DALD: Improving Logits-based Detector without Logits from Black-box LLMs

Thank you very much for the constructive and detailed reviews. We provide detailed responses to your concerns.

Response to the question about different domains:

We appreciate your interest in the effectiveness of DALD for different domains. It's worth noting that our training data is entirely distinct from our test dataset, so there is no overlap between the two datasets. Training data is the corpus from the publicly shared outputs of leading models while testing data is the specific datasets such as PubMed prompted by the target models. Additionally, we've conducted experiments on other domain-specific datasets, namely RAID[1], including poetry, news, books, etc. Results are shown:

We select 1000 human texts and 1000 GPT-4 generated texts for each domain in RAID dataset and compare the evaluation results with FastDetectGPT. The results demonstrate that DALD performs admirably in diverse domains.

Response to Weakness 1:

Thank you for raising this point as it provides a deep insight into our method. We acknowledge empirically that current closed-source models have homogeneity characteristics, as evidenced by the slight improvement in multisource settings. Therefore, we cannot guarantee the one-for-all surrogate model can perform optimally when encountering new models without homogeneity. However, it's important to note that the generalizability of our approach also lies in its ability to continuous learning. By collecting small-size data from new models and continually fine-tuning the surrogate model, we can adapt to newly published models with minimal cost. This ongoing effort represents a worthwhile alternative compared to retraining the entire model from scratch.

Response to Weakness 2:

We appreciate this careful review. The modest performance improvement of GPT-Neo-2.7B as the surrogate model only happens on Claude3 detection. As shown in the table below, upon further testing on GPT-4, it is observed a substantial improvement in its performance. We believe this might be attributed to that the parameter number of GPT-Neo-2.7B is relatively small and may not be sufficient to generalize well across all datasets. We intend to present a comprehensive overview of GPT-Neo-2.7B in the next version.

Response to Weakness 3:

We acknowledge that the Limitation and Future Work section is brief since we have to condense this section in the current version due to space constraints. However, we appreciate your feedback and will ensure to include a more comprehensive discussiont in the next version of the paper. Regarding future work, we plan to explore the influence function to improve data efficiency for finetuning. Additionally, future work can utilize our pipeline for analyzing the homogeneity of different models and versions such as investigating whether there is more variability in non-transformer architectures or black-box model alignment from different companies. These are crucial areas that we will focus on exploring further.

Response to Typo:

Thank you for this careful review and pointing out the typo in our paper. We appreciate your attention to detail and will make sure to revise the typo accordingly in the next version of the manuscript. Your feedback is invaluable, and we are grateful for your thorough assessment of our work!

Reference:

[1] Dugan, Liam, et al. "RAID: A Shared Benchmark for Robust Evaluation of Machine-Generated Text Detectors." arXiv preprint arXiv:2405.07940 (2024).

Thank you very much for your detailed review. Please check our response to your concerns.

Response to Weakness 1:

First, regarding the concern of the better performance of the model trained on multiple source data, a reasonable explanation could be that the optimization space of logits is large. Therefore, aligning the logits of one model does not necessarily affect the alignment of others in the LLM detection point of view. It suggests that continuing to learn from the corpus generated by multiple models simultaneously has no negative impact on the overall performance. Moreover, by collecting from multiple sources, the training data is augmented, which, given homogeneous models, is similar in spirit to the widely used data augmentation for improving generalization. Augmentations induce extra stochasticity during training, which effectively flattens the loss landscape [3]. The surrogate model may also benefit from the complementary information from different sources that can potentially improve the alignment of distributions, and eventually enhance the model's generalization performance. We will add discussions in the revision. This indicates that training DALD on datasets from multiple source models is indeed effective and not contradictory.

Besides, regarding the point you raised about the perplexing outperformance of DALD trained on a GPT-4 dataset compared to a dataset from the source model Claude3, we would like to point out that their performance is close. In the general direction, a closer distribution of logits can help produce better detection results. However, there is a certain degree of randomness involved, as we are not comparing the direct value of logits, but rather the scoring function in Fast-DetectGPT, which uses logits to calculate the score as the detection metric. In most cases, our results align with our assumptions.

