Pith. sign in

REVIEW 4 major objections 7 minor 36 references

T5-CSBoost: Adversarial Perturbation Resistant LLM Fingerprinting

T0 review · 4 major / 7 minor · reviewed 2026-08-02 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Adding a triplet loss to T5's decoder embeddings makes LLM text detection resist heavy perturbation.

desk verdict A plausible, incremental empirical result on contrastive regularization for LLM fingerprinting, with an overreaching post-hoc robustness theory; worth reviewing if the authors can back it up with code and error bars. read the letter →

arxiv 2607.14113 v1 pith:SQOQUMUM submitted 2026-05-08 cs.CL cs.AI

Gayan K. Kulatilleke , Mahsa Baktashmotlagh , Siamak Layeghy , Marius Portmann This is my paper
classification cs.CLcs.AI
keywords AI-generatedtextdetectionLLMfingerprintingcontrastivelearningtripletlossadversarialperturbationrobustnessparaphraseout-of-distributionstylometricembeddings
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that T5-CSBoost, an extension of T5-Sentinel, achieves state-of-the-art detection of AI-generated text while resisting adversarial edits to words and characters. The key addition is a margin-based triplet loss applied over the decoder's final embeddings, which pulls same-author texts together and pushes different-author texts apart. Because these stylometric representations are compact and separated, the model survives up to 90% word/character perturbation, unseen models, unseen domains, and extreme paraphrasing. A sympathetic reader would care because this suggests a lightweight training-only change—no architecture changes, no adversarial training—can make detectors substantially more reliable in real-world settings.

What carries the argument

A margin-based triplet loss (margin m = 1.0, Euclidean distance) applied to mean-pooled T5 decoder final-layer embeddings, alongside the original cross-entropy next-token objective (λ = 0.5). This regularizes the embedding space so same-author texts cluster tightly and different-author texts separate by at least the margin, creating a perturbation buffer and improving class separability.

What would settle it

Measure the Euclidean displacement of decoder embeddings between original and perturbed texts at 80–90% word/character perturbation intensity; if average displacement exceeds m/2 ≈ 0.5, the margin-buffer explanation is violated and the proposed geometric argument collapses.

Watch

Extended reading notes

Core claim

T5-CSBoost claims that explicitly regularizing the style embedding space of a next-token-prediction detector is sufficient for robust LLM fingerprinting. Empirically, it reports state-of-the-art multiclass source attribution on OpenLLMText and HC3, binary human-vs-LLM detection (AUC 0.974), and best average recall on the MAGE/Deepfake stress-test suite for unseen models, unseen domains, and paraphrasing (task 8), surpassing T5-Sentinel and DeTeCtive without domain adaptation. The mechanism is the margin-based triplet loss on mean-pooled final decoder embeddings, combined with cross-entropy at equal weight.

Load-bearing premise

The claim of guaranteed robustness rests on the unmeasured assumption that realistic perturbations shift decoder embeddings by no more than half the triplet margin (m/2); the paper does not estimate this embedding-space perturbation magnitude.

Editorial extensions

If this is right

  • Robust AIGT detection can be improved without architectural changes, adversarial training, or multi-task objectives—just an auxiliary loss on decoder embeddings.
  • The approach transfers to out-of-distribution settings: unseen LLM models and unseen domains show over 93% average recall without any adaptation.
  • Paraphrase robustness (the hardest MAGE task) reaches state-of-the-art 68.19% average recall, exceeding prior methods by several points.
  • Hard negative/positive mining gives only marginal multiclass gains and slightly hurts binary detection, so random sampling remains a strong default.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The margin buffer argument is a postulate: the paper never measures the actual embedding displacement σ_n under 80-90% perturbations, so the theoretical robustness guarantee depends on an unverified geometric quantity; if real-world edits move embeddings beyond m/2, robustness could degrade even if the reported stress tests pass.
  • Because the gain comes from regularizing decoder embeddings rather than the architecture, the same triplet-loss recipe could be applied to other author-token classification frameworks or to encoder-decoder models besides T5-small.
  • The integrated-gradient evidence suggests the model relies on topic-invariant function words (conjunctions, transitions); a direct test would be to ablate those tokens and measure how much attribution shifts—if the model truly uses style markers, removing them should cause larger errors than removing content words.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 7 minor

