions.
  • Number of StyleDetect machine exemplars K = 100
    Few-shot exemplar count for the StyleDetect detectors; a design choice that affects the detector's reference embedding.
  • Iterative inference candidate count = 10
    Number of candidates generated per iteration; selection uses SBERT similarity. The exact count is reported but not ablated.
assumptions (4)
  • domain assumption The style embeddings (LUAR, CISR, StyleDistance) capture author-specific writing style and are a valid feature space for detection.
    Sections 2 and 5.2 treat these embeddings as ground truth for style; this is inherited from prior work and not proven in this paper.
  • domain assumption DPO reliably optimizes LLMs toward the detector's humanness score.
    Used to construct Mistral-7B-DPO-FastDetectGPT and the DPO stage of the attack; relies on the standard DPO machinery.
  • domain assumption The detectors evaluated (RADAR, ReMoDetect, Rank, LogRank, FastDetectGPT, Binoculars, StyleDetect variants) are representative of machine-text detectors.
    The paper's claims about detection robustness are limited to this set; no argument covers the full space of possible detectors.
  • domain assumption The sample mean of detector scores is the appropriate aggregation for multi-document detection.
    Section 5.1 computes AUROC by averaging per-document scores; other aggregations could yield different results.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Attacks on Machine-Text Detectors Retain Stylistic Fingerprints." pith.science (2026). https://pith.science/paper/R2UWJLIK

@misc{pith2026250514608,
  author       = {Pith},
  title        = {Pith review of: Attacks on Machine-Text Detectors Retain Stylistic Fingerprints},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/R2UWJLIK}},
  note         = {Machine review of arXiv:2505.14608}
}
read the original abstract

Despite considerable progress in the development of machine-text detectors, the ease with which machine-text can be manipulated to evade detection has led to suggestions that the problem is inherently intractable. In this work, we investigate the limits of such evasion strategies. We demonstrate that while current attacks, ranging from prompt engineering to detector-guided optimization can effectively degrade performance of standard detectors, they fail to erase the underlying stylistic "fingerprints" of machine text. We show that few-shot detectors that utilize the stylistic feature space are robust to these evasion attempts, reliably detecting samples even from models explicitly tuned to prevent detection. This raises the question: does style represent a universal defense against machine-detection attacks? We demonstrate that the answer is "no'' by introducing a novel paraphrasing approach that simultaneously optimizes for undetectability and adherence to specific human styles. We show that unlike prior methods, this attack effectively evades all considered detectors, including those that utilize writing style. However, we find that this evasion is not absolute: as the number of documents available for analysis grows, the human and machine distributions become distinguishable again. Overall, our findings suggest that reliable machine-text detection requires moving beyond single-document analysis to multi-document analysis.

Figures

Figures reproduced from arXiv: 2505.14608 by the authors.

Figure 1
Figure 1. (a) UMAP (McInnes et al., 2020) projections of representations that capture writing style for comments in the Reddit domain, using LUAR (Rivera-Soto et al., 2021). Each point corresponds to a document of at most 128 tokens. Despite optimization against FastDetectGPT, the LLM’s writing style remains largely unchanged (compare ▲ with ■). In contrast, our approach better closes the gap between human-written and machine… view at source ↗
Figure 2
Figure 2. Detection performance (AUROC(10), lower is better) of the strongest detector for each sample size and method combination. Our detector evasion approach is the least detectable across all three domains, including Amazon and Blogs, which were not seen during training. examples drawn from random machine-generated text in our dataset that was not produced by any of the evaluated methods. Moreover, we include two additio… view at source ↗
Figure 3
Figure 3. Detection performance (AUROC(10), lower is better) of various detectors as the sample size increases (left: Mistral-7B-DPO-FastDetectGPT, right: Ours). Our detector evasion approach is consistently harder to detect across all detectors. Mistral-7B-DPO-FastDetectGPT becomes detectable with just 5 samples, while our approach remains robust up to 50. We report the performance of all detectors, evaluated on all methods … view at source ↗
Figures from the paper (10 more)
Figure 4
Figure 4. Figure 4: UMAP (McInnes et al., 2020) projections of representations that capture writing style for [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]
Figure 5
Figure 5. Figure 5: Similarity to the target style as a function of [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]
Figure 7
Figure 7. Figure 7: Performance on the baseline text. 0 10 20 30 40 50 N 0.5 0.6 0.7 0.8 0.9 1.0 AUROC(10) ReMoDetect RADAR Rank LogRank FastDetectGPT Binoculars StyleDetect StyleDetect-CISR StyleDetect-SD [PITH_FULL_IMAGE:figures/full_fig_p013_7.png]
Figure 8
Figure 8. Figure 8: Performance on text generated by Mistral-7B-DPO-FastDetectGPT. [PITH_FULL_IMAGE:figures/full_fig_p013_8.png]
Figure 9
Figure 9. Figure 9: Performance of the style-aware paraphrasing prompting baseline with [PITH_FULL_IMAGE:figures/full_fig_p014_9.png]
Figure 10
Figure 10. Figure 10: Performance on text paraphrased by DIPPER. 0 10 20 30 40 50 N 0.5 0.6 0.7 0.8 0.9 1.0 AUROC(10) ReMoDetect RADAR Rank LogRank FastDetectGPT Binoculars StyleDetect StyleDetect-CISR StyleDetect-SD [PITH_FULL_IMAGE:figures/full_fig_p014_10.png]
Figure 11
Figure 11. Figure 11: Performance on text paraphrased by gpt-4o-mini. 14 [PITH_FULL_IMAGE:figures/full_fig_p014_11.png]
Figure 12
Figure 12. Figure 12: Performance of text generated by OUTFOX. 0 10 20 30 40 50 N 0.5 0.6 0.7 0.8 0.9 1.0 AUROC(10) ReMoDetect RADAR Rank LogRank FastDetectGPT Binoculars StyleDetect StyleDetect-CISR StyleDetect-SD [PITH_FULL_IMAGE:figures/full_fig_p015_12.png]
Figure 13
Figure 13. Figure 13: Performance on text paraphrased by TinyStyler. [PITH_FULL_IMAGE:figures/full_fig_p015_13.png]
Figure 14
Figure 14. Figure 14: Performance on text paraphrased by our system. [PITH_FULL_IMAGE:figures/full_fig_p015_14.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