Response to Weakness 2:

Sorry for the unclearness of our fine-tuning datasets. As we discussed in the main text, the only requirement of the fine-tuning dataset is that the texts are generated by the same target model. More concretely, in our experiments, we utilize the corpus generated by ChatGPT and GPT-4 from WildChat[1]. As for Claude-3, the data is from the huggingface[2]. For the open-source model, we randomly select 5000 prompts from Wildchat and generate the output from the open-source models to obtain fine-tuning data. We will share our code with the public for reproduction.

Response to Question 2:

DetectGPT and FastDetectGPT can be applied in both white-box and black-box settings. In the white-box setting, the output logits of the target model will be accessed. However, it is unavailable in the black-box setting, thus methods like DetectGPT and FastDetectGPT utilize a surrogate model to compute the output logits. Our method focuses on the black-box setting since the black-box scenario is more practical but challenging due to the closed-source trend of current models. Therefore, we report and compare the results of DetectGPT and FastDetectGPT in the black-box setting.

Response to Limitation:

Thank you for your feedback on the size of the test dataset. First of all, we follow previous works such as DNA-GPT and FastDetectGPT and utilize the same amount of data for fair evaluation. Moreover, we are happy to provide the evaluation results of our method on different test data sizes, as shown:

It is observed that there is little difference in performance as the number of samples increases, indicating the robustness of our method to test data size.

Reference:

[1] Zhao, Wenting, et al. "Wildchat: 1m chatGPT interaction logs in the wild." arXiv preprint arXiv:2405.01470 (2024).

[2] lodrick-the-lafted/Sao10K_Claude-3-Opus-Instruct-9.5K-ShareGPT

[3] Geiping, Jonas, et al. "How much data are augmentations worth? An investigation into scaling laws, invariance, and implicit regularization." arXiv preprint arXiv:2210.06441 (2022).

Thank you very much for your detailed reviews. Here are our responses to your questions:

Response to Weakness 1:

The detection of black-box commercial LLM models is a critical topic. The rapid updates in these models present a significant and ongoing challenge, as they lead to decreased detection efficiency in existing logit-based zero-shot detectors. Traditional methods require the manual and careful selection of different surrogate models. Our work's most significant contribution is the observation that lightweight distribution alignment (less than 10 mins on a single A6000) between the surrogate model and the target model can significantly improve detection accuracy and effectively address the issue of model updates. The empirical results demonstrate the strong sample efficiency of the proposed approach, which is also supported by theoretical analysis. Furthermore, the empirical results reveal an interesting observation: the approach exhibits relatively strong generalization capabilities and can be used to enhance all existing logit-based detectors.

Response to Weakness 2:

There are two aspects of the generalizability of our method. On the one hand, the model trained on single-source data can perform effectively on different target models, which indicates one-for-all ability. We gently invite the reviewer to check the 3rd line results in Table 2. Our model is only trained on 5K texts generated by GPT-4, yet it demonstrated large performance improvement on ChatGPT, GPT-4, and Claude3. Additionally, we further tested its performance on the newly published models GPT-4o and GPT-4o-mini and found the model also has strong performance on them. These results highlight the generalizability of our approach.

On the other hand, reviewer bnrm also highlighted that the model has the capability of continuous learning. We encourage the reviewer to refer to the 5th line of Table 2 where we present the results of our model which has been trained using 5K texts from multiple sources. Its exceptional performance suggests that if a new closed-source model is released, we can gather a small corpus generated by the model and use it to continue training the surrogate model. Thus, our model can rapidly and continuously adapt to new models with minimal fine-tuning costs.

Response to Weakness 3:

First, our paper contains in-depth experiments that investigate the required data size for fine-tuning. We would like to invite the reviewer to refer to Figure 4, which depicts the performance at various data sizes. This result shows that just about 2k of training data is enough to yield significant improvements, indicating the minimal amount of data needed. Moreover, we performed a theoretical analysis of the amount of training data (refer to the Appendix and the Method section). One of our key contributions is demonstrating that only a minimal tuning cost is required.

