DP-MGTD: Privacy-Preserving Machine-Generated Text Detection via Adaptive Differentially Private Entity Sanitization

Haoyang Li; Jiabin Luo; Lionel Z. Wang; Lixu Wang; Wei Dong; Xiaofeng Wang; Xinfeng Li; Yinan Peng; Yusheng Zhao

REVIEW 4 major objections 4 minor 3 references

Adding calibrated privacy noise to text sharpens, not blurs, the boundary between human and machine authorship, lifting detection to near-perfect accuracy while claiming a strict differential-privacy guarantee.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-03 11:58 UTC pith:XZDLMD65

load-bearing objection Novel idea, broken DP proof, and confounded experiments: the core privacy guarantee fails because truncation leaks entity presence, and the F1 gains are not isolated from classifier capacity. the 4 major comments →

arxiv 2601.04641 v2 pith:XZDLMD65 submitted 2026-01-08 cs.CR cs.CLcs.LG

DP-MGTD: Privacy-Preserving Machine-Generated Text Detection via Adaptive Differentially Private Entity Sanitization

Lionel Z. Wang , Yusheng Zhao , Jiabin Luo , Xinfeng Li , Lixu Wang , Yinan Peng , Haoyang Li , XiaoFeng Wang

show 1 more author

Wei Dong

This is my paper

classification cs.CR cs.CLcs.LG

keywords machine-generated text detectiondifferential privacyentity sanitizationadaptive budget allocationLaplace mechanismExponential mechanismsensitivity fingerprinttext perturbation

verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper claims to have resolved the apparent conflict between privacy and authorship detection by making the privacy mechanism itself the detector's best feature. DP-MGTD sanitizes sensitive entities with calibrated noise—Laplace for numbers, Exponential for names—but instead of degrading the text, the perturbation exposes a 'sensitivity fingerprint' that differs between human and machine writing. On MGTBench-2.0 across five LLMs and three domains, the method lifts model-based detection from near-chance to F1 above 0.99, and improves every metric-based baseline, all while claiming a strict epsilon-total differential-privacy guarantee. If this holds, privacy constraints become a source of discriminative signal rather than an obstacle.

Core claim

The central claim is that machine-generated text and human text respond differently to differentially private entity perturbation: human prose is relatively stable under noise, while machine text shows distinct sensitivity patterns. By sampling each input at many privacy levels (epsilon from 0.1 to 2.0), the framework builds a temporal feature matrix that a small LSTM learns to read almost perfectly. The authors argue this is not an artifact of one model—the gain persists across dense, mixture-of-experts, and black-box LLMs, and across STEM, Humanities, and Social Sciences. The paper frames this as a new paradigm: privacy mechanisms can uncover latent distributional distinctions between huma

What carries the argument

The adaptive differentially private entity sanitization module: a two-stage mechanism that first estimates entity frequencies with a Laplace-based noisy count, then allocates the remaining privacy budget proportionally to each entity type's sensitivity, pre-defined weight, and noisy count. Numerical entities are perturbed with the Laplace mechanism, textual entities with the Exponential mechanism over a replacement candidate set. The sequence of sanitized versions across a grid of epsilon values forms a 'perturbation trajectory' that serves as the classifier's input.

Load-bearing premise

The formal epsilon-total differential-privacy bound holds only if the budget-allocation weights and noisy counts used to set each entity's noise scale are independent of the raw private data—but the weighting formula in the appendix uses true entity counts, which would make the noise scale data-dependent and void the guarantee.

What would settle it

An auditor could run the exact allocation rule from Appendix A.1 on two texts that differ only in one extra entity occurrence, compare the output distributions, and check whether the privacy-loss ratio exceeds exp(epsilon_total); if it does, the claimed strict guarantee fails. Alternatively, replace the DP noise with independent noise of the same magnitude not calibrated by sensitivity: if detection accuracy stays near 0.99, the 'privacy' mechanism is not the driver, only the perturbation itself.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

Model-based detectors can operate on sanitized text with near-perfect accuracy, enabling privacy-preserving delegation of authorship checks to third parties.
Privacy noise, when adaptively calibrated, can serve as an adversarial augmentation that strengthens detection rather than weakening it, reversing the usual privacy-utility trade-off.
The sensitivity fingerprint generalizes across LLM architectures and domains, so detectors built this way do not need to know the generating model in advance.
Even coarse epsilon grids (d=10) retain the discriminative signal, meaning the method is robust to hyperparameter selection and cheap to deploy.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