Summary. The paper proposes T5-CSBoost, an extension of T5-Sentinel that adds an auxiliary margin-based triplet loss on mean-pooled final-decoder embeddings to the next-token cross-entropy objective. The method is evaluated on OpenLLMText, HC3, and MAGE/Deepfake, with claims of state-of-the-art binary and multiclass source attribution, improved robustness to word/character perturbations and paraphrasing, and a geometric robustness explanation based on a margin buffer. Ablations compare the proposed loss against CE-only, triplet-only, and alternative contrastive formulations.

Significance. If the empirical results hold, the paper demonstrates that a lightweight auxiliary contrastive loss on decoder embeddings can improve robustness of an existing AIGT detector without architectural changes, adversarial training, or multi-task objectives. The strengths are the honest ablation design—comparing balanced CE+triplet against CE-only and triplet-only, as well as alternative losses, sample mining, and margin variants—and the evaluation on the MAGE/Deepfake benchmark including unseen-model, unseen-domain, and paraphrasing tasks. The qualitative diagnostics (IG, t-SNE/PCA) are useful illustrations, though not quantitative. The main weakness is that the theoretical mechanism is asserted rather than measured, and several strong claims in the abstract/conclusion outrun the evidence as presented.

major comments (4)
  1. [III-D, Eq. (5)] The robustness guarantee m ≥ 2σ_n + δ is asserted without ever estimating σ_n, the expected embedding-space displacement under the evaluated perturbations. The paper does not measure how far decoder embeddings move under 80–90% synonym/character edits, so the central 'up to roughly m/2' buffer is not verified. Moreover, margin m=1.0 is fixed a priori, while Table V shows a learnable margin collapses to 0.015 after 15 epochs, which strongly suggests the fixed margin is not the operative buffer. The conclusion should be softened to an empirical observation or supported by directly measuring σ_n and checking the margin condition.
  2. [III-C, Eq. (4)] The Bhattacharyya bound is written for arbitrary class-conditional distributions p_c(z), but the bound as stated is only valid for Gaussians with common covariance, and the scalar σ^2 would need to be a covariance matrix. No Gaussianity or covariance structure is established. The subsequent claims that triplet loss 'tightens the exponent' are qualitative and not derived from the actual margin loss. As written, this section does not provide a formal error guarantee; it should be reframed as heuristic or replaced with a correct derivation and explicit assumptions.
  3. [V-D, Table VII] The HC3 perturbation table does not support the 'enhanced robustness' claim. At 0–30% word-level synonym replacement, T5-Sentinel is already at 0.998 accuracy and T5-CSBoost is at 0.998–0.999, a difference of at most 0.001. The statement that T5-CSBoost 'outperforms all models' is technically true but materially negligible. The text should present this as no significant gain on HC3, or provide paired significance tests and effect sizes. The stronger OpenLLMText and MAGE results are separate, but the abstract's unqualified 'enhanced robustness' claim should be qualified.
  4. [V-A, Tables I-III] The claim of 'state-of-the-art multiclass source attribution' is too strong given the presented evidence. Table I compares only against T5-Sentinel; no multiclass results are reported for DeTeCtive, TopFormer, or other contrastive detectors. The binary comparisons in Tables II–III are useful, but they do not establish SOTA for the multiclass setup. Either add the missing multiclass baselines or restrict the claim to the binary/OpenLLMText settings that are actually benchmarked.
minor comments (7)
  1. [III-B, Eq. (2)] The notation y_i is used but not formally defined as a one-hot target; clarify that this is the standard cross-entropy over the author-token vocabulary.
  2. [III-D] The phrase 'This explains why...' overstates causality. The margin argument gives a plausible mechanism, not a demonstrated explanation, especially since Table V indicates the margin collapses toward zero when learned.
  3. [Table II] The DeTeCtive row has a blank Precision entry; please fix the table formatting and ensure all reported metrics are complete.
  4. [V-D, Figures 5-7 and 9-11] The central 'up to 90%' robustness claim is supported only by figures, with no numerical values quoted in the text. Please include at least a summary table or explicit accuracy numbers for representative perturbation intensities.
  5. [Table VIII] The column header 'Distribution In-distribution Out-of-distribution In the wild Average' is confusing. Clarify that AvgRec columns correspond to tasks 3,4,5,6,8 and explain the task numbering in the caption.
  6. [V-C] The integrated-gradient boxes are illustrative but are not controlled comparisons; please state clearly that these are qualitative examples and avoid generalizing from two micro-texts.
  7. [Abstract] The abstract says 'adversarial perturbations of up to 90% intensity,' but the perturbations evaluated are random synonym/typo operations, not optimization-based adversarial attacks. Consider using 'perturbation intensity' or 'substitution rate' to avoid overstating the adversarial nature.

