Deep Kernel Relative Test for Machine-generated Text Detection

We thank you for reviewing our paper and giving valuable comments. We will include rebuttal discussions in the updated version to make the final version more clear to our readers. We hope the answers below solve your concerns. If your concerns were not cleared, please let us know, and we'll try to clarify them further. We also hope you can re-evaluate our paper based on the answers and consider raising your score.

Weakness 1: The assumptions on which the method is based are too strong and do not align with reality. Firstly, there is significant overlap between machine-generated language and human language; they do not exist in completely separate domains. Additionally, the subspace assumption is overly idealized and lacks a solid foundation, which greatly undermines the paper's validity.

We would like to clarify that the purpose of introducing this assumption is to ensure the theoretical rigor of our proposed method. As you correctly pointed out, it is clearly true in the wild that there is significant overlap between machine-generated language and human language, and we fully acknowledge this fact. Consequently, it is impossible for any detector to reliably differentiate machine-generated texts (MGTs) from human-written texts (HWTs) within this overlapping area.

This raises an important question: when a detector fails in practice, is the failure due to inherent flaws in its design, or is it simply encountering this theoretically undetectable overlap? By explicitly incorporating this assumption, we aim to delineate the boundary where our method—and indeed any method—might face principled limitations, thereby providing a clearer understanding of the contexts in which failure is expected.

Weakness 2: The method proposed in the article resembles a general text anomaly detection approach and is not closely related to large language models or machine-generated language detection. It appears to be a universal solution for text anomaly detection rather than a targeted one, as the specific characteristics of the problem have not been discussed or reflected in the method's design.

The theoretical support of our method is relative hypothesis test, which is a universal solution to test if the hypothesis "the distribution Z is closer to the distribution Q than to the distribution P" is statistically true. Originally, it is a universal solution at the distribution level rather than one targeted at MGT detection.

However, no existing study explicitly explores whether or how relative testing can be used for MGT detection. Therefore, one of our key contributions is to fill this gap. The experimental results of R-Detect-k^m and R-Detect w/o k* in Table 2 and Table 3 indeed show that the original relative test cannot work very well in MGT detection tasks, especially when the HWTs are from unseen distribution. Our proposed version R-Detect can overcome that and perform excellently in MGT detection tasks.

In addition, the intuitive explanations of how the Test Power in relative hypothesis test is connected with TPR/FPR in MGT detecion can be found in Section 3.1 Test Power v.s. TPR v.s. FPR. (Line #206, highlighted in cyan).

The comparative methods in the experiments are relatively few and not comprehensive enough. Many anomaly detection solutions could also address this issue, so more comparisons and discussions should be provided.

• We are conducting more experiments. As one of our key contributions is ``enriching the MGT detection framework with robust theoretical foundations derived from hypothesis testing", we add more comparative experiments to existing MGT detection methodologies. Following reviewer [4sdF]'s comments the experiments will include

1. More baselines such as few-shot detection [ICLR'24], threads-of-subtlety (awaiting code availability) [ACL'24], Detect-GPT [ICML'23], Fast-DetectGPT [ICLR'24], DNA-GPT [ICLR'24], DALD [NeurIPS'24].
2. Testing on the benchmark proposed in RAID [ACL'24], which includes data with adversarial attacks and non-English texts.
3. Testing feature generators other than Roberta-based GPT-2, such as ChatGPT Detector [r1].
   [r1] How close is ChatGPT to human experts? Comparison corpus, evaluation, and detection. ArXiv 2023.

• The results will be updated gradually in rebuttal replies and updated to the submission.

Dear Reviewer Er1T,

Thank you so much for taking the time to thoroughly review our paper and provide insightful feedback! We really enjoy the discussion with you and deeply appreciate your support!

Best,

Thank you for your time and prompt replies! We apologise for potentially misunderstanding your questions in the first round. Below, we clarify our responses to the points you raised:

1. Should the assumptions originate from the problem?

The key gap lies in how we interpret "assumption." If an "assumption" refers to a mathematical description of the problem, it must stem from the practical problem. In the original submission, we used Problem 1 to describe this practical problem:
MGT detection aims to find a detector $f: S_h \cup \mathcal{S}_{\rm m} \rightarrow \{\text{MGT}, \text{HWT}\}$, which effectively distinguishes between MGTs and HWTs.
As you noted, the method can still be derived without this assumption. From the perspective of problem description, this is true, as the detection problem is fundamentally about finding a mapping function that maps text to MGT or HWT, regardless of whether MGTs and HWTs overlap.

However, in our original submission, the assumption refers to the method itself. For instance, suppose the word "cat" is written by a human while another "cat" is generated by a machine. In this case, the text "cat" overlaps between HWTs and MGTs. If we assume that this text can belong to both HWT and MGT, the corresponding mathematical problem becomes "the same $X$ has two different $Y$s," which is a completely different story.

