Pith. sign in

REVIEW 3 major objections 7 minor 50 references

One robust covariance estimator detects synthetic text, hallucinations, watermarks, and adversarial attacks

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · glm-5.2

2026-07-09 07:54 UTC pith:EE27FRAZ

load-bearing objection Solid theoretical contribution to robust covariance estimation; the detection framework is the weaker half the 3 major comments →

arxiv 2607.07527 v1 pith:EE27FRAZ submitted 2026-07-08 stat.ML cs.LG

A Unified Detection Framework for AI-Related Content and Artifacts

Xifeng Zhang , Tao Hu , Yijie Peng , Wan Tian This is my paper
classification stat.ML cs.LG MSC 62H12
keywords Mahalanobis distancerobust covariance estimationminimum covariance determinantAI content detectionbreakdown pointHadamard decompositionanomaly detection
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper argues that four seemingly different AI oversight problems—spotting LLM-generated text, catching hallucinated statements, detecting watermarked output, and flagging adversarial examples—reduce to the same statistical question: does a sample's deep representation deviate from the distribution of known-good samples? The authors propose using Mahalanobis distance scores (MDS) against a robustly estimated covariance of positive-class representations as a single, unified black-box detector. The central technical contribution is a pair of joint minimum covariance determinant (MCD) estimators—casewise and cellwise—that handle multi-class positive samples where classes share some covariance structure but differ in other respects. This sharing is captured by a Hadamard product decomposition of each class's covariance matrix into a shared pattern and a class-specific component, with L1 penalties enforcing sparsity. The authors prove these joint estimators converge to blockwise-stationary points and achieve high breakdown points, meaning they tolerate a provable fraction of contaminated data before the estimates become unbounded. Experiments across all four detection tasks show the framework is competitive with specialized methods, and in some settings—particularly when the watermarking mechanism is unknown or when detecting hallucinations without external references—the unified approach outperforms task-specific baselines.

Core claim

The paper's central claim is that a single detection mechanism—robust covariance estimation followed by Mahalanobis distance scoring in a pretrained model's representation space—can serve across four distinct AI-artifact detection tasks, and that the key to making this work with heterogeneous multi-class positive samples is a joint MCD estimator built on the Hadamard decomposition Σ^(k) = Θ ⊙ Γ^(k), which separates shared covariance structure (Θ) from class-specific variation (Γ^(k)). The authors prove this estimator converges under alternating optimization (Theorems 6.1–6.2) and tolerates up to β₀ = min_k (n_k − h_k + 1)/n_k fraction of contamination before breaking down (Theorems 6.3–6.4),

What carries the argument

The Hadamard product decomposition Σ^(k) = Θ ⊙ Γ^(k) that separates shared from class-specific covariance, combined with the MDS scoring rule that assigns anomaly based on minimum Mahalanobis distance to any positive class.

Load-bearing premise

The entire framework rests on a Gaussian working model for deep representations—assuming they follow a multivariate normal distribution up to contamination. Deep representations from pretrained models are known to exhibit heavy tails, multimodality, and anisotropic structure that deviate substantially from this assumption, and the paper acknowledges this only in its conclusion as future work.

What would settle it

If deep representations from standard pretrained models (RoBERTa, ResNet) are sufficiently non-Gaussian that the MCD-selected subset does not approximate the true positive-class distribution, then the Mahalanobis distance scores would fail to discriminate positive from negative samples, and the detection framework's empirical success would be attributable to the feature extractor rather than the robust estimation machinery.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • If the unification is valid, practitioners could deploy a single detection pipeline rather than maintaining separate, task-specific detectors for each AI artifact type.
  • The joint estimation framework could extend to other anomaly detection domains where the reference class is multi-population—e.g., detecting distribution shift in medical imaging across patient subgroups.
  • The breakdown point analysis provides a concrete contamination budget: practitioners can select the subset size parameter h_k to guarantee robustness up to a known fraction of corrupted data.
  • The mechanism-agnostic watermark detection result suggests the framework could detect future watermarking schemes without requiring knowledge of their embedding rules.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The Gaussian working model is the load-bearing assumption: if deep representations are sufficiently non-Gaussian (heavy-tailed, multimodal, anisotropic), the MCD subset selection may pick inappropriate samples and the Mahalanobis distance may not separate positive from negative samples, undermining the entire detection pipeline even though the robustness guarantees remain formally valid.
  • The framework's competitive performance on Gemini-based datasets (where DetectGPT fails) versus its weaker performance on CIFAR-100 adversarial detection suggests the approach works best when representation-space deviations are large relative to within-class heterogeneity, and degrades in high-dimensional multi-class settings where joint covariance estimation becomes unstable.
  • The cellwise variant outperforming the casewise variant on hallucination detection (but not on LLM-text detection) hints that different AI artifacts may contaminate representations at different granularities—localized feature corruption versus whole-sample deviation—a distinction that could guide which estimator to deploy for which task.
  • The random projection dimensionality reduction step, while practically necessary, may distort the very covariance structure the MCD estimator is trying to capture, creating a trade-off between computational tractability and detection fidelity that the paper does not formally analyze.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 7 minor