Circularity Check

0 steps flagged · score 2.0 of 10

No material circularity: the margin-based robustness claim is an empirical result against external benchmarks; Eq. (5) is a stated geometric condition, not a fitted prediction.

full rationale

The central derivation chain is empirical rather than tautological. T5-CSBoost is T5-Sentinel plus a triplet loss (Eq. 3); its claimed SOTA results are computed against external benchmarks (OpenLLMText, HC3, MAGE/Deepfake) and compared to published baselines, with ablations isolating CE-only, triplet-only, alternative contrastive losses, sampling, margin, and lambda. No parameter is fitted to the reported test results and then renamed a prediction; margin m=1.0 and lambda=0.5 are fixed hyperparameters. The robustness argument in Section III-D is a geometric consequence of the triplet objective: if the original triplet inequality d(a,p)+m <= d(a,n) holds, any perturbation displacing embeddings by less than m/2 preserves the ordering by triangle inequality. This is not circular, though it is under-supported because sigma_n in Eq. (5) is never estimated; that is an unverified assumption or correctness risk, not a circular reduction. Self-citations ([16],[20],[32],[33]) appear only in related-work and ablation context and are not load-bearing; no uniqueness theorem is imported from the authors. The conclusion that margin-based contrastive regularization improves robustness remains an empirical claim that could fail and is not forced by definition.

Assumptions & free parameters 2 free parameters · 5 assumptions · 0 invented entities

No new physical or conceptual entities are introduced. The paper's load-bearing components are a training objective, a chosen margin, a loss weight, and a set of proxy perturbation tasks; the central contribution rests on T5 pretraining, public benchmarks, and an unmeasured embedding-displacement assumption.

free parameters (2)
  • triplet margin m = 1.0
    Chosen by hand; ablation tests margin=0.1 and a learnable margin. The theoretical robustness argument assumes perturbations move embeddings by at most m/2, but m is not derived from any measured embedding displacement.
  • loss weight λ = 0.5
    Balances cross-entropy and triplet losses; Table VI shows λ=0.5 works best among tested values, with λ=0.25 lowering accuracy.
assumptions (5)
  • domain assumption T5-small pretrained representations are a sufficient base for author-style attribution
    The method inherits the backbone and next-token objective from T5-Sentinel; if T5-small embeddings do not carry enough style signal, the triplet regularization cannot recover it.
  • domain assumption Word/character perturbations and MAGE task-8 paraphrasing are valid proxies for real-world adversarial edits
    Stated in the introduction and Section V-D; the robustness conclusions depend on these proxies being representative of real text polishing and evasion.
  • ad hoc to paper Perturbation-induced embedding displacement is bounded by roughly m/2
    Section III-D and Eq. (5); the paper asserts this buffer without measuring embedding shifts, so the robustness guarantee is a postulate.
  • domain assumption Class-conditional decoder embeddings are sufficiently Gaussian for the Bhattacharyya bound argument
    Section III-C uses mean/covariance bound Eq. (4); no distributional check is provided, and the written bound uses a scalar σ² rather than the full covariance.
  • standard math Standard identities such as the Bhattacharyya bound and mutual information expansion apply to the learned embeddings
    Eq. (4) and Eq. (6) are invoked as background results; the paper does not prove them, which is acceptable, but the mapping from triplet loss to reduced Bhattacharyya error is heuristic.