Thanks again for your valuable insights on this point! We realise this point hasn't been explicitly explained in the main context. We will refine the draft with the following revisions:

1. Move the assumption after proposing Problem 1. Instead of "overlapped", it should be "identical" in the assumption.
2. Add an explanation of the assumption between Problem 1 and the assumption.
3. Include the following toy study as a figure to demonstrate how detection performance varies when we manually increase the distance $\mu$ between the distributions of $\mathbb{P}$ and $\mathbb{Q}$ (i.e., the mathematical reflection of decreasing the overlap ratio). The results show that test power increases as the overlap between distributions decreases.

2. Weak Motivation

In the first round, one of your concerns was: "It appears to be a universal solution for text anomaly detection rather than a targeted one." That is why we responded by explaining that the relative test is a universal solution but has not yet been explored for MGT detection.

In the MGT detection problem (our Problem 1), the effectiveness is evaluated using TPR/FPR. Intuitive explanations of how Test Power in hypothesis testing relates to TPR/FPR in MGT detection can be found in Section 3.1: Test Power vs. TPR vs. FPR (Line #206, highlighted in cyan):
"Consequently, the test power in R-Detect, given that the ground truth is an MGT, is the probability that an MGT is correctly identified as an MGT, corresponding to TPR. Similarly, the test power in R-Detect, given that the ground truth is an HWT, is the probability that an HWT is incorrectly identified as an MGT, corresponding to FPR."

Test power and hypothesis test have their statistical support. Therefore, as pointed in our first contribution:
"The potential of using statistical hypothesis tests for MGT detection is explored, enriching the detection framework with robust theoretical foundations derived from hypothesis testing." (Line #102)

We thank you for reviewing our paper and giving valuable comments. We will include rebuttal discussions in the updated version to make the final version more clear to our readers. We hope the answers below solve your concerns. If your concerns were not cleared, please let us know, and we'll try to clarify them further. We also hope you can re-evaluate our paper based on the answers and consider raising your score.

Concern 1): The limitation of these MMD-based approach is obvious. The appraoch by nature is not Zero-Shot aaproach. As the approach needs to prepare HWT and MGT in advance, I would say the approach is not training free by nature. Especially, the paper proposes kernel optimisation algorithm to select best kernel. This by nature is somehow “training”. Thus, the approach only compare times with Bino is not sufficient, as it also needs to compare time with training/classifier based approach (Table 2)

• It is worth noting that although Bino is zero-shot, it is based on the output of pre-trained LLMs, while our "pre-training" is merely a deep kernel using an NVIDIA RTX graphics card with 16 GB of memory.
• It is also worth noting that we only trained the kernel once with HC3 and tested it for ALL experiments. Fairly speaking, the experiments in Section 4.2.2 (when HWTs are from unseen distributions) and Section 4.4 (detecting GPT4-rewritten texts) can be considered zero-shot testing. Clearly, these are more challenging tasks.

Concerns 2)-6): we understand these concerns as insufficient experiments

• We are conducting more experiments,where we use the same kernel trained from HC3. Following your comments, the experiments will include:

1. More baselines such as few-shot detection [ICLR'24], threads-of-subtlety (awaiting code availability) [ACL'24], Detect-GPT [ICML'23], Fast-DetectGPT [ICLR'24], DNA-GPT [ICLR'24], DALD [NeurIPS'24].
2. Testing on the benchmark proposed in RAID [ACL'24], which includes data with adversarial attacks and non-English texts.
3. Testing feature generators other than Roberta-based GPT-2, such as ChatGPT Detector [r1] and Falcon-7B's feature generator (e.g., Bino's).
   [r1] How close is ChatGPT to human experts? Comparison corpus, evaluation, and detection. ArXiv 2023.

In the above three experiments, we directly used the previously trained kernel from HC3 and didn't train the kernel with new data. Additionally, we will conduct

4. the effectiveness of our method when training the kernel with RAID data.

• The results will be updated gradually in rebuttal replies and updated to the draft.

Concern 7): The literature review is far from sufficient. Pl refer to the recent surveys such as: A Survey of AI-generated Text Forensic Systems: Detection, Attribution, and Characterization A Survey on Detection of LLMs-Generated Content, EMNLP’24. On the Possibilities of AI-Generated Text Detection\

We have reviewed On the Possibilities of AI-Generated Text Detection"* in the first version (Line \#96, \#117, and \#477). We add the review of *A Survey of AI-generated Text Forensic Systems: Detection, Attribution, and Characterization" and ``A Survey on Detection of LLMs-Generated Content" in the updated version (Line #475, #483, highlighted in cyan).