Summary. This paper proposes a unified black-box detection framework for AI-related content and artifacts (LLM-generated text, hallucinations, watermarks, adversarial examples) based on Mahalanobis distance scores (MDS). The core methodological contribution is a joint robust covariance estimation procedure for multi-class positive samples, extending both casewise and cellwise minimum covariance determinant (MCD) estimators via a Hadamard product decomposition Σ^(k) = Θ ⊙ Γ^(k) that separates shared and class-specific structure. The authors provide alternating optimization algorithms (Fast-MCD for casewise, EM-based for cellwise) and prove convergence to blockwise-stationary points (Theorems 6.1–6.2) and finite-sample breakdown point lower bounds β₀ = min_k (n_k − h_k + 1)/n_k (Theorems 6.3–6.4). Experiments across four detection tasks show competitive performance on LLM-generated text and hallucination detection, but underperformance on watermark detection and adversarial example detection in complex settings.

Significance. The paper makes a solid methodological contribution by extending MCD estimators to the multi-class joint estimation setting with a shared/class-specific covariance decomposition. The convergence proofs (Theorems 6.1–6.2) are standard but correct monotone-descent arguments with proximal gradient updates, and the breakdown point proofs (Theorems 6.3–6.4) are clean with sharp lower bounds and matching counterexamples. The Hadamard decomposition with RMS-correlation normalization is a reasonable identifiability device. The framework is applied across a broad range of detection tasks, and the authors provide reproducible code (https://github.com/Astringency/JointMCD.git). The simulation studies in Appendix C provide useful controlled comparisons against non-joint MCD baselines.

major comments (3)
  1. §2.1–§2.2, Eqs. (1)–(2): The central claim is that the proposed framework is a 'unified detection' method, but the connection between the robust covariance estimation theory and the detection effectiveness is not analyzed. The theorems (6.1–6.4) ensure the estimator converges and resists contamination, but they say nothing about whether the Mahalanobis distance d_i = (z_i − μ̂)^T Σ̂^{-1}(z_i − μ̂) separates positive from negative samples. This gap is empirically visible: the method is competitive on GPT-5.4 text detection (Table 1, ROC AUC 0.969) but underperforms specialized baselines on watermark detection (Table 2, F1 0.575 vs. 0.630) and CIFAR-100 adversarial detection (Figure 2). The paper should either provide analytical conditions under which the MDS discriminates positive from negative samples, or more carefully scope the effectiveness claim to match what the empirical results (e
  2. §3.1, §4.1: The Gaussian working model z_i^(k) ~ N_q(μ^(k), Σ^(k)) motivates the MCD objective and the Mahalanobis distance score. The convergence and breakdown point theorems are indeed distribution-free (they rely only on objective descent and constraint structure), but the detection score's discriminative power depends on the geometry of deep representations, which are known to be highly non-Gaussian. The paper acknowledges this only in the conclusion ('future work will consider relaxing the normality assumption'). This is a load-bearing assumption for the detection framework's effectiveness claim, and the paper should discuss it more prominently—ideally with empirical evidence (e.g., tests of Gaussianity on the representations used in the experiments) or by noting that the MCD/MDS approach is used as a distribution-free scoring rule whose effectiveness is validated empirically rather
  3. §7.4, Figure 2: The adversarial example detection results show the proposed method underperforms the standard Mahalanobis baseline of Lee et al. [15] on CIFAR-100 under CWL2/DeepFool. The paper attributes this to 'instability of joint covariance estimation in high-dimensional, multi-class spaces' but does not diagnose the failure. Since the joint estimator is the paper's main contribution over the non-joint baseline, understanding when and why it hurts performance is important for the framework's practical utility.
minor comments (7)
  1. §4.1, Eq. (3): The Hadamard product decomposition Σ^(k) = Θ ⊙ Γ^(k) is introduced without much motivation for why this particular parameterization is preferred over alternatives (e.g., additive decomposition). A brief discussion of the advantages of the multiplicative form would help.
  2. §5.1, Algorithm 1: The convergence criterion checks max_k ∥Σ̂^(k,t+1) − Σ̂^(k,t)∥_F < ε and max_k ∥μ̂^(k,t+1) − μ̂^(k,t)∥_2 < ε, but the algorithm also updates Θ̂ and Γ̂^(k). It would be clearer to also monitor convergence of these quantities, or note that their convergence is implied by the convergence of Σ̂^(k).
  3. §7.1, Table 1: The 'Mean' column aggregates metrics across datasets but the meaning of averaging ROC AUC, F1, etc. across tasks with different difficulty levels is questionable. A note explaining this would help.
  4. §7.2, Table 2: The table layout is dense and the distinction between 'Human vs Gumbel' and 'Null vs Gumbel' tasks could be explained more clearly in the text. A brief sentence clarifying the practical scenario for each would help interpretation.
  5. Appendix C, Table C.5: The simulation table is very dense and hard to parse. Consider splitting by contamination mode or presenting key findings in a summary table, with full results in a supplementary table.
  6. §8 (Conclusion): The phrase 'future work will consider relaxing the normality assumption' is vague. Specifying what alternatives are contemplated (e.g., elliptical distributions, rank-based approaches) would be more informative.
  7. References [22]–[28]: Several references are to model releases dated 2026 (GPT-5.4, Gemini-3.1). If these are preliminary or pre-release versions, this should be noted.