36 extracted references · 10 canonical work pages

  1. [3]

    Aldan Creo and Shushanta Pudasaini

    On the possibilities of ai-generated text detection.Preprint, arXiv:2304.04736. Aldan Creo and Shushanta Pudasaini

    arXiv

  2. [5]

    Julian Hazell

    Spotting llms with binoculars: Zero-shot detection of machine-generated text.Preprint, arXiv:2401.12070. Julian Hazell

    arXiv

  3. [6]

    Zachary Horvitz, Ajay Patel, Chris Callison-Burch, Zhou Yu, and Kathleen McKeown

    Spear phishing with large language models.Preprint, arXiv:2305.06972. Zachary Horvitz, Ajay Patel, Chris Callison-Burch, Zhou Yu, and Kathleen McKeown. 2024a. Paraguide: Guided diffusion paraphrasers for plug-and-play textual style transfer.Proceedings of the AAAI Conference on Artificial Intelligence, 38(16):18216–18224. Zachary Horvitz, Ajay Patel, Kani...

    arXiv

  4. [8]

    Daphne Ippolito, Daniel Duckworth, Chris Callison-Burch, and Douglas Eck

    Radar: Robust ai-text detection via adversarial learning.Preprint, arXiv:2307.03838. Daphne Ippolito, Daniel Duckworth, Chris Callison-Burch, and Douglas Eck

    arXiv

  5. [9]

    A Deep Metric Learning Approach to Account Linking

    A deep metric learning approach to account linking.CoRR, abs/2105.07263. Aleem Khan, Andrew Wang, Sophia Hager, and Nicholas Andrews

    work page Pith review arXiv

  6. [10]

    John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein

    Learning to generate text in arbitrary writing styles.Preprint, arXiv:2312.17242. John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein

    arXiv

  7. [11]

    Ryuto Koike, Masahiro Kaneko, and Naoaki Okazaki

    A watermark for large language models.Preprint, arXiv:2301.10226. Ryuto Koike, Masahiro Kaneko, and Naoaki Okazaki

    arXiv

  8. [12]

    Kalpesh Krishna, John Wieting, and Mohit Iyyer

    Para- phrasing evades detectors of ai-generated text, but retrieval is an effective defense.Preprint, arXiv:2303.13408. Kalpesh Krishna, John Wieting, and Mohit Iyyer

    arXiv

Show all 36 references
  1. [14]

    Hyunseok Lee, Jihoon Tack, and Jinwoo Shin

    Robust distortion- free watermarks for language models.Preprint, arXiv:2307.15593. Hyunseok Lee, Jihoon Tack, and Jinwoo Shin

    arXiv

  2. [15]

    Shuai Liu and Jonathan May

    Authorship style transfer with policy optimization.Preprint, arXiv:2403.08043. Shuai Liu and Jonathan May

    arXiv

  3. [16]