If the effect is real, it suggests a broader class of detection that probes how text reacts to perturbation rather than reading static surface features—potentially reusable for single-pass detection by learning a perturbation-response model instead of sampling many epsilon levels at inference time.
The paper does not isolate whether the DP calibration (sensitivity-proportional noise) or the mere act of perturbing entities creates the fingerprint; a test that swaps DP noise for independent noise of the same magnitude would clarify the mechanism.
A caution follows: if attackers learn that detection relies on perturbation response, they could add noise to machine text to mimic human stability, so the signal may be erasable by adversarial post-processing.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Desk Editor's Note

Novel idea, broken DP proof, and confounded experiments: the core privacy guarantee fails because truncation leaks entity presence, and the F1 gains are not isolated from classifier capacity.

read the letter

The paper has a genuinely interesting idea: use the perturbation trajectory of a text under different DP budgets as a supervised feature for machine-generated-text detection, and allocate the DP budget adaptively based on noisy counts. That framing is fresh, and the two-stage mechanism (noisy counting, then Laplace/Exponential perturbation) is a sensible design target. The writing is clear and the related work is covered well enough.

The problem is that the central privacy claim does not survive contact with the mechanism. The stress-test note is right. Algorithm 1 processes min(c_tau, tilde{c}_tau) instances per entity type and truncates the rest. Because tilde{c}_tau is clamped to be at least 1 whenever the entity type appears, the output always contains at least one token of any type that is present in the input, and no token of a type that is absent. Two adjacent inputs that differ on the presence of a single PERSON entity produce outputs with disjoint support: one has a PERSON token, the other does not. That gives infinite privacy loss for every output in the support, so Definition 3.1 is violated for any finite epsilon_total. The composition proof in Eq. (11) is invalid because the number of mechanisms and the truncation decisions are data-dependent queries with no noise. The data-dependent weights in Appendix A.1 Eq. (15) are another leak, but the truncation alone is enough to sink the guarantee.

The empirical claims are also not isolated. The “Ours” pipelines are trained LSTM classifiers on 30 perturbed views; the baselines are zero-shot metrics and a RoBERTa-F that appears to collapse to a constant 0.667 in almost every cell. There is no ablation that feeds raw text or non-DP perturbations through the same multi-view classifier. So the reported “amplification” could easily be an artifact of added classifier capacity and the 30-view input, not the DP noise itself. There are no error bars, no code or data, and the unpublished candidate list blocks replication. The paper’s own Limitations section concedes the missing mathematical account and the entity-density dependence.

What’s worth keeping: the perturbation-trajectory feature is a promising direction, and the adaptive-budget idea could be repaired by using fixed public weights, processing a fixed number of entity slots, and padding outputs to a fixed length. But as written, the load-bearing claims fail.

I would bring this to a reading group as a cautionary example of why composition theorems do not forgive data-dependent mechanism counts. I would not cite it as a reliable method. If I were an editor, I would send it to peer review, because the idea deserves a serious referee and the flaws are instructive; but the expected outcome would be major revision or rejection on the current evidence.

Referee Report

4 major / 4 minor

Summary. The paper proposes DP-MGTD, a framework for privacy-preserving machine-generated text (MGT) detection. Raw text is sanitized by an adaptive differentially private entity sanitization algorithm: Stage 1 performs noisy frequency estimation of entity types with a Laplace mechanism; Stage 2 allocates the remaining privacy budget proportionally to entity sensitivity and noisy counts, then perturbs numerical entities with Laplace noise and textual entities with the Exponential mechanism. The sanitized text is passed to downstream metric-based or model-based detectors, and a 'sensitivity fingerprint' is formed by varying the privacy budget over 30 levels and extracting per-level features. The paper claims the scheme satisfies strict epsilon_total-DP via sequential composition (Eq. (11)), and reports F1 scores above 0.99 for model-based detectors, substantially outperforming non-private baselines on MGTBench-2.0 across five LLMs and three domains.