Simulated Author's Rebuttal

3 responses · 0 unresolved

We thank the referee for a careful and constructive report. The referee correctly identifies a gap between our theoretical guarantees (convergence and breakdown point) and the detection effectiveness of the Mahalanobis distance score, as well as the need for more prominent discussion of the Gaussian working assumption and a deeper diagnosis of the adversarial detection underperformance. We address each comment below and describe revisions we will make.

read point-by-point responses

  1. Referee: §2.1–§2.2, Eqs. (1)–(2): The central claim is that the proposed framework is a 'unified detection' method, but the connection between the robust covariance estimation theory and the detection effectiveness is not analyzed. The theorems (6.1–6.4) ensure the estimator converges and resists contamination, but they say nothing about whether the Mahalanobis distance separates positive from negative samples. The paper should either provide analytical conditions under which the MDS discriminates positive from negative samples, or more carefully scope the effectiveness claim to match what the empirical results show.

    Authors: The referee is correct that Theorems 6.1–6.4 concern estimator properties—convergence and breakdown robustness—and do not directly establish discriminative power of the MDS. We agree that this gap should be made explicit rather than left implicit. In the revised manuscript, we will add a discussion in Section 2 clarifying the logical relationship between the theoretical results and the detection framework. Specifically, we will state that the theorems guarantee that the covariance estimates used in the MDS are stable and resistant to contamination—a necessary but not sufficient condition for effective detection—and that the discriminative power of the MDS depends on the geometric separation between positive and negative samples in the representation space, which we validate empirically rather than analytically. We will also scope the effectiveness claim in the abstract and introduction to state that the framework is empirically validated across four detection tasks, with competitive performance on some tasks and acknowledged limitations on others, rather than claiming uniform effectiveness. Providing full analytical conditions for MDS discrimination would require assumptions about the separation between positive and negative distributions in deep representation space (e.g., a margin condition on the Mahalanobis distance between the two populations), which is beyond the scope of the current paper. We will note this as a direction for future theoretical work. revision: partial

  2. Referee: §3.1, §4.1: The Gaussian working model motivates the MCD objective and the Mahalanobis distance score. The convergence and breakdown point theorems are distribution-free, but the detection score's discriminative power depends on the geometry of deep representations, which are known to be highly non-Gaussian. The paper acknowledges this only in the conclusion. This is a load-bearing assumption for the detection framework's effectiveness claim, and the paper should discuss it more prominently—ideally with empirical evidence or by noting that the MCD/MDS approach is used as a distribution-free scoring rule whose effectiveness is validated empirically.