    Preprint, arXiv:2406.11581

    Style transfer with multi-iteration preference optimization. Preprint, arXiv:2406.11581. Ning Lu, Shengcai Liu, Rui He, Qi Wang, Yew-Soon Ong, and Ke Tang

    arXiv

  4. [17]

    Leland McInnes, John Healy, and James Melville

    Large language models can be guided to evade ai-generated text detection.Preprint, arXiv:2305.10847. Leland McInnes, John Healy, and James Melville

    arXiv

  5. [18]

    Eric Mitchell, Yoonho Lee, Alexander Khazatsky, Christopher D

    Umap: Uniform manifold approximation and projection for dimension reduction.Preprint, arXiv:1802.03426. Eric Mitchell, Yoonho Lee, Alexander Khazatsky, Christopher D. Manning, and Chelsea Finn

    arXiv

  6. [19]

    Jianmo Ni, Jiacheng Li, and Julian McAuley

    Detectgpt: Zero-shot machine-generated text detection using probability curvature.Preprint, arXiv:2301.11305. Jianmo Ni, Jiacheng Li, and Julian McAuley

    arXiv

  7. [21]

    11 Ajay Patel, Jiacheng Zhu, Justin Qiu, Zachary Horvitz, Marianna Apidianaki, Kathleen McKeown, and Chris Callison-Burch

    Low-resource authorship style transfer: Can non-famous authors be imitated?Preprint, arXiv:2212.08986. 11 Ajay Patel, Jiacheng Zhu, Justin Qiu, Zachary Horvitz, Marianna Apidianaki, Kathleen McKeown, and Chris Callison-Burch

    arXiv

  8. [22]

    Rafael Rafailov, Archit Sharma, Eric Mitchell, Stefano Ermon, Christopher D

    Styledistance: Stronger content-independent style embeddings with synthetic parallel examples.Preprint, arXiv:2410.12757. Rafael Rafailov, Archit Sharma, Eric Mitchell, Stefano Ermon, Christopher D. Manning, and Chelsea Finn

    arXiv

  9. [23]

    Preprint, arXiv:2305.18290

    Direct preference optimization: Your language model is secretly a reward model. Preprint, arXiv:2305.18290. Rafael A. Rivera-Soto, Olivia Elizabeth Miano, Juanita Ordonez, Barry Y . Chen, Aleem Khan, Marcus Bishop, and Nicholas Andrews

    arXiv

  10. [24]

    InProceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, pages 913–919, Online and Punta Cana, Dominican Republic

    Learning universal authorship representations. InProceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, pages 913–919, Online and Punta Cana, Dominican Republic. Association for Computational Linguistics. Vinu Sankar Sadasivan, Aounon Kumar, Sr...

    2021

  11. [25]

    Jonathan Schler, Moshe Koppel, Shlomo Argamon, and James W

    Can ai-generated text be reliably detected?Preprint, arXiv:2303.11156. Jonathan Schler, Moshe Koppel, Shlomo Argamon, and James W. Pennebaker

    arXiv

  12. [27]

    Rafael Rivera Soto, Barry Chen, and Nicholas Andrews

    Release strategies and the social impacts of language models.Preprint, arXiv:1908.09203. Rafael Rivera Soto, Barry Chen, and Nicholas Andrews

    1908 arXiv

  13. [28]

    Rafael Rivera Soto, Kailin Koch, Aleem Khan, Barry Chen, Marcus Bishop, and Nicholas An- drews

    Mitigating paraphrase attacks on machine-text detectors via paraphrase inversion.Preprint, arXiv:2410.21637. Rafael Rivera Soto, Kailin Koch, Aleem Khan, Barry Chen, Marcus Bishop, and Nicholas An- drews

    arXiv

  14. [29]

    Tianchun Wang, Yuanzhou Chen, Zichuan Liu, Zhanwen Chen, Haifeng Chen, Xiang Zhang, and Wei Cheng

    Few-shot detection of machine-generated text using style representations.Preprint, arXiv:2401.06712. Tianchun Wang, Yuanzhou Chen, Zichuan Liu, Zhanwen Chen, Haifeng Chen, Xiang Zhang, and Wei Cheng

    arXiv

  15. [30]

    Anna Wegmann, Marijn Schraagen, and Dong Nguyen

    Humanizing the machine: Proxy attacks to mislead llm detectors.Preprint, arXiv:2410.19230. Anna Wegmann, Marijn Schraagen, and Dong Nguyen

    arXiv

  16. [32]

    Finetuned language models are zero-shot learners.Preprint, arXiv:2109.01652. Laura Weidinger, Jonathan Uesato, Maribeth Rauh, Conor Griffin, Po-Sen Huang, John Mellor, Amelia Glaese, Myra Cheng, Borja Balle, Atoosa Kasirzadeh, Courtney Biles, Sasha Brown, Zac Kenton, Will Hawk...

    arXiv

  17. [33]

    InProceedings of the 2022 ACM Conference on Fairness, Accountability, and Transparency, FAccT ’22, page 214–229, New York, NY , USA

    Taxonomy of risks posed by language models. InProceedings of the 2022 ACM Conference on Fairness, Accountability, and Transparency, FAccT ’22, page 214–229, New York, NY , USA. Association for Computing Machinery. Xianjun Yang, Wei Cheng, Yue Wu, Linda Petzold, William Yang Wa...

