Raidar: geneRative AI Detection viA Rewriting

Experiment with second-language and non-native speaker

Thank you for your suggestion in strengthening our paper. We have cited the paper [1] and conducted the experiment in our paper. We utilized 200 examples from the ASAP dataset, featuring TOEFL essays authored by non-native English speakers. Our experiments, detailed in the subsequent table, involved training on the ASAP dataset and testing on it, as well as training on our original arXiv dataset and testing on ASAP in an out-of-domain context. Our method, not relying on word semantics, showed strong generalization to the previously unseen ASAP data. Our approach won't mistakenly identify non-native speaker-written texts as AI-generated, given that LLMs might also classify these as lower quality, prompting substantial rewrite edits. Our empirically results below validate this.

Q1: Feature size and hyperparameter for training classifier.

The Feature size is 28 and we did model selection for the classifier.

For each input, our method generates one Levenshtein score and three sets of bag-of-words edit features—derived from one, two, and three bags of words—resulting in four distinct metrics per prompt. We apply seven different rewriting prompts to each input, leading to a total of 28 features. To process these features, we employed the Logistic Regression and XGBoost algorithms using their default configurations in the Sklearn package. After evaluating their performance, we selected and presented the results from the classifier that demonstrated better efficacy. Based on our results, we use logistic regression for all our experiments except for the essay dataset.

Q2: Classifier Setup for Table 1,2,3,4.

We use logistic regresssion for all experiments except for Table 1's student essay, which we used XGBoost. We run both and use the one that performs higher. We find XGboost performs better on student essay tasks, so we used XGBoost for this task in Table 1 and logistic regression for all other experiments.

Q3: Number of change is significant.

To access the significance of the number of the change, we calculate the one-sided two-sample t tests and calculate the p-value for the changes between human-generated text and machine-generated text (corresponding to the histogram in Figure 2). The small p-value demonstrate that the change is very significant.

Q4: Dataset choice in Table 3-5.

Thank you for your question. In our experiments for Tables 3 and 4, adjustments in the generated texts were necessary, involving changes to both the prompts and the generation models. However, since the datasets comprising News, Creative Writing, and Student Essays, as released by Ghostbuster, are fixed and do not permit such manipulations, we were unable to conduct analyses on these datasets for these tables.

Following your suggestion, for Table 5, we have provided comprehensive results since we can vary the rewriting model, ensuring that the entire scope of our findings and analyses for this specific table is thoroughly detailed and accessible. We show the complete results below:

Q5: Replace word ”significant” with “substantial”

Thank you. We updated.

Q6: Additional results for effect of content length

Thank you for your suggestion. We've included supplementary results on the impact of content length in Appendix Figures 7, 8, and 9. Generally, longer content tends to enhance detection performance, with the notable exceptions of code and arXiv papers. We conjecture that this deviation may be attributed to LLMs struggling with rewriting longer pieces of code or academic papers, likely due to the intrinsic complexity associated with these specific tasks.

Thank you for your helpful experiment suggestions in strengthening the paper! We ran them and reported the results below. We also incorporate your revision suggestions. Please let us know if you need any additional information.

Characteristics of the dataset.

We show the statistics of the dataset in Table 6,7 in the appendix.

Reason for choosing the studied datasets.

Our dataset selection was driven by the need to address emerging challenges and gaps in current research. We incorporated news, creative writing, and essays from the established Ghostbuster paper to maintain continuity with prior work. Recognizing the growing capabilities of Language Learning Models (LLMs) like ChatGPT in generating code, and the accompanying security issues, we included code as a novel and pertinent text data type. Additionally, we analyzed Yelp reviews to explore LLMs' potential for generating fake reviews, a concern overlooked in previous studies, which could significantly influence public opinion about businesses. Lastly, we included arXiv data to address recent concerns over the use of GPT in academic writing, reflecting on its ethical implications.

Justification for Additional LLM generated text, such as from Claude, included for comparison.

