We wholeheartedly appreciate your insightful comments, which we will carefully incorporate should the paper be accepted. During the rebuttal, we conducted extensive empirical studies to further evaluate AdaDetectGPT under various settings, including:

1. the use of falcon-7b and falcon-7b-instruct as scoring models;
2. the detection of more recent LLMs;
3. adversarial attacks;
4. comparison against additional baseline methods.

Results detailed below demonstrate that AdaDetectGPT consistently delivers the most competitive performance across all settings:

Scoring models (Weakness 1)

Following your suggestion, we have employed falcon-7b as scoring models to compare AdaDetectGPT against FastDetectGPT. The corresponding results have been reported in Table D2. It can be seen that AdaDetectGPT continues to achieve the largest AUC in most cases.

Adversarial attacks (Weakness 3)

We have conducted additional experiments to evaluate the robustness of our proposed AdaDetectGPT against 2 adversarial attacks:

• paraphrasing, where an LLM is instructed to rephrase human-written text, and
• decoherence, where the coherence of LLM-generated text is intentionally reduced to avoid detection.

These experiments were carried out across 3 datasets and 3 target LLMs, resulting in a total of 18 settings. Refer to Table B2 in our Response to potential concern 6 to Reviewer aTfn for the detailed results.

Additional baselines and more recent LLMs (Weaknesses 2, 4 & Question)

We have compared against 5 newly added baseline methods, including RADAR, ImBD, Text Fluoroscopy, Biscope (as you pointed out), as well as another recent detector Binoculars. These methods were evaluated using 3 recent open-sourced LLMs, including Qwen2.5, LLaMA3 and Mistral, across 5 benchmark datasets (including our newly added Yelp, Essay and XSum, SQuAD, WritingPrompts), yielding a total of 15 scenarios. We remark that Yelp and Essay are two common benchmark datasets employed in prior works as well (Zhang et al, 2015; Verma et al., NAACL 2024). Additionally, we also used another 3 closed-source models GPT-4o, Claude and Gemini for comparison.

The results are reported in Tables D1-D2. For open-source models (i.e., Qwen2.5, LLaMA3 and Mistral), AdaDetectGPT consistently achieves the highest AUC across nearly all scenarios, outperforming 5 newly added baselines such as Binoculars, RADAR, ImBD, Text Fluoroscopy, Biscope, as well as Fast-DetectGPT, Likelihood, Entropy, and LogRank considered in our main paper. It can be seen that the improvement over Fast-DetectGPT and Binoculars can reach up to 10% and 30%, respectively.

For proprietary models (i.e., Claude, Gemini and GPT-4o), AdaDetectGPT again remains the most competitive across almost all scenarios, and the improvement over Fast-DetectGPT can reach up to 60% - 80%.

Table D1: Performance on three recent open-source models, i.e., Qwen2.5, LLaMA3, and Mistral. The “Relative” rows report the percentage improvement of AdaDetectGPT over Fast-DetectGPT.

Table D2: Performance on three closed-source LLMs, i.e., GPT-4o, Gemini-2.5; Claude-3.5

Reduce the discussion on watermarking (Strengths 3)

Thank you for pointing this out, we will follow your suggestion to reduce our discussion on watermarking.

Missing conclusion (Weakness 5)

Due to the page limit, we did not include a conclusion section in the main paper. During the rebuttal, we have drafted a conclusion that we plan to include using the extra page should our paper be accepted. Refer to Missing conclusion (Minor) in our Response to Reviewer UhoV for details.

We hope our clarifications and newly-added experiments address your concerns. Let us know if you have any follow-up questions.

Apologize for the confusion. We make some clarifications.

First, the results for Fast-DetectGPT in Table D2 did use Falcon-7B/Falcon-7B-Instruct as the scoring model. To confirm this, Table D3 summarizes the AUCs of Fast-DetectGPT when using both GPT-J/Neo-2.7 and Falcon-7B/Falcon-7B-Instruct for scoring models to detect text generated by ChatGPT, GPT-4, GPT-4o, Gemini-2.5 and Claude-3.5. It can be seen that

• The AUCs using GPT-J/Neo-2.7 for ChatGPT and GPT-4 match those reported in the original Fast-DetectGPT paper;
• Switching to Falcon-7B/Falcon-7B-Instruct yields significantly improved AUCs, consistent with the findings reported on the Fast-DetectGPT website;
• GPT-4o, Gemini 2.5, and Claude 3.5 appear to be more challenging to detect, as reflected by their lower AUCs. This likely explains the reduced performance of Fast-DetectGPT you mentioned.