Response to Weakness 4:

Thank you for your suggestions about adding more baseline models and different tasks. As suggested, we add comparisons with RADAR:

We utilize the official codebase of RADAR. RADAR is evaluated on the same test dataset as our DALD. As shown in the table, DALD achieves better performance on all datasets. We will add the comparison and discussion to our draft accordingly.

We also include the performance comparison on the coding task. We follow [2] to apply APPS[1] dataset as the coding task. We sample 150 coding tasks from APPS and generate the coding results by calling GPT-4 API. Our method is only trained by the corpus generated by GPT-4 as we previously did. The results are as follows:

Our method obtains significant improvement on the coding task.

Finally, we conduct the experiments on Gemini, as shown in:

Since Gemini has the protection mechanisms(recitation), we only conducted the experiments on the PubMed dataset to evaluate the performance. Our method is still the best compared with other methods, demonstrating the effectiveness of our method.

Reference:

[1] Hendrycks, Dan, et al. "Measuring coding challenge competence with apps." arXiv preprint arXiv:2105.09938 (2021)

[2] Yang, Xianjun, et al. "Zero-shot detection of machine-generated codes." arXiv preprint arXiv:2310.05103 (2023).

Thanks a lot for your detailed and careful reviews. We will give our response to your questions.

Response to Weakness 1:

We appreciate the suggestion of comparison with Ghostbuster and adding experiments comparing our method to Ghostbuster. We utilize the official code of Ghostbuster and evaluate it on the same datasets in our experiments. The results are:

DALD achieves the best performance on all datasets compared with Ghostbuster. We will add the results of Ghostbuster and more discussions to the next version. In addition, we would like to point out that we have already compared our method to training-based methods like Roberta (we gently invite the reviewer to check Table 1), demonstrating its effectiveness in comparison to existing approaches. Concerning the fairness of comparison, we would like to clarify that our method significantly differs from traditional training-based methods, as we only utilize a small amount of data (e.g., around 2k data) to fine-tune the model (less than 10 mins on a single A6000), whereas training-based methods typically require much more training data (250K in Roberta). Therefore, we believe that to demonstrate the uniqueness and advantages of our method, it is essential (and has been) to compare it with both zero-shot and training-based methods.

Response to Weakness 2:

We appreciate your careful review. Due to space constraints in the paper, we omitted results from two other datasets on ChatGPT, so we had to prioritize the study using the most recent datasets available on PubMed. We add the results here (which will also be included in the next version):

It is observed Xsum and Writing on ChatGPT can be well detected by FastDetectGPT. Furthermore, our method further improves the performance on top of FastDetectGPT.

Response to Weakness 3:

Thank you for this suggestion. We will add the ROC curves to the pdf page. We would like to invite you to check Figure 1 on the pdf page. We compare the curve with DNA-GPT and FastDetectGPT. Our method achieves the best performance at low FPR on all datasets.

Response to Weakness 4:

We appreciate the suggestion to incorporate recent open-source models such as Llama 3 and Mistral in our assessment. It's worth noting that the results for Llama 3-8B are already documented in Table 6. Additionally, we intend to present further findings on open-source models like Mistral-7B and the new Llama 3.1-8B. These results are available for review:

The results show that our method achieves the best on all open-source models, demonstrating its effectiveness.

Response to Weakness 5:

While our method might be easy to implement, it's essential to consider the practical implications and benefits it offers. We want to highlight that our work's most significant contribution is the observation that lightweight distribution alignment (less than 10 mins on a single A6000) between the surrogate model and the target model can significantly improve detection accuracy and effectively address the issue of model updates. The empirical results demonstrate the strong sample efficiency of the proposed approach, which is also supported by theoretical analysis. Furthermore, the empirical results reveal an interesting observation: the approach exhibits relatively strong generalization capabilities and can be used to enhance all existing logit-based detectors.