Significance. If the central claims held, this would be a noteworthy contribution: a DP mechanism that protects sensitive entities while empirically improving MGT detection accuracy through a newly identified 'sensitivity fingerprint' phenomenon. The manuscript is strong in scope and presentation: it targets a real deployment conflict, uses a public benchmark, reports detailed hyperparameters, and acknowledges in its Limitations section that the theoretical basis for the observed amplification is not yet established. However, the paper's core privacy proof is invalid as written, and the empirical comparison does not isolate the claimed phenomenon. Since the strict-DP guarantee is a headline contribution and the experimental evidence is confounded, the current significance is limited and the paper cannot be accepted in its present form.

major comments (4)

[Section 4.2, Algorithm 1, Eq. (11)] The epsilon_total-DP proof is invalid. Algorithm 1 (lines 10–11) processes only min(c_tau, tilde{c}_tau) entity instances and truncates the rest. The sanitized output therefore contains exactly min(c_tau, tilde{c}_tau) tokens of each entity type. For adjacent inputs differing by the presence of one PERSON entity, one output contains a PERSON token and the other does not; the two output distributions have disjoint supports, so the privacy loss is infinite for any finite epsilon_total. Theorem 3.3 (sequential composition) applies only when the number of mechanisms and their data-dependence are fixed; here the truncation decision is a data-dependent query with no privacy accounting. This undermines the 'strict privacy guarantees' claimed in the abstract and Section 4.2.
[Appendix A.1 Eq. (15) vs Section 4.2] The allocation weights w_i in Eq. (15) are computed from true per-text entity counts: w_i = w_base * log(sensitivity_i + 1) * (count_i + 1). Section 4.2 treats w_tau as a predefined input, but the implementation appears to use data-dependent weights. This makes the per-instance budgets epsilon_tau in Eq. (8) depend on the private input, so the composition bound in Eq. (11) is not a valid DP argument even setting aside the truncation leak. If the authors intended to use only noisy counts in Eq. (15), the text must say so explicitly and the proof must be reworked; however, the truncation issue in Algorithm 1 remains.
[Sections 5.2–5.3, Table 1] The headline empirical claim—that DP noise amplifies distinguishability—is not isolated. 'Ours' pipelines feed an LSTM with a 30×3 (or 30×K) feature matrix built from 30 sanitized variants, whereas the baselines are zero-shot metrics on a single raw text or fine-tuned classifiers on raw text. The large F1 gain could result from the extra 30 views, the LSTM classifier, or the feature representation, rather than from the DP perturbation itself. To support the 'sensitivity fingerprint' phenomenon, the authors need ablations: e.g., the same LSTM on 30 raw-text variants without sanitization, or a single sanitized view with the same classifier, or a non-private sanitization baseline such as random masking. Without these controls, the experimental result does not demonstrate the causal claim.
[Appendix A.3, Limitations] The filtering criteria in Appendix A.3 (length constraints, at least one numerical and one textual entity, density > 0.003) alter the dataset composition, but it is not stated whether the baselines were evaluated on the same filtered subset. This is important because the method relies explicitly on entity presence and density, and the baselines may be at an unfair disadvantage if they are evaluated on the full MGTBench-2.0. Additionally, the Limitations section concedes that a 'comprehensive mathematical proof' of the noise-amplification phenomenon is not provided; this is consistent with the absence of a precise definition or independent operationalization of the 'sensitivity fingerprint.'

minor comments (4)

[Table 1] The RoBERTa-F baseline F1 is 0.667 across almost all LLM/domain combinations, which is suspiciously constant and suggests a possible implementation artifact (e.g., an untrained or default classifier). Please verify and report details.
[Algorithm 1 / Figure 1] In Algorithm 1, V_x is a set but the union operation in line 18 is not clearly defined; Figure 1 shows an 'Adaptive Parameter Control' arrow from sanitized entities to Stage 2 that is not described in the algorithm. Please align the figure with the pseudocode.
[Equation (17)] The utility function u is described as binary (1 if t' = t, 0 otherwise). The Exponential Mechanism then reduces to a keep-or-sample-uniform rule; the sensitivity of u and the resulting probability P_keep should be stated explicitly to make the mechanism reproducible.
[Related work / typography] There are typographical artifacts such as 'Pr ϵϵMPT' in Section 2.1, 'DistillBert-F' in Table 1, and inconsistent use of 'MGTBench-2.0' vs 'MGTBench'. These should be cleaned up.

Circularity Check

0 steps flagged

No significant circularity: the detection-gain claim is an independent supervised result and the privacy-proof problem is an invalidity, not a self-referential reduction.

full rationale

The paper's central empirical claim—that DP perturbation trajectories improve MGT detection—is established by training a supervised LSTM on sanitized-text features and evaluating it on a held-out 20% test split (Section 5.2, Appendix A.4). This is an independent measurement, not a prediction forced by construction: the feature definitions do not encode the labels, and the perturbation features are not fitted parameters derived from the labels. The privacy argument in Eq. (11) is an algebraic budget-accounting exercise using the standard sequential composition theorem; it is not circular, although it is invalid because Algorithm 1's truncation at min(c_tau, tilde c_tau) makes the output support depend on the true entity count, and Appendix Eq. (15) uses raw counts in the weights. Those are correctness flaws, not reductions of the conclusion to the premises. There are no load-bearing self-citations, no imported uniqueness theorem, and no ansatz smuggled in via citation; the cited mechanisms (Laplace, Exponential, composition) are standard and externally defined. The paper itself candidly states in Limitations that no mathematical proof of the amplification phenomenon is provided, which further confirms the claim is empirical rather than definitional.