Table D3. AUCs of Fast-Detect on GPT-3.5-turbo, GPT-4, GPT-4o, Gemini-2.5, and Claude-3.5.

Second, are you referring to BiScope as opposed to Binoculars? We did not implement Binoculars in Table D2 and the numbers you referred to correspond to the AUCs of BiScope. For BiScope, we used their default scoring model, Llama-2-7B. As shown in Table D4 below, Llama-2-7B outperforms Falcon-7B in nearly all cases.

Table D4. AUCs of BiScope on recent closed-source LLMs when using Falcon-7b and Llama-2-7b.

Third, the AUCs of AdaDetectGPT in Table D2 were computed using Gemma-9B/Gemma-9B-Instruct as the scoring model. We acknowledge that this may result in an unfair comparison, as Fast-DetectGPT (based on your recommended Falcon-7b/Falcon-7b-Instruct), BiScope (based on its default Llama-2-7b) and other methods (based on Gemma-9B/Gemma-9B-Instruct) used different scoring models. To ensure fairness, we also report the AUCs of Fast-DetectGPT and BiScope using Gemma-9B/Gemma-9B-Instruct in Table D5. We also include Binoculars with Gemma-9B/Gemma-9B-Instruct as the scoring model in Table D5, as you mentioned this algorithm. We observe that:

• Using Gemma-9B/Gemma-9B-Instruct improves the performance of Fast-DetectGPT, but downgrades the performance of BiScope (compared to its default Llama-2-7b);
• AdaDetectGPT still generally outperforms Fast-DetectGPT, BiScope and Binoculars, with improvements reaching up to 37.8% over Fast-DetectGPT, though the margins over Fast-DetectGPT are smaller in some cases.

Table D5. AUCs of BiScope, Binoculars, FastDetect, and AdaDetectGPT on recent closed-source LLMs when all of them using Gemma-9b/Gemma-9b-instruct.

I appreciate the authors’ additional experiments, especially the effort in training a variant of AdaDetectGPT and ensuring a fairer comparison. In the original submission, my main concerns were that the experiments were not sufficiently comprehensive or fair (note: I did not carefully check the formulas and proofs), for instance, the generation models used were not sufficiently advanced, and the paper lacked a proper conclusion. However, these issues have been addressed in the rebuttal, which leads me to raise my score to 5.

I encourage the authors to incorporate these additional experiments and provide more detailed descriptions of the experimental setup in the revised manuscript or the appendix. This should include all necessary details for reproducibility, such as the parameters of the generation model APIs.

Supplement:

I have currently resolved my doubts, so I have also raised the Quality score from 2 to 3.

Finally, motivated by your earlier comment, we trained a variant of AdaDetectGPT that fine-tunes its scoring model by directly maximizing the proposed TNR lower bound -- rather than relying on linear function approximation as in our original approach. The results, also shown in Table D6, demonstrate much improved performance over Fast-DetectGPT and Binoculars using Gemma-9B/Gemma-9B-Instruct as the scoring model. Moreover, as reported in Table D6, this fine-tuned version outperforms ImBD by a large margin, highlighting the benefit of optimizing the proposed objective function.

Table D6. The results of ImBD, FastDetect and AdaDetectGPT (fine-tuned) on recent closed-source LLMs when all of them using Gemma-9b/Gemma-9b-instruct.

We hope our responses clarifies your confusions. Let us know if you have any follow-up comment.

We sincerely thank you for your thoughtful feedback, which we will thoroughly integrate once the paper is accepted. Below, we provide comprehensive discussions and substantial empirical analyses to address all your comments.