Dear Reviewer 4sdF,

Following your suggestion, we have conducted experiments on the Beemo benchmark, which contains paired HWT and MGT to the same expert question. In addition, the MGT will be rewritten by a different LLM with prompts asking for more human-like texts. Specifically,

Before we give the results, here is the notation of data:

• mix1: represents a mixture of MGTs generated by gemma-7b-it, tulu-2-7b, gemma-2b-it, tulu-2-13b.

• mix2: represents a mixture of MGTs generated by Llama-2-13b-chat-hf, Llama-2-70b-chat, Mixtral-8x7B-Instruct-v0.1, tulu-2-7b.

• mix3: represents a mixture of MGTs generated by tulu-2-13b, Mixtral-8x7B-Instruct-v0.1, gemma-2b-it, Llama-2-13b-chat-hf, gemma-7b-it.

• att#: LLM#1|LLM#2 means using LLM#2 to rewrite the LLM#1-generated texts by prompts asking for more human-like texts.

• att1: represents a mixture of MGTs generated by:

  • gemma-7b-it|llama-3.1-70b/gpt-4o
  • tulu-2-7b|gpt-4o
  • gemma-2b-it|llama-3.1-70b
  • tulu-2-13b|llama-3.1-70b.

• att2: represents a mixture of MGTs generated by:

  • Llama-2-13b-chat-hf|llama-3.1-70b
  • Llama-2-70b-chat-hf|llama-3.1-70b
  • Mixtral-8x7B-Instruct-v0.1|gpt-4o
  • Llama-2-13b-chat-hf|gpt-4o
  • tulu-2-7b|gpt-4o.

• att3: represents a mixture of MGTs generated by:

  • tulu-2-13b|gpt-4o
  • Mixtral-8x7B-Instruct-v0.1|gpt-4o
  • gemma-2b-it|llama-3.1-70b
  • Llama-2-13b-chat-hf|gpt-4o
  • gemma-7b-it|gpt-4o.

The results are in Table r5.

Table r5: Test on Benchmark Beemo [arXiv24]

The results demonstrate that our method performs the best compared to other baselines on this benchmark. If you feel our responses have satisfactorily addressed your concerns, it would be greatly appreciated if you could raise your score to show that the existing concerns have been addressed.

Thank you!

The Authors

Dear Reviewer 4sdF,

We are happy to see that most of your concerns are addressed well! We also noticed that you updated your score to 6. Many thanks for recognizing our contributions to the field.

We will merge all of our discussions, which can definitely help improve our paper further.

Best regards,

Authors of Submission 4390

We thank you for reviewing our paper and giving valuable comments. We will include rebuttal discussions in the updated version to make the final version more clear to our readers. We hope the answers below solve your concerns. If your concerns were not cleared, please let us know, and we'll try to clarify them further.

Weakness 1: While this paper presents some innovative ideas, its significance appears limited. There has been some similar studies such as the ICLR'24 paper "Detecting machine-generated texts by multi-population aware optimization for maximum mean discrepancy."

The unique contribution of our method compared to MPP is reflected in the following aspects:

• Contribution 1: We are the first study that validates how relative tests are used and preferred over two-sample tests in MGT detection, while MPP [ICLR'24] uses two-sample tests instead.
• Contribution 2: We are the first study that provides a solution to optimize kernels in relative tests, while MPP [ICLR'24] only focuses on kernel optimization in two-sample tests.

The significance of Contribution 1 is demonstrated in Section 4.2, where we show the superior performance of using relative tests compared to two-sample tests in the same settings. The comparative results between R-Detect (i.e., detect by relative test) and MPP-HWT/MPP-MGT (i.e., detect by two-sample test using HWT or MGT reference) in Table 2 show the advancement of our method when HWTs are from seen HWT distributions. Similarly, the comparative results between R-Detect and MPP-HWT/MPP-MGT in Table 3 show the advancement of our method when HWTs are from unseen HWT distributions.

The significance of Contribution 2 is demonstrated by the comparative results in Table 2 and 3 among R-Detector, R-Detector w/o K* (i.e., using kernels but not optimizing kernels), and R-Detector $k^m$ (i.e., using kernels optimized by median heuristic bandwidth). The results show that our proposed optimization for relative tests is very effective in MGT detection.

Weakness 2: The proposed method requires the preparation of both the MGT and HWT datasets. In that case, simply comparing the method with Bino in the experiment is insufficient, and may even be unfair because Bino is a zero-shot method. It is essential for the authors to engage in a comprehensive experimental study, comparing their proposed method with various other detection algorithms.

• It is worth noting that although Bino is zero-shot, it is based on the output of pre-trained LLMs, while our "pre-training" is merely a deep kernel using an NVIDIA RTX graphics card with 16 GB of memory.