To evaluate the robustness of our model, we expanded our testing to include LLMs from companies beyond OpenAI. We incorporated Claude data from the Ghostbuster paper, as suggested by reviewer 3, because Claude, developed by Anthropic, differs from OpenAI's models, offering a diverse robustness check. However, due to Ghostbuster's data limitations, we could only obtain one dataset for Claude. Furthermore, we integrated LLaMA, an LLM from Meta, and conducted extensive tests across six datasets. The results demonstrate our method's ability to effectively identify content generated by LLaMA, despite not being trained on it. This highlights our approach's capability to reliably detect machine-generated content across various company products.

Discussion in Table 1,2

Thank you for your feedback. We will update in our revision. Our investigation into the significant performance improvement on code and arXiv datasets revealed that these are highly specialized tasks. LLMs like GPT often fall short in matching the quality of human-generated content in these areas, leading to a more pronounced disparity between machine-generated and human-generated texts, especially in rewriting scenarios. Previous methods, which primarily used smaller models such as OPT and GPT-2 as their score functions, struggled more with complex tasks like coding and academic writing. In contrast, our method utilizes the advanced capabilities of GPT-3.5, which better handles these challenging tasks, resulting in superior outcomes than prior approach. Additionally, for a comprehensive robustness evaluation, we included the state-of-the-art DetectGPT in Table 4, allowing for a direct comparison of its effectiveness.

Speculation Sentence

We removed the speculation from the revision.

Thank you for your thoughtful review, questions, and suggestions on the experiments. We ran them and presented them below.

1. How Human Reviews from the Yelp was selected

We select the first 2000 reviews from the Yelp Review dataset.

1. How GPT 3.5 was prompted to generated data

Code: Human eval dataset offers code specification and the completed code for each data point. We first use GPT to generate a detailed description of the function of the code by prompting it with “Describe what this code does {code specification}{code}”. The result, termed {pseudo code}, is an interpretation of the code. Subsequently, we prompt GPT with "I want to do this {pseudo code}, help me write code starting with this {code specification}," to generate Python code that adheres to the given input-output format and specifications. This way, we create the AI-generated code data.

Yelp: When tasked with crafting a synthetic Yelp review, prompting GPT-3.5 with "Help me write a review based on this {original review}" resulted in verbose and lengthy text. However, we discovered that using the prompt "Write a very short and concise review based on this: {original review}" yielded the most effective and succinct AI-generated reviews.

Arxiv: In our experiment with Arxiv data, which includes titles and abstracts, we synthesized abstracts by using the title and the first 15 words of the original abstract. We employed the prompt “The title is {title}, start with {first 15 words}, write a short concise abstract based on this:”, which successfully generated realistic abstracts that align with the titles.

1. Which scoring model was used for DetectGPT:

We used the facebook/opt-2.7B model, which boasts a larger parameter count compared to the GPT-2 model with its 1.5B parameters. We use the T5-3B model for the mask filling model, which is stated to be used for almost all experiments in the original paper.

2. Discussion on Results for OOD Generalization

Thank you for bringing this out. Yes, DetectGPT and GPTZero display consistent performance in both in-domain and out-of-domain tests, with our model outperforming them in out-of-domain scenarios, except for GPTZero in Creative Writing. However, The reliability of GPTZero's zero-shot capabilities for Creative Writing is uncertain due to its blackbox nature and unknown training data. Table 1 shows GPTZero's performance variability across tasks, notably dropping to 25 in Yelp Reviews, suggesting weak out-of-domain generalization and large variation over tasks. We will include those discussions over this in our revision.

3. Baselines for Table 4 Results

Following your suggestion, we add DetectGPT baseline and updated Table 4:

3. Generalization results to text generated from stronger LLM

Thank you for your suggestion. We added experiment with data generated from GPT-4, which is a stronger model than GPt-3.5.

3. Results generalize to models not from OpenAI, such as LLaMa and Claude

In the paper, we have included text generated from Claude that is provided by Ghostbuster paper, that we show F1 score of 57.80. In addition, here we show results from LLaMA v2-70B that is trained by Meta:

Suggestion 1: Related work and writing:

We will update as suggested.

Q1: Detection tasks at paragraph level?