how reviews work

0 comments
Cite this review

Pith. "Pith review of T5-CSBoost: Adversarial Perturbation Resistant LLM Fingerprinting." pith.science (2026). https://pith.science/paper/SQOQUMUM

@misc{pith2026260714113,
  author       = {Pith},
  title        = {Pith review of: T5-CSBoost: Adversarial Perturbation Resistant LLM Fingerprinting},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/SQOQUMUM}},
  note         = {Machine review of arXiv:2607.14113}
}
read the original abstract

While many AI-generated text (AIGT) detectors achieve strong performance on clean inputs, their accuracy degrades significantly under light paraphrasing, word substitutions, character edits, and distribution shifts. We present T5 Contrastive Style Boosted Classifier (T5-CSBoost), an extension to the T5-Sentinel framework that keeps the original next-token prediction objective for source attribution while introducing an auxiliary margin-based triplet loss over decoder embeddings. This contrastive style regularization encourages the learning of compact, perturbation-resistant stylistic representations, offering a lightweight yet effective alternative to prior approaches that rely on architectural modifications, adversarial training, or complex multi-task objectives without altering the underlying T5-small backbone. T5-CSBoost achieves state-of-the-art multiclass source attribution and binary human-vs-LLM detection on OpenLLMText and HC3 AIGT benchmarks. More importantly, T5-CSBoost demonstrates enhanced robustness to word and character level adversarial perturbations of up to 90% intensity, achieving state-of-the-art on the challenging MAGE/Deepfake stress-test suite, including unseen models, unseen domains, and extreme paraphrasing scenarios. Our results highlight that explicitly regularizing stylistic embeddings via contrastive learning is a practical and effective strategy for building more robust LLM fingerprinting systems in real-world adversarial settings.

Figures

Figures reproduced from arXiv: 2607.14113 by the authors.

Figure 1
Figure 1. T5 Contrastive Style Boosted Classifier (T5-CSBoost) combines cross-entropy loss with a batched margin-based [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 3
Figure 3. T5-CSBoost ROC curves for each one-vs-rest classi [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figure 4
Figure 4. Detection error trade-off (DET) for T5-CSBoost and the CE-only T5-Sentinel baseline (dotted lines) on one-vs￾rest OpenLLMText classification. Lower-left is better. (Table II), T5-CSBoost achieves an AUC of 0.974, an accuracy of 0.964, and an F1 score of 0.912, surpassing T5-Sentinel (AUC 0.965, accuracy 0.956, F1 0.886) and other baselines like OpenAI’s classifier and ZeroGPT. In terms of precision￾recall, DeTeCtive… view at source ↗
Figures from the paper (7 more)
Figure 5
Figure 5. Figure 5: Perturbation effect on OpenLLMText, for multi class classification accuracy over adjectives (left:); nouns (center:) replaced. Right shows typos replaced randomly with one of 4 (swap, replace, insert, delete) with equal probability, if the word was selected to be pertu…
Figure 6
Figure 6. Figure 6: Perturbation effect on the full OpenLLMText test set, for different types of typos; swap, replace, insert, delete; measured in multi class classification accuracy over different % of words [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]
Figure 7
Figure 7. Figure 7: Perturbation effect on OpenLLMText, for other grammar constructs, measured in multi class classification accuracy over different % of words. space. While t-SNE emphasizes local structure preservation, it is sensitive to hyperparameters like perplexity (which balances l…
Figure 8
Figure 8. Figure 8: Embedding visualization of CE-only T5-Sentinel base [PITH_FULL_IMAGE:figures/full_fig_p009_8.png]
Figure 9
Figure 9. Figure 9: Perturbation effect on HC3, for multi class classification accuracy over adjectives (left:); nouns (center:) replaced. Right shows typos replaced randomly with one of 4 (swap, replace, insert, delete) with equal probability, if the word was selected to be perturbed [P…
Figure 10
Figure 10. Figure 10: Perturbation effect, on the full HC3 test set, for different types of typos; swap, replace, insert, delete; measured in multi class classification accuracy over different % of words [PITH_FULL_IMAGE:figures/full_fig_p010_10.png]
Figure 11
Figure 11. Figure 11: Perturbation effects on the full HC3 test set, for other grammar constructs, measured in multi class classification accuracy over different % of words. families, yet distinct across families (e.g., LLaMA vs. GPT), enabling reliable model identification [35] [PITH_FUL…