    Authors: We agree that the Gaussian working assumption is discussed too late in the paper and that its role should be clarified more prominently. We will make the following revisions: (1) In Sections 3.1 and 4.1, we will add an explicit remark stating that the Gaussian model serves as a working model that motivates the MCD objective and the Mahalanobis distance score, but that the MCD estimator itself is a distribution-free robust estimator—it does not require Gaussianity for its definition, convergence guarantees, or breakdown point properties. (2) We will reframe the detection score as a distribution-free scoring rule whose effectiveness is validated empirically across the four detection tasks, rather than relying on the Gaussian assumption for its justification. (3) We will add a brief empirical note in Section 7 reporting results of Mardia's multivariate skewness and kurtosis tests on the deep representations used in our experiments, confirming that the representations are indeed significantly non-Gaussian, and noting that the MDS-based detection framework nonetheless achieves competitive performance—consistent with the interpretation that the Mahalanobis distance serves as a useful scoring rule even under non-Gaussianity. (4) We will move the discussion of relaxing the normality assumption from the conclusion to a dedicated paragraph in Section 2 or Section 3. revision: yes

  3. Referee: §7.4, Figure 2: The adversarial example detection results show the proposed method underperforms the standard Mahalanobis baseline of Lee et al. on CIFAR-100 under CWL2/DeepFool. The paper attributes this to 'instability of joint covariance estimation in high-dimensional, multi-class spaces' but does not diagnose the failure. Since the joint estimator is the paper's main contribution over the non-joint baseline, understanding when and why it hurts performance is important.

    Authors: The referee is right that the current explanation is insufficient. We will add a more detailed diagnostic analysis in Section 7.4. Based on our examination of the experimental results, we identify the following contributing factors: (1) With CIFAR-100 (100 classes), the joint estimation problem involves estimating a shared structure Θ and 100 class-specific matrices Γ^(k), which substantially increases the number of parameters relative to the non-joint baseline of Lee et al. that estimates a single common covariance. The additional parameters introduce estimation variance that can degrade the MDS when per-class sample sizes are limited. (2) The Hadamard decomposition assumes that classes share a common correlation pattern Θ, which may not hold for CIFAR-100 where different object classes can have qualitatively different representation geometries. When this assumption is violated, the shared structure estimate can be biased, propagating errors into all class-specific covariance estimates. (3) Under CWL2 and DeepFool attacks, which produce smaller, more carefully optimized perturbations than FGSM/BIM, the adversarial samples may deviate from the positive class in directions that are more aligned with the estimation error in the covariance matrix, making the MDS less reliable. We will add empirical evidence for these mechanisms, including: (a) a comparison of estimation error (Frobenius norm of Σ̂^(k) − Σ^(k) under a controlled simulation mimicking the CIFAR-100 setting) between the joint and non-joint estimators as the number of classes grows; (b) an analysis of the condition number and eigenvalue spectrum of the estimated covariance matrices for CIFAR-100 vs. CIFAR-10; and (c) a per-class breakdown of detection performance showing that the underperformance is driven by a revision: no

Circularity Check

0 steps flagged

No significant circularity found; theorems are self-contained and self-citations are contextual.

full rationale

The paper's main theoretical claims—convergence (Theorems 6.1–6.2) and breakdown points (Theorems 6.3–6.4)—are derived from standard optimization and robustness arguments without circular dependencies. The convergence proofs (Appendices B.1–B.2) establish monotone descent of the objective via: (1) exact minimization for the µ-block (convex quadratic), (2) proximal gradient sufficient decrease for the Γ and Θ blocks, (3) optimal 0-1 LP solution for the discrete H or W blocks, and (4) compactness of the sublevel set via Bolzano-Weierstrass. These are standard tools (Nesterov, Beck) applied to the paper's own objective, not self-cited results. The breakdown point proofs (Appendices B.3–B.4) derive β₀ = min_k(n_k − h_k + 1)/n_k from the constraint structure (λ_min ≥ a_k gives implosion resistance = 1; the h_k retention floor gives explosion/location resistance ≥ β₀) and include a constructive sharpness counterexample. The Hadamard decomposition Σ^(k) = Θ ⊙ Γ^(k) is a reparameterization motivated by external work (Guo et al. [17]), with RMS-correlation normalization (Appendix A.2) as a standard identifiability constraint—it is a modeling choice, not a prediction. The MDS detection framework is inspired by Lee et al. [15] (external). The one self-citation (Tian et al. [11]) is contextual background on Mahalanobis distance for adversarial detection and is not load-bearing for any theorem or central claim. The empirical evaluation compares against external baselines on standard datasets. The Gaussian working model motivates the MCD objective but the theorems are distribution-free properties of the algorithm and estimator. No step in the derivation chain reduces to its own inputs by construction.

