The unregulated use of LLMs can potentially lead to malicious consequences such as plagiarism, generating fake news, spamming, etc. Therefore, reliable detection of AI-generated text can be critical to ensure the responsible use of LLMs. Recent works attempt to tackle this problem either using certain model signatures present in the generated text outputs or by applying watermarking techniques that imprint specific patterns onto them. In this paper, we show that these detectors are not reliable in practical scenarios. In particular, we develop a recursive paraphrasing attack to apply on AI text, which can break a whole range of detectors, including the ones using the watermarking schemes as well as neural network-based detectors, zero-shot classifiers, and retrieval-based detectors. Our experiments include passages around 300 tokens in length, showing the sensitivity of the detectors even in the case of relatively long passages. We also observe that our recursive paraphrasing only degrades text quality slightly, measured via human studies, and metrics such as perplexity scores and accuracy on text benchmarks. Additionally, we show that even LLMs protected by watermarking schemes can be vulnerable against spoofing attacks aimed to mislead detectors to classify human-written text as AI-generated, potentially causing reputational damages to the developers. In particular, we show that an adversary can infer hidden AI text signatures of the LLM outputs without having white-box access to the detection method. Finally, we provide a theoretical connection between the AUROC of the best possible detector and the Total Variation distance between human and AI text distributions that can be used to study the fundamental hardness of the reliable detection problem for advanced language models. Our code is publicly available at https://github.com/vinusankars/Reliability-of-AI-text-detectors.

翻译：大型语言模型（LLM）的不受约束使用可能引发抄袭、生成虚假新闻、垃圾信息等恶意后果。因此，对AI生成文本的可靠检测对于确保LLM的负责任使用至关重要。近期研究尝试通过检测生成文本输出中的特定模型特征，或应用水印技术在其上烙印特定模式来应对这一问题。本文表明，这些检测器在实际场景中并不可靠。具体而言，我们开发了一种递归重述攻击方法应用于AI文本，能够突破包括水印方案、基于神经网络的检测器、零样本分类器以及基于检索的检测器等在内的多种检测系统。实验中我们使用约300个词元的段落，揭示了即便在相对较长文本情况下检测器的敏感性。同时，通过人工研究及困惑度分数、文本基准准确率等指标测量，我们发现递归重述仅轻微降低文本质量。此外，我们证明即便受水印方案保护的LLM也易受欺骗攻击——此类攻击旨在误导检测器将人类撰写的文本误判为AI生成，可能对开发者造成声誉损害。具体而言，我们展示了攻击者无需对检测方法进行白盒访问即可推断LLM输出的隐藏AI文本特征。最后，我们建立了最优检测器的AUROC值与人类与AI文本分布之间的全变差距离的理论关联，该关联可用于研究针对先进语言模型可靠检测问题的根本难度。我们的代码已在https://github.com/vinusankars/Reliability-of-AI-text-detectors 公开。