DALD: Improving Logits-based Detector without Logits from Black-box LLMs

The advent of Large Language Models (LLMs) has revolutionized text generation, producing outputs that closely mimic human writing. This blurring of lines between machine- and human-written text presents new challenges in distinguishing one from the other a task further complicated by the frequent updates and closed nature of leading proprietary LLMs. Traditional logits-based detection methods leverage surrogate models for identifying LLM-generated content when the exact logits are unavailable from black-box LLMs. However, these methods grapple with the misalignment between the distributions of the surrogate and the often undisclosed target models, leading to performance degradation, particularly with the introduction of new, closed-source models. Furthermore, while current methodologies are generally effective when the source model is identified, they falter in scenarios where the model version remains unknown, or the test set comprises outputs from various source models. To address these limitations, we present Distribution-Aligned LLMs Detection (DALD), an innovative framework that redefines the state-of-the-art performance in black-box text detection even without logits from source LLMs. DALD is designed to align the surrogate model's distribution with that of unknown target LLMs, ensuring enhanced detection capability and resilience against rapid model iterations with minimal training investment. By leveraging corpus samples from publicly accessible outputs of advanced models such as ChatGPT, GPT-4 and Claude-3, DALD fine-tunes surrogate models to synchronize with unknown source model distributions effectively.

Paper

Similar papers

Peer review

Reviewer bnRm5/10 · confidence 4/52024-07-11

Summary

This paper proposes a framework named Distribution-Aligned LLMs Detection (DALD) to improve the performance of surrogate models in detecting LLM-generated text from both closed-source and open-source models. The method enhances detection performance by aligning the distribution of the surrogate model to better match the distribution of the target model. The paper verifies the effectiveness of DALD on various advanced closed-source and open-source models through extensive experiments and demonstrates its "plug-and-play" enhancement capability in a zero-shot detection framework.

Strengths

- It is gratifying that this paper reflects on existing logits-based methods and proposes the DALD framework, which improves detection performance by aligning the distribution of the surrogate model, achieving superior performance. - The proposed method uses small-scale datasets for fine-tuning, which is cost-effective and highly adaptable, allowing it to quickly adapt to rapid iterations and updates of models, demonstrating good usability. - Ablation experiments are comprehensive. The framework also shows good performance in scenarios such as Non-English Detection and Adversarial Attack.

Weaknesses

- The method's interpretability is still insufficient. I am not entirely sure, but one point that confuses me is why training DALD on datasets from multiple source models performs better than training on a dataset from a single source model (see Table 2). Since DALD essentially aligns the logits distribution of the surrogate model with that of the source model, this is a crucial starting point of the paper. However, training DALD on datasets from multiple source models theoretically and intuitively would not align distributions better than a single source model, which is contradictory. Similarly, in the Claude-3 setting, DALD trained on a GPT-4 dataset even outperforms DALD trained on a dataset from the source model Claude-3, which is perplexing. - There is a lack of detail about the datasets used for fine-tuning, such as their sources, topics, or other attributes, which could help readers understand and reproduce the method. In fact, I am very curious about the impact of the fine-tuning dataset on DALD, aside from the sample size.

Questions

- Please refer to the weaknesses, especially Weakness 1. - An additional question: I noticed that DetectGPT and Fast-DetectGPT are described as black-box methods. Is this because they use surrogate models? In fact, all logits-based methods (including Likelihood and Rank) can use surrogate models, depending on whether the scenario is white-box or black-box.

Rating

5

Confidence

4

Soundness

2

Presentation

3

Contribution

3

Limitations

- The testing dataset is insufficient; all datasets contain only 150 human-written samples, and the experimental results obtained may actually be biased, which is indeed my concern.

Reviewer 3RMB8/10 · confidence 3/52024-07-12

Summary

This paper proposes a method to improve black-box detection of machine-generated text, tackling the problem of performance degradation when a surrogate model's output is poorly aligned with the closed-source target LLM. By LORA fine-tuning the surrogate model on text generated by the target model, the authors align the surrogate model's output distribution to the target model, thus improving detection performance. The authors show that this alignment can be used to outperform/improve existing logit detection methods such as DetectGPT, DNA-GPT and Fast-DetectGPT; is effective across a range of surrogate models; and requires only a small amount of fine-tuning (and thus can be keep surrogate models up-to-date when newer models are released).