Intuitive discussion about the witness function (Weakness 1)

We provide an analytical example, beginning on line 174, which illustrates how classifiers based on token-wise sums of logits may suffer from a loss of power and how this loss of power can be overcome by transforming the logits using a function depending on the distribution of the machine and human generated text. In the paper we have borrowed the term "witness function" from the literature on integral probability metrics, where one constructs a distance on the space of distributions defined on some set $\mathcal{X}$ by choosing a class of functions $\mathcal{F}$ on $\mathcal{X}$ and defining the distance as

D _{\mathcal{F}} (\mathbb{P}, \mathbb{Q}) = \sup _{f \in \mathcal{F}} |\mathbb{E} _{X \sim \mathbb{P}} f(X) - \mathbb{E} _{Y \sim \mathbb{Q}} f(Y)|. \tag{1}

For any two distributions $\mathbb{P},\mathbb{Q}$ on $\mathcal{X}$, the function at which the right hand side of equation (1) attains its maximum is known as the "witness function" as it "bears witness to" the difference between the two distributions. Returning to AdaDetectGPT, we propose to learn our witness function $w(\bullet)$ by optimizing a lower bound on the true negative rate of the classifier (see Theorem 1) defined in equation (4) over a particular function class. The numerator of this lower bound has the form

$\sum _t [\mathbb{E} _{X _{<t}\sim p, \widetilde{X} _t \sim q_t} w(\log q _t(\widetilde{X} _t|X _{<t}))-\mathbb{E} _{X _{<t}\sim p, \widetilde{X} _t \sim p _t} w(\log q _t(\widetilde{X} _t|X _{<t}))],$

where each summand can be associated with the term on the right hand side of equation (1) evaluated at a particular $f(\bullet)$, if the expectations were replaced with conditional expectations. For this reason, we refer to the function appearing in the AdaDetectGPT classifier as a witness function. In the manuscript we briefly mention the connection to integral probability metrics on line 222, however we would be happy to provide a fuller discussion if needed.

Advanced models and more datasets (Weakness 2)

Following your suggestions, we have considered more advanced models and datasets. Specifically, we added six recent LLMs, including three open-sourced LLMs (Qwen2.5, LLaMA3, and Mistral) and three closed-source models (GPT-4o, Claude and Gemini), across five benchmark datasets (including our newly added Yelp, Essay, XSum, SQuAD, and Writing). This yields a total of 30 new scenarios. As can be seen from Table D1 and Table D2 in our Response to Reviewer 6vsq, the proposed AdaDetectGPT generally returns the highest AUC score, confirming the effectiveness of our proposal.

Improvement and Runtime (Weakness 3)

In terms of improvement, we would like to clarify that AdaDetectGPT can improve upon FastDetectGPT by 25%-36% in the Writing dataset, as can be from Table 1 in the submitted paper. Additionally, during the rebuttal period, we found that AdaDetectGPT improves upon FastDetectGPT by over 60% -- 80% for detecting text generated by GPT-4o, Gemini-2.5; Claude-3.5 (see Table D2 in our Response to Reviewer 6vsq), which is quite significant.

Additionally, AdaDetectGPT is computationally efficient, as the average time for AdaDetectGPT to analyze each passage is around half a second—efficient enough to handle most GPT detection cases. Finally, we agree that AdaDetectGPT involves a witness function learning procedure that is not needed for FastDetectGPT. However, since we derived a closed-form for the witness function, the training procedure can be completed in one minute, as can be seen from Table A3 and Table A4 in our Response to Reviewer cReh.

Ablation study (Weakness 4)

Our approach consists of two main components: (i) deriving a lower bound on the TNR to serve as the objective for adaptively learning the detector, and (ii) parameterizing the witness function using a linear function approximation, which reduces learning to solving a system of linear equations.

In response to your concern, we conducted an ablation study to assess the impact of the second component. Specifically, instead of using a linear model, we fine-tuned the scoring model as suggested by Reviewer 6vsq. The resulting variant, referred to as AdaDetectGPT*, is compared with the original AdaDetectGPT in Table C1 below.

Overall, AdaDetectGPT* demonstrates improved performance over AdaDetectGPT. However, this comes at a significant computational cost: while AdaDetectGPT completes training in under one minute with a 0.6Gb GPU memory requirement (see Table A3 and Table A4 in our Response to Reviewer cReh), AdaDetectGPT* requires substantially more time and resources. Typically, the training time of AdaDetectGPT* ranges from five to eight minutes, and the required GPU memory ranges from 3–5Gb. Therefore, AdaDetectGPT is much more computationally attractive. Notice that AdaDetectGPT already outperforms all baseline methods in most scenarios. Thus, considering the trade-off between training cost and detection performance, the original AdaDetectGPT might offer a more practical solution.