    2022

  18. [34]

    12 A BREAKDOWN OFPERFORMANCE BYMETHOD, DATASET,ANDDETECTOR In this section, we break down the performance of all methods, evaluated on all datasets and detectors

    Dna-gpt: Divergent n-gram analysis for training-free detection of gpt-generated text.Preprint, arXiv:2305.17359. 12 A BREAKDOWN OFPERFORMANCE BYMETHOD, DATASET,ANDDETECTOR In this section, we break down the performance of all methods, evaluated on all datasets and detectors. 0...

    arXiv

  19. [35]

    For the preference- tuning stage, we train our system with β= 5 , and a constant learning rate of 1e−6

    for efficient fine-tuning, setting r= 32 , α= 64 , and d= 0.1 . For the preference- tuning stage, we train our system with β= 5 , and a constant learning rate of 1e−6. For Mistral-7B-DPO-FastDetectGPT, we setβ= 0.1. Compute ResourcesOur system is trained using 8 80Gb A100s for...

    2021

  20. [2006]

    InComputational Approaches to Analyzing Weblogs, Papers from the 2006 AAAI Spring Symposium, Technical Report SS-06-03, Stanford, California, USA, March 27-29, 2006, pages 199–205

    Effects of age and gender on blogging. InComputational Approaches to Analyzing Weblogs, Papers from the 2006 AAAI Spring Symposium, Technical Report SS-06-03, Stanford, California, USA, March 27-29, 2006, pages 199–205. AAAI. Irene Solaiman, Miles Brundage, Jack Clark, Amanda ...

    2006

  21. [2007]

    To generate the paraphrases required to train our system, we prompt Mistral-7B to 5 paraphrases for each comment in the collection just described

    to cluster the authors, sampling evenly across clusters until reaching 63,184 authors which was computationally tractable given our resources. To generate the paraphrases required to train our system, we prompt Mistral-7B to 5 paraphrases for each comment in the collection jus...

    2019

  22. [2019]

    Justifying recommendations using distantly- labeled reviews and fine-grained aspects. InProceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP), pages 188–19...

    2019

  23. [2020]

    Rohith Kuditipudi, John Thickstun, Tatsunori Hashimoto, and Percy Liang

    Reformulating unsupervised style transfer as paraphrase generation.Preprint, arXiv:2010.05700. Rohith Kuditipudi, John Thickstun, Tatsunori Hashimoto, and Percy Liang

    2010 arXiv

  24. [2021]

    10 Xiaomeng Hu, Pin-Yu Chen, and Tsung-Yi Ho

    Lora: Low-rank adaptation of large language models.Preprint, arXiv:2106.09685. 10 Xiaomeng Hu, Pin-Yu Chen, and Tsung-Yi Ho

    arXiv

  25. [2022]

    Jason Wei, Maarten Bosma, Vincent Y

    Same author or just same topic? towards content-independent style representations.Preprint, arXiv:2204.04907. Jason Wei, Maarten Bosma, Vincent Y . Zhao, Kelvin Guu, Adams Wei Yu, Brian Lester, Nan Du, Andrew M. Dai, and Quoc V . Le

    arXiv

  26. [2023]

    Souradip Chakraborty, Amrit Singh Bedi, Sicheng Zhu, Bang An, Dinesh Manocha, and Furong Huang

    Evade chatgpt detectors via a single space.Preprint, arXiv:2307.02599. Souradip Chakraborty, Amrit Singh Bedi, Sicheng Zhu, Bang An, Dinesh Manocha, and Furong Huang

    arXiv

  27. [2024]

    Preprint, arXiv:2310.05130

    Fast-detectgpt: Efficient zero-shot detection of machine-generated text via conditional probability curvature. Preprint, arXiv:2310.05130. Shuyang Cai and Wanyun Cui

    arXiv

  28. [2025]

    Brendan J

    Silverspeak: Evading ai-generated text detectors using homoglyphs.Preprint, arXiv:2406.11239. Brendan J. Frey and Delbert Dueck

    arXiv

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.