Axiom & Free-Parameter Ledger

6 free parameters · 5 axioms · 1 invented entities

The framework rests on standard DP machinery plus three domain assumptions: NER completeness, a calibrated unnamed proxy model, and the existence of an intrinsic human-versus-machine perturbation-response difference. The free parameters are the hand-set epsilon grid, the w_base weights, sensitivity caps, the entity-density filter, and the unpublished candidate-name pool. The headlining phenomenon is assumed rather than independently evidenced: the paper's own Limitations section admits there is no comprehensive mathematical proof of the noise-detector interaction and that key masking/perturbation baselines were not run.

free parameters (6)

Privacy budget grid (epsilon levels) = 30 levels, linearly spaced 0.1 to 2.0
Perturbation dimension d=30 chosen by hand; Table 2 shows d=60 slightly worse, so d=30 is effectively tuned and used in all headline F1 numbers.
Base entity weight w_base = 0.3 for numbers, 0.25 for persons
Appendix A.1 calls these 'empirical constants'; they directly shape epsilon allocation and therefore every sanitized output and every measured trajectory.
Entity sensitivity caps = 10,000 (CARDINAL/MONEY), 29 (DATE), 59 (TIME)
Hand-set caps in A.1 determine Laplace noise scale; no justification or sensitivity analysis is provided.
Entity density / length filters = length 100-15000 chars; >=1 numeric and >=1 textual entity; density threshold 0.003
Appendix A.3 filters the dataset. If the same filter is not applied to baselines, the comparison is confounded; the paper does not state that baselines use the filtered subset.
Candidate replacement list for textual entities = unpublished 'compiled list of common names'
The Exponential mechanism's output distribution depends on the candidate pool size; the pool is not published, blocking replication and affecting utility.
Feature window K = 30 tokens
Model-based features truncate embeddings to the first K tokens; the choice is unmotivated and interacts with entity positions in the text.

axioms (5)

standard math Correctness of DP primitives: Laplace mechanism (Lemma 3.1), Exponential mechanism (Lemma 3.2), sequential composition (Theorem 3.3).
These are correctly stated standard results; the composition arithmetic in Eq. (11) is valid given fixed budgets.
domain assumption Allocation weights w_tau are independent of the private input; only epsilon_cnt-protected noisy counts feed Eq. (8).
Required for the Eq. (11) proof to establish epsilon_total-DP; contradicted by Appendix A.1 Eq. (15), which uses per-text true counts count_i.
domain assumption spaCy en_core_web_sm correctly identifies all and only the sensitive entities.
NER errors would leave entities unperturbed (privacy leak) or perturb non-entities (utility loss); no NER accuracy analysis is provided.
domain assumption The unspecified proxy language model M_proxy yields calibrated likelihood scores for the Mann-Whitney and Cohen-d features in Eq. (12).
Strategy I features require a proxy model that is never named; different proxies would change all reported metric-based F1 values.
ad hoc to paper The observed separability under DP perturbation reflects authorship-specific response patterns, not entity density or dataset composition.
This is the 'counter-intuitive phenomenon' asserted in Sections 1 and 5.3; the paper's Limitations admit no mathematical proof and no isolation from entity-density effects.

invented entities (1)

Sensitivity fingerprint (intrinsic stability pattern of machine text under DP perturbation) no independent evidence
purpose: Explains why DP noise improves detection; the paper's central explanatory construct.
Operationally defined only by the fitted trajectory features inside this paper; no falsifiable handle outside the paper, and the paper's Limitations admit the absence of a theoretical account. The separability could be driven by entity density or classifier-capacity confounds.

pith-pipeline@v1.3.0-alltime-deepseek · 13876 in / 29325 out tokens · 304585 ms · 2026-08-03T11:58:45.929472+00:00 · methodology