Axiom & Free-Parameter Ledger

6 free parameters · 4 axioms · 0 invented entities

No new particles, forces, dimensions, or other physical/mathematical entities are postulated. The framework operates entirely within standard statistical and machine learning constructs.

free parameters (6)
  • h_k (subset size per class) = h_k = ⌊(n_k + q + 1)/2⌋ or ⌊0.75 n_k⌋
    Controls robustness-efficiency tradeoff in MCD; chosen per group, not derived from data
  • λ₁ (shared structure sparsity penalty) = not specified in main text
    Controls sparsity of shared covariance pattern Θ; tuned empirically
  • λ₂ (class-specific sparsity penalty) = not specified in main text
    Controls sparsity of class-specific components Γ^(k); tuned empirically
  • a_k (minimum eigenvalue threshold) = not specified in main text
    Ensures positive definiteness of covariance estimates; chosen for numerical stability
  • b_j^(k) (cellwise flagging penalty) = b_j = max{χ²_{1-α}(1) + ln(2π) + ln(1/[(Σ^(k,0))⁻¹]_{jj}), 0}
    Controls cellwise flagging aggressiveness; depends on α quantile choice
  • d (projection dimension) = not specified in main text
    Dimension after Gaussian random projection; chosen for computational efficiency
axioms (4)
  • domain assumption Gaussian working model: z_i^(k) ~ N_q(μ^(k), Σ^(k))
    Invoked in Section 3.1 and Section 4.1 to derive the negative log-likelihood objective; underlies MCD estimation and Mahalanobis distance computation
  • domain assumption Hadamard decomposition Σ^(k) = Θ ⊙ Γ^(k) captures shared and class-specific structure
    Invoked in Section 4.1 (Eq. 3); assumes covariance structure is separable into shared and class-specific components, which may not hold for arbitrary representation distributions
  • standard math General position: any (q−1)-dimensional affine subspace contains at most q points
    Invoked in Theorems 6.3–6.4 for breakdown point analysis; standard assumption in robust statistics
  • domain assumption RMS-correlation normalization ensures identifiability of the Hadamard decomposition
    Invoked in Appendix A.2; resolves scaling ambiguity but imposes a specific normalization that may not correspond to the true data-generating structure

pith-pipeline@v1.1.0-glm · 44408 in / 4030 out tokens · 195611 ms · 2026-07-09T07:54:37.988632+00:00 · methodology

0 comments
read the original abstract

Artificial intelligence (AI) is a double-edged sword: while it has achieved remarkable success across a wide range of domains, its deployment also calls for effective oversight and regulation, for which the detection of AI-related content and artifacts is perhaps the most direct and cost-effective approach. To this end, we propose a unified detection framework based on Mahalanobis distance scores (MDS), applicable to several important settings, including the detection of large language model (LLM) generated text, hallucination, watermark, and adversarial examples. A key component of the proposed method is to accurately characterize the positive class--such as human-generated text, factual statements, unwatermarked text, or non-adversarial samples--which requires an efficient and robust estimator of the covariance matrix of deep representations of positive samples before computing the MDS. Since the positive samples typically consist of multiple classes, and these classes may exhibit both homogeneity and heterogeneity, we develop joint estimation methods for both the casewise and cellwise minimum covariance determinant (MCD) estimators. We provide efficient optimization algorithms for both estimators and prove their convergence. We provide a reasonable definition of the breakdown point for the joint estimators and prove their corresponding high breakdown point properties. Empirical evaluations confirm the effectiveness of the proposed detection framework.

Figures

Figures reproduced from arXiv: 2607.07527 by Tao Hu, Wan Tian, Xifeng Zhang, Yijie Peng.