Strengths

- **Consistent performance improvements**: Ablation study (Table 4) suggests that DALD leads to consistent and significant improvements across target models and datasets, for all three logit-based methods - **Surprisingly effective**: it's quite surprising to me that a relatively low amount of data/fine-tuning is so effective at aligning the probability distributions of target and surrogate models. I wonder how effective DALD is for more niche tasks/text genres, in cases where there may be less overlap between the training corpus and the evaluation text? (the authors briefly touch on this when discussing PubMed results) - **Application to non-English & practical settings**: The authors demonstrate that DALD can also help tackle the issue of non-English detection bias by showing performance improvements for German. They also show that their method is robust to machine-generated text that has undergone adversarial attacks.

Weaknesses

- **Generalizability may be overstated** (Table 2): The authors cite the superior performance of their one-for-all surrogate model as evidence that their method could be extended to detect texts of unknown source models. However, the improvements seems very slight: I agree with their interpretation that current closed-source models tend to have a similar distribution, but this homogeneity might not necessarily be true for future versions of these models and/or other future closed-source models. - **Effectiveness across surrogate models** (Table 3): DALD doesn't significantly improve the detection performance of all surrogate models. For example, its effect on GPT2-Neo 2.7B, though positive, seems fairly minor. Does this indicate a limitation of their DALD method (e.g. that it is only effective when the performance gap/parameter size/pre-training data difference between surrogate and target is relatively small)? - **Limitation and Future work section** is extremely brief, and does not adequately address limitations

Questions

See Weaknesses Section. (and Strengths bullet point 2) Also, minor nitpicks / typos: Typos: - Line 187: is freezing - Line 215: OpanAI - Line 244: pertraining - Line 574: We

Rating

8

Confidence

3

Soundness

3

Presentation

3

Contribution

3

Limitations

Limitations section was extremely brief and only discussed extending their evaluation of multilingual performance.

Reviewer yZjY5/10 · confidence 3/52024-07-12

Summary

This paper introduces Distribution-Aligned LLMs Detection (DALD), a novel framework for detecting AI-generated text from large language models (LLMs). DALD addresses limitations of traditional detection methods, particularly when dealing with black-box or unknown LLMs. It aligns surrogate models with unknown target LLM distributions, enhancing detection capability across various models without requiring access to their internal logits. The approach leverages corpus samples from publicly available outputs of advanced models to fine-tune surrogate models, achieving state-of-the-art performance on both closed-source and open-source models. DALD can be integrated into existing zero-shot detection frameworks and demonstrates robustness against revised text attacks and non-English texts, offering a versatile solution for the evolving challenge of distinguishing AI-generated content from human-written text.

Strengths

1. The paper proposes a highly effective text detection framework. 2. The paper utilizes the fact that models can generate text under black-box settings to train a surrogate model, achieving efficient prediction in black-box scenarios. 3. The framework presented in the paper is actually plug-and-play and can be integrated into logit-based detection methods such as DetectGPT and Fast-DetectGPT.

Weaknesses

1. Since DALO is a training-based method, it may be unfair to compare it with the zero-shot method(Detect-GPT, DNA-GPT, and Fast-DetectGPT). Comparing it with other SOTA training-based methods such as Ghostbuster[1] is necessary. 2. Only testing PubMed on ChatGPT while testing all three datasets on GPT-4 and Claude. 3. For reliability, it is important to see how well the detector performs at low FPR regimes [2]. 4. Expanding your evaluation to include recent open-source models such as Llama 3 and Mistral/Mixtral would enhance the breadth and relevance of your study. 5. The method is easy and lacks contribution in technology. [1] Vivek Verma, Eve Fleisig, et al. "Ghostbuster: Detecting text ghostwritten by large language models" (2023). [2] Sadasivan, Vinu Sankar, et al. "Can ai-generated text be reliably detected?" arXiv preprint arXiv:2303.11156 (2023).

