DPIC: Decoupling Prompt and Intrinsic Characteristics for LLM Generated Text Detection

Summary

In this paper, the authors present DPIC, a novel model for detecting LLM-generated text, which centers on having an auxiliary LLM reverse-generate prompt on candidate text, and then letting the LLM re-generate the answers to the prompt and classify them based on the similarity between the candidate and the re-generated text. The authors experimented it with competitors on multiple datasets and claimed that they achieved better performance.

Strengths

- This paper is well written and detailed. - The experiments for the model were adequate. - The core idea of the model is easy to understand and interesting.

Weaknesses

- Lack of detail in evaluation metrics. - The testing model is underrepresented. - Details of the model's consumption of computational resources are missing.

Questions

1. In the manuscript, I did not find out any details about the AUROC evaluation metrics used, such as its formula, or the evaluation steps. I understand that this is a commonly used evaluation metric, but an academic paper should be complete and detailed. The authors only briefly indicated its mathematical meaning, which I think is not sufficient. 2. For the testing part of the models, the authors used three representative commercial closed-source models: gpt-3.5, gpt-4, and claude3 to generate text for specific prompts for model testing. While it can be argued that closed-source models are more difficult to access than open-source models to infer that it is more challenging to recognize text generated by closed-source models, this inference is from the perspective of detection model builder, and applied to a real-world scenario, even if the candidate text is open-source LLM-generated, will the detection model have easy access to the internal parameters used to generate this text? I don't think the authors should make too much of a distinction between closed-source and commercial models for the task of detecting LLM-generated text. So I suggest the authors to add some open-source models to the test models, which will make the conclusions more convincing, and I think the readers are also interested in the differences between texts generated by commercial closed-source models and open-source models. I understand the infeasibility of conducting new experiments in a short period of time, so I would suggest that the authors mention this in the limitations section. 3. The authors mention in question 8 of the checklist that they provide enough details about computational resource consumption in Section 5.1, but I didn't find them in the corresponding section. I think that for this kind of detection task, comparing the running efficiency of the proposed model and the competitors is also an important part. In particular, I'd be interested to know the resource consumption comparison between DPIC models and those that only input candidate text for classification.

Rating

7

Confidence

4

Soundness

3

Presentation

3

Contribution

3

Limitations

I think the statement made by the author in the limitations section (Appendix A) is not sufficient. It seems that the author is only analyzing the results of the experiment in the prompt reconstruction part by mentioning the possible scenarios that may occur when using the model. I would suggest that the authors flesh out this section from the perspective of the model's deployment in a real-world environment and its impact on society. Additionally, I suggest that the authors include an analysis with some of the current techniques that help AI-generated text escape detection, to test whether the model will be defeated by these models.

Summary

This paper addresses the problem of detecting texts generated by large language models (LLMs), which is a crucial issue considering the potential misuse of such models. The authors propose a novel method, DPIC (Decoupling Prompt and Intrinsic Characteristics), which aims to extract the intrinsic characteristics of black-box models, as traditional detection methods requiring access to the model's interior are not feasible. DPIC uses an auxiliary LLM to reconstruct the prompt of a candidate text and regenerate a text from it, allowing the detector to focus on the intrinsic characteristics of the generative model. The similarity between the candidate and regenerated texts is then used as a detection feature. Results show that DPIC outperforms baseline methods, achieving an average improvement of 6.76% and 2.91% in detecting texts from different domains generated by GPT4 and Claude3, respectively.

Strengths

The paper presents a novel approach to distinguishing between machine-generated and human-written texts by decoupling intrinsic characteristics from prompts. This innovative method offers new insights into the essential differences between these two types of text, marking a significant contribution to the field. One of the major strengths of this approach is its applicability to proprietary models. Given the usual inaccessibility to model parameters, working with such black-box models is challenging. The paper also demonstrates robustness across various datasets, source models, and paraphrasing attacks, suggesting that the proposed method is capable of maintaining performance under different conditions and adversarial scenarios. Another significant strength is the method's performance in terms of AUROC. It achieves significantly higher AUROC scores compared to previous zero-shot methods, although the paper acknowledges that comparing a method requiring training to zero-shot methods may not be entirely fair.

Weaknesses

There are a few areas that could be improved. Firstly, the comparison with zero-shot methods seems potentially unfair since the proposed method requires training. Including trained detectors as baselines, for instance, using the same LLM used by DPIC to train a classifier directly, might provide a more balanced comparison. Secondly, the paper lacks a detailed analysis of the method's robustness on different lengths of text and languages. This could limit the applicability of the method in real-world scenarios. Lastly, the content of Section 3 appears misplaced as it discusses experimental settings rather than threat models. A reorganization or further clarification in this section would enhance the overall coherence of the paper.