Table C1. Ablation studies on the effect of the witness function (FastDetectGPT vs. AdaDetectGPT) and the learning method (AdaDetectGPT vs. AdaDetectGPT* )

Missing conclusion (Minor)

Due to the page limit, we did not include a conclusion section in the main paper. During the rebuttal, we have drafted a conclusion (see below) that we plan to include using the extra page should our paper be accepted:

We propose AdaDetectGPT, an adaptive LLM detector that learns a witness function $w$ to boost the performance of existing logits-based detectors. A natural approach to learning $w$ is to maximize the TNR of the resulting detector for a fixed FNR level $\alpha$. However, the TNR is a highly complicated function of $\alpha$ and $w$, which makes the learned witness function inherently $\alpha$-dependent -- that is, it maximizes the TNR at a particular FNR level but does not guarantee optimality at other FNR levels. To address this, we derive a lower bound on the TNR and propose to learn $w$ by maximizing this lower bound. Notice that the lower bound separates the effects of $\alpha$ and $w$: the witness function $w$ affects the lower bound only through $T_w^{(2)*}$, which is independent of $\alpha$. Consequently, the witness function that maximizes this lower bound simultaneously maximizes it across all FNR levels.

In our implementation, we opted to learn the witness function via a B-spline basis due to the straightforward nature of the optimization (finding the optimal witness function boils down to solving a system of linear equations) and its favorable theoretical properties (the estimation error can be shown to attain Stone's optimal convergence rate, Stone, 1982). The number of $B$-spline basis functions can be selected in a data driven way for instance via Lepski's method; see Lepski & Spokoiny (1997).

We hope our clarifications and newly-added experiments address your concerns. Let us know if you have any follow-up questions.

I appreciate the authors' detailed response to my questions, which effectively address most of my concerns. As such, I will maintain my rating of 4.

We wholeheartedly appreciate your insightful comments and suggestions, which we will carefully incorporate should the paper be accepted. During the rebuttal, we have conducted extensive theoretical and empirical investigations to address all your concerns.

Validation of technical assumptions (Weakness 2 & Question 4)

Excellent comment! Your comment is concerned with the validity of three conditions: (i) the equal variance condition; (ii) the stochastic dominance condition; (iii) the regularity condition for the MCLT to hold.

We did not elaborate on these assumptions in the main paper, and we appreciate the opportunity to clarify and discuss them in response to your concerns. In summary:

1. During the rebuttal, we have conducted both theoretical and empirical investigations and found that the equal variance condition can be relaxed to a much weaker proportionality condition (see Equation (1) below), which is likely to hold empirically (see Table A1 below).
2. The stochastic dominance condition was introduced to derive an alternative, tighter lower bound than the one presented in Theorem 1. It is not required for the validity of Theorem 1 itself.
3. We have conducted several normality tests on our proposed statistic. Results suggest that in almost all cases, our statistic passed these normality tests (see Table A2), indicating the regularity conditions required for the MCLT are likely met in practical scenarios.

We next elaborate on these points.

First, the equal variance condition imposed in Theorem 1 can be relaxed. Specifically, our theoretical investigations during the rebuttal reveal that it is not necessary for the two variances $\sigma_{q,L}^2$ and $\sigma_{p,L}^2$ to be asymptotically equivalent in probability. Rather, it suffices to require their ratio to converge to some positive constant in probability, i.e.,

Since $K_0$ need not be 1, this proportionality condition is considerably weaker than the equal variance assumption and is more likely to hold in practice. Under this relaxed condition, following nearly identical arguments to those in Theorem 1, we can show that TNR is asymptotically lower bounded by:

This lower bound differs from the one in Theorem 1 due to the change in assumptions. However, since $\phi(K_0 z_\alpha)$ depends solely on $\alpha$ (not on the witness function $w$), our main conclusion — maximizing the lower bound is equivalent to maximizing $T_w^{(2*)}$ — remains valid. Thus, the proposed methodology remains theoretically sound.

Empirical results further support the validity of this assumption: the sample mean of the ratio remains nearly constant as a function of $L$, while its variance (in parentheses) approaches zero as $L\to \infty$ across all three datasets (see Table A1), suggesting that this condition is practical.