0 comments

read the original abstract

The deployment of Machine-Generated Text (MGT) detection systems necessitates processing sensitive user data, creating a fundamental conflict between authorship verification and privacy preservation. Standard anonymization techniques often disrupt linguistic fluency, while rigorous Differential Privacy (DP) mechanisms typically degrade the statistical signals required for accurate detection. To resolve this dilemma, we propose \textbf{DP-MGTD}, a framework incorporating an Adaptive Differentially Private Entity Sanitization algorithm. Our approach utilizes a two-stage mechanism that performs noisy frequency estimation and dynamically calibrates privacy budgets, applying Laplace and Exponential mechanisms to numerical and textual entities respectively. Crucially, we identify a counter-intuitive phenomenon where the application of DP noise amplifies the distinguishability between human and machine text by exposing distinct sensitivity patterns to perturbation. Extensive experiments on the MGTBench-2.0 dataset show that our method achieves near-perfect detection accuracy, significantly outperforming non-private baselines while satisfying strict privacy guarantees.

Figures

Figures reproduced from arXiv: 2601.04641 by Haoyang Li, Jiabin Luo, Lionel Z. Wang, Lixu Wang, Wei Dong, Xiaofeng Wang, Xinfeng Li, Yinan Peng, Yusheng Zhao.

discussion (0)

Reference graph

Works this paper leans on

3 extracted references · 3 linked inside Pith

[2023]

arXiv preprint arXiv:2306.05540

Detectllm: Leveraging log rank information for zero-shot detection of machine-generated text. arXiv preprint arXiv:2306.05540. Meng Tong, Kejiang Chen, Jie Zhang, Yuang Qi, Weim- ing Zhang, Nenghai Yu, Tianwei Zhang, and Zhikun Zhang. 2025. Inferdpt: Privacy-preserving inference for black-box large language models.IEEE Transac- tions on Dependable and Sec...

Pith/arXiv arXiv 2025
[2024]

Xinlei He, Xinyue Shen, Zeyuan Chen, Michael Backes, and Yang Zhang

Spotting llms with binoculars: Zero-shot detection of machine-generated text.arXiv preprint arXiv:2401.12070. Xinlei He, Xinyue Shen, Zeyuan Chen, Michael Backes, and Yang Zhang. 2024. Mgtbench: Benchmarking machine-generated text detection. InProceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, pages 2251–2265. Daphne...

Pith/arXiv arXiv 2024
[2025]

Rian Dolphin, Joe Dursun, Jonathan Chow, Jarrett Blankenship, Katie Adams, and Quinton Pike

Security and privacy challenges of large lan- guage models: A survey.ACM Computing Surveys, 57(6):1–39. Rian Dolphin, Joe Dursun, Jonathan Chow, Jarrett Blankenship, Katie Adams, and Quinton Pike. 2024. Extracting structured insights from financial news: An augmented llm driven approach.arXiv preprint arXiv:2407.15788. Abhimanyu Dubey, Abhinav Jauhri, Abh...

Pith/arXiv arXiv 2024

[1] [2023]

arXiv preprint arXiv:2306.05540

Detectllm: Leveraging log rank information for zero-shot detection of machine-generated text. arXiv preprint arXiv:2306.05540. Meng Tong, Kejiang Chen, Jie Zhang, Yuang Qi, Weim- ing Zhang, Nenghai Yu, Tianwei Zhang, and Zhikun Zhang. 2025. Inferdpt: Privacy-preserving inference for black-box large language models.IEEE Transac- tions on Dependable and Sec...

Pith/arXiv arXiv 2025

[2] [2024]

Xinlei He, Xinyue Shen, Zeyuan Chen, Michael Backes, and Yang Zhang

Spotting llms with binoculars: Zero-shot detection of machine-generated text.arXiv preprint arXiv:2401.12070. Xinlei He, Xinyue Shen, Zeyuan Chen, Michael Backes, and Yang Zhang. 2024. Mgtbench: Benchmarking machine-generated text detection. InProceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, pages 2251–2265. Daphne...

Pith/arXiv arXiv 2024

[3] [2025]

Rian Dolphin, Joe Dursun, Jonathan Chow, Jarrett Blankenship, Katie Adams, and Quinton Pike

Security and privacy challenges of large lan- guage models: A survey.ACM Computing Surveys, 57(6):1–39. Rian Dolphin, Joe Dursun, Jonathan Chow, Jarrett Blankenship, Katie Adams, and Quinton Pike. 2024. Extracting structured insights from financial news: An augmented llm driven approach.arXiv preprint arXiv:2407.15788. Abhimanyu Dubey, Abhinav Jauhri, Abh...

Pith/arXiv arXiv 2024