Yes, our detection tasks are at the paragraph level. We calculate the median length of documents across tasks and shown in Table 6,7, and also below:

Q2: Experiment combining invariance, equivariance, and uncertainty

Yes, following your suggestion, we tried combining them by concatenating the features over two datasets. Yet we did not achieve better results by combining.

Q3: Experimental design and number of examples for each point in Fig 5.

Thank you for your question. We updated the Figure 5 to show the number of samples for each point via the size of the dot. We run the detection over Yelp test set which contains 800 samples. The number of points for each point in Figure 5 is [51, 204, 164, 135, 82, 84, 80].

We appreciate your thoughtful review and we hope we addressed your concerns. Please let us know if you'd like any further information.

1. Quality of human/LM written text

Thank you for your suggestion. Yes, we manually checked the quality of human/LM text. In general, machine generated text is similar or less preferred by human than human-written text, suggesting that LLM perceive text quality in a different way than human. Due to the time limit, we conducted a user study on Arxiv and Yelp datasets over 40 random examples over 3 users due to the time constraint, produced by GPT-3.5. We show the results below. We will conduct experiments over more users.

2. Discussion on LLM is finetuned to mimic human rewrite

Thank you for your suggestion. In Section 4.4 of our paper, we explored a related concept by prompting the model to emulate human-style writing. Our findings indicated a reduction in detection effectiveness under these conditions. This scenario can be viewed as a rudimentary form of LLM fine-tuning, where the prompt is adjusted rather than the model's parameters. Extrapolating from this trend, it's plausible that more extensive LLM fine-tuning would further diminish the efficacy of our detection method. Consequently, future research should focus on adapting detection models to effectively identify content from fine-tuned LLMs that closely mimic human rewrites. As our study is pioneering in examining rewriting for detection, and considering the high costs associated with fine-tuning LLMs, we suggest this as future research.

We thank the reviewer for their thoughtful review. We are glad that the review found our approach simple and effective, with interesting studies. We address the reviewer’s concern below:

1. Method Robustness to different LLM, such as finetuning

Thank you for your question. We ran the experiment on GPT-3.5 and GPT-4. GPT-4 can be treated as an advanced, continual fine-tuned LLM with new real-world data. We show the results In Table 7 in the appendix, as well as follows.

Our detector, trained only on GPT-3.5, can still work well on detecting GPT-4-Turbo generated data. Our method outperforms established state-of-the-art DetectGPT. This means our method is robust to LLM finetuning.

In Table 4 in our paper, we also evaluate our method over detecting text generated from 5 different LLMs, demonstrating the robustness of our detector to different LLMs.

2. The cost associated with calling the LLM API

Thank you for bringing up the cost. While there is no free algorithm, in Table 5, we have shown using cheaper OpenAI models, such as Ada which is 10 times cheaper for detection. Given the price reduction of OpenAI’s recent API cost, our approach will be more cost efficient.

In addition, to avoid the cost of OpenAI API, we also show that open-source LLaMA-7B, which can be run on a single RTX 3090 Ti GPU, can also be integrated into our framework, avoiding the fee to pay for OpenAI API calls. As shown below, it only leads to a performance drop of a few points, still achieving up to 85 points F-1 detection accuracy score.

Q1: Term Usage, the difference between in-distribution and in-domain

Sorry for the confusion. Yes, they are the same terms. We will use a consistent “in domain” word in our revision.

Q2: The training and testing domain for Table 2

For all experiments in Table 2, we use logistic regression, and use the same source and target for invariance, equivariance, and uncertainty. News: train on Creative Writing and test on News. Creative Writing: train on News and test on Creative Writing. Student Essay: train on News, and test on student Essay.

Q3: The effectiveness of using multiple LLM to rewrite the input text

Thank you for your suggestion. We conducted this study on Yelp and Arxiv, results show that the suggested method can improve the detection score by up to 10 points. We show the results in Table 9 and also follows:

Q3: Edit distance between the rewritten texts from different LLMs as additional features.

Yes, they can be useful features. Following your suggestion we run the experiment on Yelp and arxiv. We can achieve up to to 8 points gain on arxiv dataset. We also find the improvement is dataset dependent.

The authors have not responded to the reviews, at least till now. My scores will therefore remain unchanged.