Second, for the stochastic dominance condition, we clarify that its primary purpose was to apply Lemma S3 in deriving an alternative tighter lower bound (detailed in Remark 1 after the proof of Theorem 1 in the supplementary material). This condition is therefore not essential for the validity of Theorem 1 and can be safely omitted without affecting our main conclusion.

Third, we applied 2 standard hypothesis tests — the Kolmogorov–Smirnov (KS) test and the Shapiro–Wilk (SW) test — to evaluate whether our proposed statistic follows a normal distribution. These tests were conducted across 3 benchmark datasets and 2 LLM source distributions, yielding a total of 12 p-values. As shown in Table A2, almost all p-values exceed 0.1 (most by a large margin), indicating that our test statistic passes normality tests in most cases, providing strong empirical support for the validity of MCLT regularity conditions.

Table A1: Sample mean and variance (in parentheses) of the ratio evaluated on 3 datasets as $L$ increases

Table A2: $p$-values of KS and SW tests across 3 datasets and 2 source LLMs

Experiments on more datasets and LLM models (Weakness 5 & Question 1)

Following your suggestion, we have conducted experiments during the rebuttal to compare AdaDetectGPT against existing detectors across 6 recent LLMs and 5 datasets. Due to space limit, refer to our Table D1 & Table D2 in Response to Reviewer 6vsq for details.

Experiments against evasion techniques (Question 1)

Following your suggestion, we have conducted additional experiments to evaluate the robustness of AdaDetectGPT against two evasion techniques: (i) paraphrasing and (ii) decoherence across 3 datasets and 3 target LLMs, resulting in a total of 18 settings. Refer to Table B2 in our Response to potential concern 6 to Reviewer aTfn for detailed results.

B-spline basis functions (Weakness 4 & Question 3)

We opted to learn the witness function via a B-spline basis due to the straightforward nature of the optimization: finding the optimal witness function reduces to solving a system of linear equations.

Theoretically, when the optimal witness function is $\beta$-smooth (with larger $\beta$ indicating greater smoothness), we can derive the following supremum error bound for our estimated witness function $\hat{w}$, following arguments similar to those used in the analysis of B-spline estimators (e.g., Theorem 2.1 of Chen & Christensen, 2015):

Using similar arguments to the proof of our Theorem 3, we can show that the difference in TNR between the oracle $w^*$ and the estimated $\hat{w}$ is also of order (2). By setting $d=\Theta\Big(\big(n/\log n\big)^{1/(2\beta+1)}\Big),$ this yields the optimal rate of convergence: $O_p\Big(\big(n/ \log n\big)^{-\beta/(2\beta+1)}\Big).$

In comparison:

• Local polynomial partition series estimators can achieve a similar uniform convergence rate (see Cattaneo & Farrell, 2013), and therefore yield a comparable rate in TNR difference.
• Neural networks can also attain a similar convergence rate, but in terms of the $\ell_2$ norm rather than the uniform $\ell_\infty$ norm. As a result, the proof technique used in Theorem 3 does not directly apply. Instead, under the margin condition (Assumption 1), the TNR difference converges more slowly at a rate of $O_p\Big(\big(n/\log n\big)^{-\beta / (3\beta+1.5)}\Big)$. In addition, neural networks are known to learn certain non-smooth functions at near-optimal rates (see Schmidt-Hieber, 2020).

Regarding the choice of dimension $d$, in line 292, we note that numerical experiments suggest: "AdaDetectGPT is generally robust to … the number of B-spline feature mappings." However, we agree that $d$ can be chosen in a more principled way:

• If the smoothness parameter $\beta$ is known, then one can set $d=\Theta\big(\left(n/\log n\right)^{1/(2\beta+1)}\big)$ to achieve the optimal rate in Equation (2), which in turn maximizes the expected TNR of AdaDetectGPT.
• If $\beta$ is unknown, $d$ can be chosen in a data-driven way, for instance via Lepski's method (see Lepski & Spokoiny, 1997).

Computational efficiency (Question 2)

From Table A3, the runtime of AdaDetectGPT is around 44 seconds and changes marginally with respect to $d$. This is because we can use a closed-form expression to learn a witness function. This time is nearly negligible compared with the time required to compute logits, which involves feeding tokens from multiple passages into LLMs. Furthermore, the training time when $n$ increases is shown in Table A4. It shows AdaDetectGPT saves more runtime and memory than ImBD.