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

36 extracted references · 6 linked inside Pith

  1. [1]

    Paraphrasing evades detectors of ai-generated text, but retrieval is an effective defense,

    K. Krishna, Y . Song, M. Karpinska, J. Wieting, and M. Iyyer, “Paraphrasing evades detectors of ai-generated text, but retrieval is an effective defense,”Advances in Neural Information Processing Systems, vol. 36, pp. 27 469–27 500, 2023

    2023

  2. [2]

    Detectgpt: Zero-shot machine-generated text detection using probability curvature,

    E. Mitchell, Y . Lee, A. Khazatsky, C. D. Manning, and C. Finn, “Detectgpt: Zero-shot machine-generated text detection using probability curvature,” inInternational conference on machine learning. PMLR, 2023, pp. 24 950–24 962

    2023

  3. [3]

    Are ai-generated text detectors robust to adversarial perturbations?

    G. Huang, Y . Zhang, Z. Li, Y . You, M. Wang, and Z. Yang, “Are ai-generated text detectors robust to adversarial perturbations?” inProceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), 2024, pp. 6005–6024

    2024

  4. [4]

    Damage: Detecting adversarially modified ai generated text,

    E. Masrour, B. Emi, and M. Spero, “Damage: Detecting adversarially modified ai generated text,”arXiv preprint arXiv:2501.03437, 2025

    arXiv 2025

  5. [5]

    A literature survey on writing style change detection based on machine learning: State-of-the-art–review,

    V . A. Oloo, C. Otieno, and L. A. Wanzare, “A literature survey on writing style change detection based on machine learning: State-of-the-art–review,”Int. J. Comput. Trends Technol., vol. 70, no. 5, pp. 15–32, 2022

    2022

  6. [6]

    Token prediction as implicit classification to identify LLM-generated text,

    Y . Chen, H. Kang, V . Zhai, L. Li, R. Singh, and B. Raj, “Token prediction as implicit classification to identify LLM-generated text,” inProceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, H. Bouamor, J. Pino, and K. Bali, Eds. Singapore: Association for Computational Linguistics, Dec. 2023, pp. 13 112–13 120. [Online]...

    2023

  7. [7]

    Coco: Coherence-enhanced machine-generated text detection under low resource with contrastive learning,

    X. Liu, Z. Zhang, Y . Wang, H. Pu, Y . Lan, and C. Shen, “Coco: Coherence-enhanced machine-generated text detection under low resource with contrastive learning,” inProceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, 2023, pp. 16 167–16 188

    2023

  8. [8]

    Prdetect: Perturbation-robust llm-generated text detection based on syntax tree,

    X. Li, Z. Yin, H. Tan, S. Jing, D. Su, Y . Cheng, H. Shen, and F. Sun, “Prdetect: Perturbation-robust llm-generated text detection based on syntax tree,” inFindings of the Association for Computational Linguistics: NAACL 2025, 2025, pp. 8290–8301

    2025

Show all 36 references
  1. [9]

    Turnitin ai writing detection: Model architecture and testing protocol,

    T. A. T. Staff, “Turnitin ai writing detection: Model architecture and testing protocol,” Turnitin, Tech. Rep., 2024, technical report. [Online]. Available: https://www.turnitin.com/whitepapers/ turnitin-ai-writing-detection-model-architecture-and-testing-protocol

    2024

  2. [10]