Questions

Figure2, can we use a pre-trained Siamese Network to measure the similarity in DPIC? Then, we do not need a training here. LN121, the section 3 looks strange because it does not provide a threat model but some experimental settings. Table1, I would expect to see more comparsion with trained detectors given that DPIC is also a trained detector. Figure3, it seems the major contribution is from the supervised training, while the contribution from the prompt is much smaller. Why? Figure3, the improvement of DNA-GPT(prompt) compared to DNA-GPT(supervised) mainly happens on PubMed. Is it caused by the QA style of the dataset?

Rating

7

Confidence

4

Soundness

3

Presentation

3

Contribution

3

Limitations

Yes.

Summary

This paper proposes a novel method named DPIC (Decoupling Prompt and Intrinsic Characteristics) for detecting texts generated by LLMs. The authors posit that generated texts are a coupled product of prompts and intrinsic characteristics, and suggest that decoupling these two elements can enhance detection quality and generalization ability. Specifically, the DPIC method employs an auxiliary LLM to reconstruct the prompt of the candidate text, and then uses this prompt to regenerate the text. By comparing the similarity between the candidate text and the regenerated text, the detector can better focus on the intrinsic characteristics of the generating model. Experimental results show that, compared to baseline methods, DPIC improves the detection of texts generated by GPT-4 and Claude-3 in different domains by an average of 6.76% and 2.91%, respectively.

Strengths

- A new perspective is proposed, improving detection performance by decoupling prompts and intrinsic characteristics, with strong motivation and description. More importantly, this method can handle black-box detection scenarios. - Experimental results demonstrate that the DPIC method significantly enhances detection quality and generalization ability, especially when dealing with black-box models.

Weaknesses

- DPIC involves multiple steps, including prompt reconstruction and text regeneration, which significantly increase computational costs and resource overhead in practical applications. An ablation analysis on the impact of the training sample size would help readers further understand and evaluate the DPIC method. - DPIC is essentially a supervised method and should be compared fairly with methods based on RoBERTa (not the OpenAI detector trained on GPT-2 but a RoBERTa classifier trained from scratch). - Supervised methods perform well within their domain but have poor out-of-distribution generalization ability, which lacks discussion in the paper. For example, the performance of DPIC trained on XSum on Writing, and the performance of DPIC trained on ChatGPT re-generated data on Claude-3. This is crucial for highlighting the effectiveness of DPIC in practical applications.

Questions

How is the accuracy of prompt reconstruction evaluated? Did the authors verify the consistency between the reconstructed prompts and the original prompts? If there is a significant difference between the reconstructed prompts and the original prompts, how much impact would that have on the detection results?

Rating

6

Confidence

4

Soundness

3

Presentation

3

Contribution

3

Limitations

The authors did not discuss the out-of-distribution generalization ability of DPIC.

Summary

This paper develops an LLM-generated text detection method by ****. The key idea is to regenerate text based on a prompt reconstructed by an auxiliary LLM from the candidate text so that the regenerated text and the original candidate text can be used to extract similarity-based features, which are used for a classifier.

Strengths

- (S1) The idea is simple and intuitive. - (S2) Comprehensive experiments and analysis especially including paraphrased machine-generated text such as DIPPER and back-translate (in Table3) - (S3) The paper is well-written and easy to follow.

Weaknesses

- (W1) It is not clear if the proposed method can replace other classification-based methods. Ghostbuster [41] is known to be a strong machine-generated text detection method and should be compared for evaluation (it also offers a benchmark as well). Other recent simple-yet-effective methods could be compared as well. For example, - [Ref 1] Smaller Language Models are Better Zero-shot Machine-Generated Text Detectors https://aclanthology.org/2024.eacl-short.25.pdf - [Ref 2] Your Large Language Models Are Leaving Fingerprints https://arxiv.org/abs/2405.14057 - (W2) The datasets used for evaluation might be too easy to detect. Unless there’s a special reason, the proposed should also be tested in other benchmarks used for machine-generated text detection research (e.g., the Ghostbuster dataset). - (W3) The feature extraction is computationally expensive. Two LLM inferences (prompt generation, candidate text regeneration) and then dual-encoder-based feature extraction. It is not clear if the feature extraction offers significantly better benefits compared to more lightweight approaches (e.g., [Ref 1][Ref 2] above) ### Minor comments For perturbation, in addition to DIPPER, OUTFOX is another option. - [Ref 3] OUTFOX: LLM-Generated Essay Detection Through In-Context Learning with Adversarially Generated Examples https://arxiv.org/abs/2307.11729

Questions

Please answer the weaknesses raised in the Weaknesses section.

Rating

6

Confidence

4

Soundness

3

Presentation

3

Contribution

3

Limitations

Yes.