Table A3: Runtime scale with $d$

Table A4: Runtime (memory in parenthesis) scale with $n$ comparing with ImBD (SOTA)

Missing conclusion (Weakness 1)

During the rebuttal, we have drafted a conclusion that we plan to include using the extra page should our paper be accepted. Refer to Missing conclusion (Minor) in Response to Reviewer UhoV for details.

TNR lower bound (Weakness 3)

We clarify the rationale behind the derivation of our lower bound below. Recall that our goal is to learn a witness function $w$ that maximizes the TNR of the resulting detector for a fixed FNR level $\alpha$. However, the TNR is a very complicated function of $\alpha$ and $w$, which makes the learned witness function that maximizes the TNR $\alpha$-dependent. Specifically, it maximizes the TNR at a particular FNR level but does not guarantee optimality at other FNR levels.

To address this, we derive a lower bound on the TNR and propose learning $w$ by maximizing this lower bound. As you pointed out, this lower bound also involves $\alpha$. The key advantage is that the lower bound separates the effects of $\alpha$ and $w$: the witness function $w$ affects the lower bound only through $T_w^{(2)*}$, which is independent of $\alpha$. Consequently, the witness function that maximizes this lower bound simultaneously maximizes the bound across all FNR levels.

Thus, the problem reduces to selecting a single witness function that maximizes $\alpha$-independent $T_w^{(2)*}$.

We hope this clarifies your confusion.

Dear Reviewer cReh, once again, we greatly appreciate your constructive comments and feedback. Would you please let us know if our responses have adequately addressed your comments, or if you have any follow-up questions?

Thank you for the comprehensive response addressing my concerns. Most of my concerns have been solved.

The relaxed proportionality condition (Equation 1) with empirical validation (Table A1) and normality tests (Table A2) strengthen the theoretical foundation by satisfying MCLT regularity conditions, while experiments across 6 LLMs and robustness against evasion techniques substantially enhance empirical validation. The B-spline theoretical justification with error bounds (Equation 2) and principled dimension selection guidelines provide valuable theoretical rigor, and runtime analysis demonstrates the practical efficiency advantages of this computationally feasible approach.

By the way, I think the relaxed proportionality condition should be prominently featured in the main paper, with consideration given to empirically demonstrating Lepski's method for dimension selection, while the expanded experimental results need to be integrated into the main evaluation section. Overall, the rebuttal addresses the paper's limitations while strengthening both theoretical rigor and practical applicability of the proposed approach. I will increase my score from 3 to 4.

We wholeheartedly appreciate your insightful comments, which we will carefully incorporate should the paper be accepted. In summary, during the rebuttal, we have conducted extensive empirical studies to evaluate the proposed AdaDetectGPT under a wide range of settings to address your concerns, including:

• (i) distributional shifts;
• (ii) adversarial attacks;
• (iii) comparisons with additional baseline methods; and
• (iv) evaluations on more diverse datasets.

Results detailed below demonstrate that AdaDetectGPT consistently delivers the most competitive performance across all settings.

Distributional shifts (Potential concern 1)

AdaDetectGPT is robust to distributional shifts; see Figure S4 in the Appendix. This figure reports the AUC of AdaDetectGPT when the distribution of the test data differs from that of the training data used to learn the witness function. Specifically, during training, we vary the number of human prompt tokens in the LLM-generated text, whereas in the test data, the number of human prompt tokens is fixed. It can be seen that the AUC hardly changes as we vary the number of human prompt tokens in the training data. Additionally, our method achieves the highest AUC in all cases.

Additional baselines (Potential concern 2).

We have compared against 5 newly added baseline methods, including Binoculars you pointed out, as well as four other recent detectors RADAR, ImBD, Text Fluoroscopy and Biscope. These methods were evaluated using 3 recent LLMs (Qwen2.5, LLama3, Mistral) across 5 benchmark datasets (including our newly added Yelp, Essay and Xsum, SQuAD, WritingPrompts). Refer to Table D1 in our Response to Reviewer 6vsq for the detailed results. In particular, our AdaDetectGPT consistently outperforms Binoculars in most scenarios and the improvement can reach up to 60% (see the table below where we average the AUC across the LLMs).

Table B1. AUC scores of Binoculars and AdaDetectGPT and the relative improvement. "Relative" reports the percentage improvement of AdaDetectGPT over Binoculars.