Figure 1
Figure 1. Figure 1: Overview of the proposed framework for detecting AI-related content and artifacts under single-class [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Heatmap of different metrics. All metrics are computed with respect to the adversarial examples. [PITH_FULL_IMAGE:figures/full_fig_p021_2.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

50 extracted references · 50 canonical work pages · 7 internal anchors

  1. [1]

    On the Opportunities and Risks of Foundation Models

    R. Bommasani, D. A. Hudson, E. Adeli, R. Altman, S. Arora, S. von Arx, M. S. Bernstein, J. Bohg, A. Bosselut, E. Brunskill, et al., On the opportunities and risks of foundation models, 2021. ArXiv:2108.07258

    work page internal anchor Pith review Pith/arXiv arXiv 2021

  2. [2]

    Sparks of Artificial General Intelligence: Early experiments with GPT-4

    S. Bubeck, V. Chandrasekaran, R. Eldan, J. Gehrke, E. Horvitz, E. Kamar, P. Lee, Y. T. Lee, Y. Li, S. Lundberg, et al., Sparks of artificial general intelligence: Early experiments with GPT-4, 2023. ArXiv:2303.12712

    work page internal anchor Pith review Pith/arXiv arXiv 2023

  3. [3]

    I. J. Goodfellow, J. Shlens, C. Szegedy, Explaining and harnessing adversarial examples, in: International Conference on Learning Representations, 2015

    work page 2015

  4. [4]

    Carlini, D

    N. Carlini, D. A. Wagner, Towards evaluating the robustness of neural networks, in: 2017 IEEE Symposium on Security and Privacy, IEEE, 2017, pp. 39–57

    work page 2017

  5. [5]

    Kirchenbauer, J

    J. Kirchenbauer, J. Geiping, Y. Wen, J. Katz, I. Miers, T. Goldstein, A watermark for large language models, in: Proceedings of the 40th International Conference on Machine Learning, volume 202 ofProceedings of Machine Learning Research, PMLR, 2023, pp. 17061–17084

    work page 2023

  6. [6]

    Manakul, A

    P. Manakul, A. Liusie, M. J. F. Gales, SelfCheckGPT: Zero-resource black-box hallucina- tion detection for generative large language models, in: Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, 2023, pp. 9004–9017

    work page 2023

  7. [7]

    Gehrmann, H

    S. Gehrmann, H. Strobelt, A. M. Rush, GLTR: Statistical detection and visualization of generated text, in: Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics: System Demonstrations, 2019, pp. 111–116

    work page 2019

  8. [8]

    Mitchell, Y

    E. Mitchell, Y. Lee, A. Khazatsky, C. D. Manning, C. Finn, DetectGPT: Zero-shot machine-generated text detection using probability curvature, in: Proceedings of the 40th International Conference on Machine Learning, volume 202 ofProceedings of Machine Learning Research, PMLR, 2023, pp. 24950–24962

    work page 2023

  9. [9]

    Z. Ji, N. Lee, R. Frieske, T. Yu, D. Su, Y. Xu, E. Ishii, Y. Bang, A. Madotto, P. Fung, Surveyofhallucinationinnaturallanguagegeneration, ACMComputingSurveys55(2023) 1–38

    work page 2023

  10. [10]

    J.H.Metzen, T.Genewein, V.Fischer, B.Bischoff, Ondetectingadversarialperturbations, in: International Conference on Learning Representations, 2017

    work page 2017

  11. [11]

    W. Tian, L. Zhang, H. Cui, Abnormal sample detection based on robust Mahalanobis distance estimation in adversarial machine learning, Statistics and Its Interface 17 (2024) 91–106

    work page 2024

  12. [12]

    Release Strategies and the Social Impacts of Language Models

    I. Solaiman, M. Brundage, J. Clark, A. Askell, A. Herbert-Voss, J. Wu, A. Radford, G. Krueger, J. W. Kim, S. Kreps, et al., Release strategies and the social impacts of language models, 2019. ArXiv:1908.09203

    work page internal anchor Pith review Pith/arXiv arXiv 2019

  13. [13]

    Hubert, M

    M. Hubert, M. Debruyne, Minimum covariance determinant, Wiley Interdisciplinary Reviews: Computational Statistics 2 (2010) 36–43

    work page 2010

  14. [14]

    Raymaekers, P

    J. Raymaekers, P. J. Rousseeuw, The cellwise minimum covariance determinant estimator, Journal of the American Statistical Association 119 (2024) 2610–2621. 43

    work page 2024

  15. [15]

    K.Lee, K.Lee, H.Lee, J.Shin, Asimpleunifiedframeworkfordetectingout-of-distribution samples and adversarial attacks, in: Advances in Neural Information Processing Systems, volume 31, 2018

    work page 2018

  16. [16]