    Red teaming language model detectors with language models,

    Z. Shi, Y . Wang, F. Yin, X. Chen, K.-W. Chang, and C.-J. Hsieh, “Red teaming language model detectors with language models,”Transactions of the Association for Computational Linguistics, vol. 12, pp. 174–189, 2024

    2024

  3. [11]

    Towards robust llms: an adversarial robustness measurement framework,

    N. Levy, A. Ashrov, and G. Katz, “Towards robust llms: an adversarial robustness measurement framework,”arXiv preprint arXiv:2504.17723, 2025

    2025 arXiv

  4. [12]

    Radar: Robust ai-text detection via adversarial learning,

    X. Hu, P.-Y . Chen, and T.-Y . Ho, “Radar: Robust ai-text detection via adversarial learning,”Advances in neural information processing systems, vol. 36, pp. 15 077–15 095, 2023

    2023

  5. [13]

    Not all tokens are created equal: Perplexity attention weighted networks for ai-generated text detection,

    P. Miralles-Gonz ´alez, J. Huertas-Tato, A. Mart´ın, and D. Camacho, “Not all tokens are created equal: Perplexity attention weighted networks for ai-generated text detection,”Information Fusion, vol. 125, p. 103465, 2026

    2026

  6. [14]

    Gptzero: Towards detection of ai-generated text using zero-shot and supervised methods,

    E. Tian and A. Cui, “Gptzero: Towards detection of ai-generated text using zero-shot and supervised methods,” https: //gptzero.me, 2023, accessed: 2025-08-12

    2023

  7. [15]

    AI Detector,

    ZeroGPT, “AI Detector,” https://www.zerogpt.com, Jan. 2023

    2023

  8. [16]

    Scgc: Self-supervised contrastive graph clustering,

    G. K. Kulatilleke, M. Portmann, and S. S. Chandra, “Scgc: Self-supervised contrastive graph clustering,”Neurocomputing, vol. 611, p. 128629, 2025

    2025

  9. [17]

    Simcse: Simple contrastive learning of sentence embeddings,

    T. Gao, X. Yao, and D. Chen, “Simcse: Simple contrastive learning of sentence embeddings,”arXiv preprint arXiv:2104.08821, 2021

    2021 arXiv

  10. [18]

    Contrastive decoding: Open-ended text generation as optimization,

    X. L. Li, A. Holtzman, D. Fried, P. Liang, J. Eisner, T. Hashimoto, L. Zettlemoyer, and M. Lewis, “Contrastive decoding: Open-ended text generation as optimization,”arXiv preprint arXiv:2210.15097, 2022

    2022 arXiv

  11. [19]

    A contrastive framework for learning sentence representations from pairwise and triple-wise perspective in angular space,

    Y . Zhang, H. Zhu, Y . Wang, N. Xu, X. Li, and B. Zhao, “A contrastive framework for learning sentence representations from pairwise and triple-wise perspective in angular space,” inProceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume...

    2022

  12. [20]

    Efficient block contrastive learning via parameter-free meta-node approximation,

    G. K. Kulatilleke, M. Portmann, and S. S. Chandra, “Efficient block contrastive learning via parameter-free meta-node approximation,”Neurocomputing, vol. 561, p. 126850, 2023

    2023

  13. [21]

    Topformer: Topology-aware authorship attribution of deepfake texts with diverse writing styles,

    A. Uchendu, T. Le, and D. Lee, “Topformer: Topology-aware authorship attribution of deepfake texts with diverse writing styles,” inECAI 2024. IOS Press, 2024, pp. 1446–1454

    2024

  14. [22]

    Detective: Detecting ai-generated text via multi-level contrastive learning,

    X. Guo, Y . He, S. Zhang, T. Zhang, W. Feng, H. Huang, and C. Ma, “Detective: Detecting ai-generated text via multi-level contrastive learning,”Advances in Neural Information Processing Systems, vol. 37, pp. 88 320–88 347, 2024

    2024

  15. [23]

    OpenAI, https://openai.com/blog/new-ai-classifier-for-indicating-ai-written-text, Jan. 2023

    2023

  16. [24]