Adversarial attacks (Potential concern 6)

We have conducted additional experiments to evaluate the robustness of our proposed AdaDetectGPT against 2 adversarial attacks: (i) paraphrasing, where an LLM is instructed to rephrase human-written text, and (ii) decoherence, where the coherence LLM-generated text is intentionally reduced to avoid detection. These experiments were carried out across 3 datasets and 3 target LLMs, resulting in a total of 18 settings. Both adversarial attacks were implemented following Bao, et al., ICLR2024.

Table B2. Detection of LLM texts under attack.

Results are reported in the table above. It can be seen that As shown, AdaDetectGPT consistently achieves higher AUCs than Fast-DetectGPT in most of the 18 scenarios. And the improvement reaches up to 10% for paraphrasing and up to 85% for decoherence. These results suggest that AdaDetectGPT attains more robust performance against adversarial attacks.

More diverse datasets (Potential concern 7)

We have conducted two analyses to address your comment. First, we have included two additional datasets -- Yelp and Essay -- in addition to XSum, SQuAD, WritingPrompts and found AdaDetectGPT remains the most competitive detector on both datasets. Refer to Table D1 and Table D2 in our Response to Reviewer 6vsq for the detailed results. These two datasets have been employed in prior works as well (Mao, et al., ICLR2024; Verma, et al., NAACL2024).

Second, our black-box settings use purely human/machine text, where the machine-generated text consists solely of outputs produced by LLMs. As can be seen from Table D2 in our Response to Reviewer 6vsq, AdaDetectGPT achieves the most competitive performance among state-of-the-art detectors.

Missing conclusion (Potential concern 3).

Due to the page limit, we did not include a conclusion section in the main paper. During the rebuttal, we have drafted a conclusion that we plan to include using the extra page should our paper be accepted. The conclusion summarizes our proposed procedure and discusses the data contamination issue you highlighted (see our next response). Refer to Missing conclusion (Minor) in our Response to Reviewer UhoV for details.

Realistic applications & data contamination (Potential concerns 4 & 5).

Your comment raises three important questions: (i) the realism of white-box settings; (ii) the potential issue of data contamination; (iii) the target application considered in this work. We address each of these points in detail below.

• Realism of white-box settings.

First, white-box settings are particularly relevant in scenarios where the goal is to detect outputs from open-source LLMs such as Qwen, LLaMA3, and Mistral. Note that we have conducted experiments on these models and found AdaDetectGPT continues to perform well; see Table D1 in our Response to Reviewer 6vsq for detailed results.

Second, we clarify that while the white-box setting is used to motivate and develop our methodology, AdaDetectGPT is also applicable in black-box settings. As you pointed out, our main paper already includes some black-box experiments, which we are glad to hear have partially addressed your concern. To further demonstrate AdaDetectGPT's usefulness, we have conducted additional black-box experiments during the rebuttal on other widely-used closed-source LLMs Claude and Gemini. AdaDetectGPT again attains the most competitive performance -- see our Table D2 in Response to Reviewer 6vsq.

• Data contamination.

We fully agree that data contamination is a critical issue in evaluating LLM-related tasks. In particular, when evaluation data is contained in the training dataset, it can lead to overly optimistic estimates of the proposed algorithm's performance. We have carefully reviewed our evaluation protocol and did not find any such contamination.

In our setup, training data is used for learning the witness function. As mentioned in Section B.1 of the Appendix, we employ cross-validation to separate training and testing datasets. For instance, in our main paper, we use three benchmark datasets: XSum, SQuAD, and WritingPrompts. When testing on one dataset (e.g., XSum), the witness function is trained using the other two datasets (e.g., SQuAD and WritingPrompts). Notice that these datasets are semantically and topically different -- XSum provides news summaries, SQuAD involves Wikipedia-based question answering, and WritingPrompts consists of creative human-written stories. This further reduces any risk of data leakage between training and testing.

• Target application.

This work focuses on determining whether a piece of text was generated by a user-specified LLM -- either open-source (white-box) or closed-source (black-box). Your comment highlights two practical challenges.