    P. J. Rousseeuw, K. Van Driessen, A fast algorithm for the minimum covariance determi- nant estimator, Technometrics 41 (1999) 212–223

    work page 1999

  17. [17]

    J. Guo, E. Levina, G. Michailidis, J. Zhu, Joint estimation of multiple graphical models, Biometrika 98 (2011) 1–15

    work page 2011

  18. [18]

    A. P. Dempster, N. M. Laird, D. B. Rubin, Maximum likelihood from incomplete data via the EM algorithm, Journal of the Royal Statistical Society: Series B (Methodological) 39 (1977) 1–22

    work page 1977

  19. [19]

    B. Guo, X. Zhang, Z. Wang, M. Jiang, J. Nie, Y. Ding, J. Yue, Y. Wu, How close is ChatGPT to human experts? comparison corpus, evaluation, and detection, 2023. ArXiv:2301.07597

    work page internal anchor Pith review Pith/arXiv arXiv 2023

  20. [20]

    Ouyang, J

    L. Ouyang, J. Wu, X. Jiang, D. Almeida, C. L. Wainwright, P. Mishkin, C. Zhang, S. Agar- wal, K. Slama, A. Ray, J. Schulman, J. Hilton, F. Kelton, L. Miller, M. Simens, A. Askell, P. Welinder, P. Christiano, J. Leike, R. Lowe, Training language models to follow in- structions with human feedback, in: Advances in Neural Information Processing Systems, volu...

    work page 2022

  21. [21]

    Accessed April 27, 2026

    OpenAI, Introducing ChatGPT, OpenAI, 2022. Accessed April 27, 2026

    work page 2022

  22. [22]

    Accessed April 27, 2026

    OpenAI, GPT-5.4 Thinking system card, OpenAI, 2026. Accessed April 27, 2026

    work page 2026

  23. [23]

    Accessed April 27, 2026

    OpenAI, Introducing GPT-5.4, OpenAI, 2026. Accessed April 27, 2026

    work page 2026

  24. [24]

    Accessed April 27, 2026

    OpenAI, Introducing GPT-5.4 mini and nano, OpenAI, 2026. Accessed April 27, 2026

    work page 2026

  25. [25]

    Gemini 1.5: Unlocking multimodal understanding across millions of tokens of context

    Gemini Team, Gemini 1.5: Unlocking multimodal understanding across millions of tokens of context, 2024. ArXiv:2403.05530

    work page internal anchor Pith review Pith/arXiv arXiv 2024

  26. [26]

    Accessed April 27, 2026

    Google, Gemini 3 Flash preview, Google AI for Developers, 2026. Accessed April 27, 2026

    work page 2026

  27. [27]

    Accessed April 27, 2026

    Google, Gemini 3.1 Flash-Lite preview, Google AI for Developers, 2026. Accessed April 27, 2026

    work page 2026

  28. [28]

    Accessed April 27, 2026

    Google, Gemini 3.1 Pro preview, Google Cloud Vertex AI documentation, 2026. Accessed April 27, 2026

    work page 2026

  29. [29]

    Y. Liu, M. Ott, N. Goyal, J. Du, M. Joshi, D. Chen, O. Levy, M. Lewis, L. Zettle- moyer, V. Stoyanov, RoBERTa: A robustly optimized BERT pretraining approach, 2019. ArXiv:1907.11692

    work page internal anchor Pith review Pith/arXiv arXiv 2019

  30. [30]

    Ippolito, D

    D. Ippolito, D. Duckworth, C. Callison-Burch, D. Eck, Automatic detection of generated text is easiest when humans are fooled, in: Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, 2020, pp. 1808–1822

    work page 2020

  31. [31]

    X. Li, F. Ruan, H. Wang, Q. Long, W. J. Su, A statistical framework of watermarks for large language models: Pivot, detection efficiency and optimal rules, Annals of Statistics 53 (2025) 322–351. 44

    work page 2025

  32. [32]

    OPT: Open Pre-trained Transformer Language Models

    S. Zhang, S. Roller, N. Goyal, M. Artetxe, M. Chen, S. Chen, C. Dewan, M. Diab, X. Li, X. V. Lin, T. Mihaylov, M. Ott, S. Shleifer, K. Shuster, D. Simig, P. S. Koura, A. Sridhar, T. Wang, L. Zettlemoyer, OPT: Open pre-trained transformer language models, 2022. ArXiv:2205.01068

    work page internal anchor Pith review Pith/arXiv arXiv 2022

  33. [33]