• It is also worth noting that we only trained the kernel once with HC3 and tested it for ALL experiments. Fairly speaking, the experiments in Section 4.2.2 (when HWTs are from unseen distributions) and Section 4.4 (detecting GPT4-rewritten texts) can be considered zero-shot testing. Clearly, these are more challenging tasks.

We are conducting more experiments,where we use the same kernel trained from HC3. Following Reviewer [4sdF]'s comments, the experiments will include:

1. More baselines such as few-shot detection [ICLR'24], threads-of-subtlety (awaiting code availability) [ACL'24], Detect-GPT [ICML'23], Fast-DetectGPT [ICLR'24], DNA-GPT [ICLR'24], DALD [NeurIPS'24].
2. Testing on the benchmark proposed in RAID [ACL'24], which includes data with adversarial attacks and non-English texts.
3. Testing feature generators other than Roberta-based GPT-2, such as ChatGPT Detector [r1] and Falcon-7B's feature generator (e.g., Bino's).
   [r1]: How close is ChatGPT to human experts? Comparison corpus, evaluation, and detection. ArXiv 2023.

In the above three experiments, we directly used the previously trained kernel from HC3 and didn't train the kernel with new data. Additionally, we will conduct

4. the effectiveness of our method when training the kernel with RAID data.

The results will be updated gradually in rebuttal replies and updated to the submission.

Dear Reviwer hh24,

Thank you for taking your time to provide us with your valuable comments, which helped improve our paper.

We have replied to your concerns and questions below in section Replies to Weakness 1 and 2.

The newly added experiment results are presented in section Newly added experiments: result summary, design and notations, and we also validate the analysis summary in section Experimental results are updated.

We are still waiting for more experimental results which have been listed in section Replies to Weakness 1 and 2.

We would like to gently remind you that the discussion period is nearing its conclusion, we hope you have taken the time to consider our responses to your review. If you have any additional questions or concerns, please let us know so we can resolve them before the discussion period concludes. If you feel our responses have satisfactorily addressed your concerns, it would be greatly appreciated if you could raise your score to show that the existing concerns have been addressed.

Thank you!

The Authors

Table r1: Comparative AUROC to more baselines on RAID data (non-attack) in zero-shot setting

Table r2: Comparative AUROC to more baselines on RAID under attack in zero-shot setting

Table r3: Test on non-English RAID data (with and without attack) in different settings

Table r4: Test with different feature extractors

Following Reviewer [4sdF]'s reply, two baselines and two benchmarks are suggested where the result of DALD [NeurIPS'24] has been attached in the first round added experiments. In this section, we give the experimental results on one of the benchmark Beemo [arXiv'24] which contains paired HWT and MGT to the same expert question. In addition, the MGT will be rewritten by a different LLM with prompts asking for more human-like texts. Specifically,

Notes of datasets:

• mix1: represents a mixture of MGTs generated by gemma-7b-it, tulu-2-7b, gemma-2b-it, tulu-2-13b.

• mix2: represents a mixture of MGTs generated by Llama-2-13b-chat-hf, Llama-2-70b-chat, Mixtral-8x7B-Instruct-v0.1, tulu-2-7b.

• mix3: represents a mixture of MGTs generated by tulu-2-13b, Mixtral-8x7B-Instruct-v0.1, gemma-2b-it, Llama-2-13b-chat-hf, gemma-7b-it.

• att#: LLM#1|LLM#2 means using LLM#2 to rewrite the LLM#1-generated texts by prompts asking for more human-like texts.

  • att1: represents a mixture of MGTs generated by:
    • gemma-7b-it|llama-3.1-70b/gpt-4o
    • tulu-2-7b|gpt-4o
    • gemma-2b-it|llama-3.1-70b
    • tulu-2-13b|llama-3.1-70b.
  • att2: represents a mixture of MGTs generated by:
    • Llama-2-13b-chat-hf|llama-3.1-70b
    • Llama-2-70b-chat-hf|llama-3.1-70b
    • Mixtral-8x7B-Instruct-v0.1|gpt-4o
    • Llama-2-13b-chat-hf|gpt-4o
    • tulu-2-7b|gpt-4o.
  • att3: represents a mixture of MGTs generated by:
    • tulu-2-13b|gpt-4o
    • Mixtral-8x7B-Instruct-v0.1|gpt-4o
    • gemma-2b-it|llama-3.1-70b
    • Llama-2-13b-chat-hf|gpt-4o
    • gemma-7b-it|gpt-4o.

Table r5: Test on Benchmark Beemo [arXiv24]

• human-mix attack of benchmark DetectRL[NeuRIPS'24] means the MGT is generated by "replacing one-quarter of the sentences in an LLM-generated text with human-written text at random".
• prompt attack of benchmark DetectRL[NeuRIPS'24] is "intended to use carefully designed prompts to guide LLMs in generating text that closely mimics human writing style".

Table r6: Test on Benchmark [NeuRIPS'24]