    Language models are few-shot learners,

    T. Brown, B. Mann, N. Ryder, M. Subbiah, J. D. Kaplan, P. Dhariwal, A. Neelakantan, P. Shyam, G. Sastry, A. Askellet al., “Language models are few-shot learners,”Advances in neural information processing systems, vol. 33, pp. 1877–1901, 2020

    1901

  17. [25]

    Palm: Scaling language modeling with pathways,

    A. C. et. al., “Palm: Scaling language modeling with pathways,” 2022

    2022

  18. [26]

    Llama: Open and efficient foundation language models,

    H. Touvron, T. Lavril, G. Izacard, X. Martinet, M.-A. Lachaux, T. Lacroix, B. Rozi `ere, N. Goyal, E. Hambro, F. Azhar, A. Rodriguez, A. Joulin, E. Grave, and G. Lample, “Llama: Open and efficient foundation language models,” 2023

    2023

  19. [27]

    Language models are unsupervised multitask learners,

    A. Radford, J. Wu, R. Child, D. Luan, D. Amodei, and I. Sutskever, “Language models are unsupervised multitask learners,” 2019

    2019

  20. [28]

    Openwebtext corpus,

    A. Gokaslan and V . Cohen, “Openwebtext corpus,” http://Skylion007.github.io/OpenWebTextCorpus, 2019

    2019

  21. [29]

    Gpt2-output dataset,

    OpenAI, “Gpt2-output dataset,” https://github.com/openai/gpt-2-output-dataset, 2019

    2019

  22. [30]

    How close is chatgpt to human experts,

    B. Guo, X. Zhang, Z. Wang, M. Jiang, J. Nie, Y . Ding, J. Yue, and Y . Wu, “How close is chatgpt to human experts,” Comparison corpus, evaluation, and detection, vol. 2301, 2023

    2023

  23. [31]

    Mage: Machine-generated text detection in the wild,

    Y . Li, Q. Li, L. Cui, W. Bi, Z. Wang, L. Wang, L. Yang, S. Shi, and Y . Zhang, “Mage: Machine-generated text detection in the wild,” inProceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), 2024, pp. 36–53

    2024

  24. [32]

    Nbc-softmax: Darkweb author fingerprinting and migration tracking,

    G. K. Kulatilleke, S. S. Chandra, and M. Portmann, “Nbc-softmax: Darkweb author fingerprinting and migration tracking,” arXiv preprint arXiv:2212.08184, 2022

    2022 arXiv

  25. [33]

    A tiered quadruplet network with patient-specific mining and dynamic margin for improved ugly duckling lesion classification,

    N. Naranpanawa, H. P. Soyer, A. Mothershaw, G. K. Kulatilleke, Z. Ge, B. Betz-Stablein, and S. S. Chandra, “A tiered quadruplet network with patient-specific mining and dynamic margin for improved ugly duckling lesion classification,” in2024 IEEE International Symposium on Bio...

    2024

  26. [34]

    Release strategies and the social impacts of language models,

    I. Solaiman, M. Brundage, J. Clark, A. Askell, A. Herbert-V oss, J. Wu, A. Radford, G. Krueger, J. W. Kim, S. Kreps et al., “Release strategies and the social impacts of language models,”arXiv preprint arXiv:1908.09203, 2019

    1908 arXiv

  27. [35]

    Your large language models are leaving fingerprints,

    H. E. McGovern, R. Stureborg, Y . Suhara, and D. Alikaniotis, “Your large language models are leaving fingerprints,” in Proceedings of the 1stWorkshop on GenAI Content Detection (GenAIDetect), 2025, pp. 85–95

    2025

  28. [36]

    How johnny can persuade llms to jailbreak them: Rethinking persuasion to challenge ai safety by humanizing llms,

    Y . Zeng, H. Lin, J. Zhang, D. Yang, R. Jia, and W. Shi, “How johnny can persuade llms to jailbreak them: Rethinking persuasion to challenge ai safety by humanizing llms,” inProceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long...

    2024

Pith tools

Reviewed August 2, 2026 · model on record in the stance chip above.