    J. Li, X. Cheng, X. Zhao, J.-Y. Nie, J.-R. Wen, HaluEval: A large-scale hallucination evaluation benchmark for large language models, in: Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, Association for Computational Linguistics, Singapore, 2023, pp. 6449–6464

    work page 2023

  34. [34]

    X. Ma, B. Li, Y. Wang, S. M. Erfani, S. Wijewickrema, G. Schoenebeck, M. E. Houle, D. Song, J. Bailey, Characterizing adversarial subspaces using local intrinsic dimensional- ity, in: International Conference on Learning Representations, 2018

    work page 2018

  35. [35]

    Krizhevsky, G

    A. Krizhevsky, G. Hinton, Learning multiple layers of features from tiny images, Technical Report, University of Toronto, Toronto, 2009

    work page 2009

  36. [36]

    Kurakin, I

    A. Kurakin, I. J. Goodfellow, S. Bengio, Adversarial examples in the physical world, in: Artificial Intelligence Safety and Security, Chapman and Hall/CRC, 2018, pp. 99–112

    work page 2018

  37. [37]

    Moosavi-Dezfooli, A

    S.-M. Moosavi-Dezfooli, A. Fawzi, P. Frossard, DeepFool: A simple and accurate method to fool deep neural networks, in: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, 2016, pp. 2574–2582

    work page 2016

  38. [38]

    J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, L. Fei-Fei, ImageNet: A large-scale hierar- chical image database, in: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, 2009, pp. 248–255

    work page 2009

  39. [39]

    H. Xue, A. Araujo, B. Hu, Y. Chen, Diffusion-based adversarial sample generation for improved stealthiness and controllability, in: Advances in Neural Information Processing Systems, volume 36, 2023, pp. 2894–2921

    work page 2023

  40. [40]

    K. He, X. Zhang, S. Ren, J. Sun, Deep residual learning for image recognition, in: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, 2016, pp. 770–778

    work page 2016

  41. [41]

    Huang, Z

    G. Huang, Z. Liu, L. van der Maaten, K. Q. Weinberger, Densely connected convolutional networks, in: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, 2017, pp. 4700–4708

    work page 2017

  42. [42]

    Iglewicz, D

    B. Iglewicz, D. C. Hoaglin, How to Detect and Handle Outliers, ASQC Quality Press, Milwaukee, WI, 1993

    work page 1993

  43. [43]

    A. Beck, M. Teboulle, A fast iterative shrinkage-thresholding algorithm for linear inverse problems, SIAM Journal on Imaging Sciences 2 (2009) 183–202

    work page 2009

  44. [44]

    Nesterov, Introductory Lectures on Convex Optimization: A Basic Course, 1st ed., Springer, New York, 2004

    Y. Nesterov, Introductory Lectures on Convex Optimization: A Basic Course, 1st ed., Springer, New York, 2004

    work page 2004

  45. [45]

    Beck, First-Order Methods in Optimization, Society for Industrial and Applied Math- ematics, Philadelphia, PA, 2017

    A. Beck, First-Order Methods in Optimization, Society for Industrial and Applied Math- ematics, Philadelphia, PA, 2017

    work page 2017

  46. [46]

    R. G. Bartle, D. R. Sherbert, Introduction to Real Analysis, 4th ed., Wiley, New York, 2018. 45

    work page 2018

  47. [47]

    R. A. Horn, C. R. Johnson, Matrix Analysis, 2nd ed., Cambridge University Press, Cam- bridge, 2012

    work page 2012

  48. [48]

    Agostinelli, A

    C. Agostinelli, A. Leung, V. J. Yohai, R. H. Zamar, Robust estimation of multivariate location and scatter in the presence of cellwise and casewise contamination, TEST 24 (2015) 441–461

    work page 2015

  49. [49]

    Maechler, P

    M. Maechler, P. Rousseeuw, C. Croux, V. Todorov, A. Ruckstuhl, M. Salibian-Barrera, T. Verbeke, M. Koller, E. L. T. Conceicao, M. A. di Palma, robustbase: Basic Robust Statistics, 2026. R package version 0.99-7

    work page 2026

  50. [50]

    Todorov, P

    V. Todorov, P. Filzmoser, An object-oriented framework for robust multivariate analysis, Journal of Statistical Software 32 (2009) 1–47. 46

    work page 2009