First, given the vast and growing number of LLMs, it is impractical to detect outputs from all possible models. Therefore, we focus on a set of widely-used and popular LLMs. In fact, following the submission of our paper, we have developed a private website hosting our detector. Due to NeurIPS policy, we are unable to release its link at this stage. However, on the website, users can select from a list of supported target LLMs to check whether a given text was generated by any of them (including a “union” option to check if it came from any of the listed models). We plan to regularly update the set of supported models to reflect the evolving popularity of LLMs -- for instance, by removing outdated ones and incorporating new, widely adopted models.

Second, you raise the important point that adversaries might fine-tune LLMs specifically to fool detectors. We acknowledge this is a challenging and largely open problem. Nonetheless, as we have discussed in our Response 3, our method can still be competitive in certain adversarial scenarios (e.g., paraphrasing and decoherence).

We hope our clarifications and newly-added experiments address your concerns. Let us know if you have any follow-up questions.

Theory. To provide intuition for why the oracle property may hold, we consider two illustrative cases, leaving a rigorous proof to future work.

• Case 1: All $q^{(i)}$ are similar. In this case, the learned witness functions $w^{(i)}$ tend to be similar as well, resulting in detection statistics $T^{(i)}$ being similar across models. Consequently, taking the maximum over $T^{(i)}$ yields a statistic that behaves similarly to each individual $T^{(i)}$. As such, the FNR and TNR of $\max_i T^{(i)}$ become very similar to each $T^{(i)}$, justifying the oracle property in this case.

• Case 2: All $q^{(i)}$ differ substantially. Suppose the text is generated by the $i$-th model. In this case, the statistic $T^{(i)}$, computed using the correctly specified model, is expected to dominate the others. Therefore, taking the maximum over all $T^{(i)}$ effectively selects the oracle statistic $T^{(i)}$, leading to similar FNR/TNR as the model-specific detector. This again supports the oracle property.

In more general cases where some $q^{(i)}$ are similar while others differ substantially, similar arguments can be applied to show the taking the maximum over $T^{(i)}$ tends to approximate the oracle statistic generated under the true model $T^{(i)}$.

We hope our responses address your comment. Let us know if you have any follow-up question.

Many thanks for the follow-up. Following prior works (e.g., Gehrmann, et al., ACL2019 and Bao, et al., ICLR2024), we focus on the setting with a specified target LLM. However, our approach can be easily extended to the case without specifying the target LLM, and we appreciate the opportunity to clarify this point.

As mentioned in our rebuttal, we provide a "union" option that enables users to determine whether a text was generated by any of several popular models (e.g., GPT, Gemini, or Claude), without the need to specify which particular model it comes from. We have also conducted preliminary theoretical and empirical studies, which show that even without specifying a target model, the resulting detector achieves performance that is comparable to that of our original detector tailored to a specific model. We refer to such a desirable property as the oracle property, meaning that the method works as well as if the target model were known in advance.

Methodology. To elaborate our methodology, let $q^{(i)}$ denote the $i$-th target model in the list. Our goal is to detect whether a given text was generated by any model in the set $\{ q^{(i)} \}_i$. Toward that end, for each $q^{(i)}$, we apply our procedure to learn a witness function $w^{(i)}$, which is then used to construct our detection statistic denoted by $T^{(i)}$. Notice that each $T^{(i)}$ is applied to detect text generated by its target $q^{(i)}$. To detect any model in the set, we propose a simple extension: take the maximum over all statistics, i.e., $\max_i T^{(i)}$. We refer to this extension as AdaDetectGPT (Max).

Experiment. To evaluate performance, we conduct an additional experiment under the black-box setting described in our rebuttal. The goal is to detect whether a given text was generated by any of the following three popular models: GPT-4o, Gemini-2.5, or Claude-3.5. We compare the performance of AdaDetectGPT (Max) — our extension for detecting across multiple models - against the original AdaDetectGPT and other baselines (e.g., Fast-DetectGPT) that assume prior knowledge of the specific target model used to generate the text. Results are presented in Table B3 below.

It can be seen that AdaDetectGPT (Max) achieves comparable performance to AdaDetectGPT, which knows the target model in advance. In some cases, it even outperforms AdaDetectGPT. This empirically verifies the oracle property of AdaDetectGPT (Max). Moreover, it generally outperforms other baseline methods that require prior knowledge of the specific target model used to generate the text.

Table B3. AUCs of various methods on recent closed-source LLMs. The best one is bold and the second one is italic.