Questions

1. Could you compare it with other SOTA training-based methods such as Ghostbuster[1]? 2. Why did you just test PubMed on ChatGPT while testing all three datasets on GPT-4 and Claude? 3. Could you provide the ROC curves for your detector? For reliability, it is important to see how well the detector performs at low FPR regimes [2]. 4. Why not conduct some experiments on open-source LLM like Llama 3 and Mistral/Mixtral? [1] Vivek Verma, Eve Fleisig, et al. "Ghostbuster: Detecting text ghostwritten by large language models" (2023). [2] Sadasivan, Vinu Sankar, et al. "Can ai-generated text be reliably detected?" arXiv preprint arXiv:2303.11156 (2023).

Rating

5

Confidence

3

Soundness

2

Presentation

3

Contribution

2

Limitations

Yes

Reviewer iaeF4/10 · confidence 3/52024-07-13

Summary

The paper addresses the challenge of detecting machine-generated text from black-box LLMs without access to their logits. Traditional methods using surrogate models suffer from performance degradation due to misalignment with target model distributions, particularly as new models are introduced. The proposed Distribution-Aligned LLMs Detection (DALD) framework aligns surrogate model distributions with unknown target LLMs. DALD enhances detection capabilities, achieving state-of-the-art performance in black-box settings, and offers a plug-and-play enhancement to existing zero-shot detection frameworks. Extensive experiments validate DALD's high detection precision against revised text attacks and non-English texts.

Strengths

1. The detection of machine-generated text is an important problem. 2. The paper includes theoretical analysis on the effectiveness of fine-tuning.

Weaknesses

1. The idea lacks novelty; collecting data from models with the same version as the target model and then aligning the surrogate model is not novel. 2. The proposed method appears to heavily rely on alignment data collection and specific model versions. Does this mean the surrogate model needs continuous fine-tuning, when the detection task varies? If so, what is the generalizability? 3. The paper missing abalation studies on how much fine-tuning data is required when the detection task varies in different categories. If the data requirement is large, it could pose a problem for the detection task. 4. The paper is missing important baselines such as RADAR [1] and could benefit from evaluation on more models like Gemini and additional tasks, including coding tasks. ## Reference [1]. Radar: Robust ai-text detection via adversarial learning. NeurIPS 2023.

Questions

Please refer to the weaknesses.

Rating

4

Confidence

3

Soundness

3

Presentation

2

Contribution

2

Limitations

Please refer to the weaknesses.

Authorsrebuttal2024-08-07

General Response

## General Response Dear AC and Reviewers, We would like to sincerely appreciate the reviewers for their positive feedback and highly constructive comments. To improve the clarity and readability of the paper, the following changes have been made and the manuscript will be revised accordingly in the next version. * We clarified some misunderstandings of the reviewers about the method and experiment. * We added more experiments and explanations to demonstrate the generalizability of DALD. * We added more baseline comparisons including Ghostbuster and RADAR. * We provided the ROC curves of our detector and other methods. * We added more experiments on open-source models including llama3.1-8B, and Mistral-7B. * We added more experiments on RAID datasets with more topics. * Add a detailed discussion of the limitations and future work. Thanks again, The Authors

Reviewer 3RMB2024-08-12

Thanks for your response. I appreciate the additional results you've provided on domain-specific datasets as well as for GPT-Neo-2.7B on GPT-4 (Weakness 2).

Authorsrebuttal2024-08-12

Response to Reviewer 3RMB

Dear Reviewer 3RMB, Thank you very much for your comments. We will revise our manuscript accordingly in the next version. Best, Author

Reviewer bnRm2024-08-13

Official Comment by Reviewer bnRm

I would like to thank the responses provided by authors. However, my concerns about the Weakness 1 are not well addressed. Specifically, regarding the observation that "DALD trained on the GPT-4 dataset performs better than the source model Claude3's dataset," are the logits distributions of GPT-4 and Claude3 truly similar? This contradicts my experience, and I still have doubts about the consistency between the assumptions and experimental results.

Authorsrebuttal2024-08-13

Response to Reviewer bnRm

Dear Reviewer bnRm, Thank you very much for your reply. We really appreciate your suggestions on our work. Regarding your concern about our assumption and experimental results, as we discussed in the main text, the training data generated by GPT-4 is from WildChat[1], which is a high-quality dataset. However, WildChat does not include the data generated from Claude3. In order to save money, we didn't call Claude3 API to generate training data. The data of Claude3 was collected from the public output in Huggingface without a quality guarantee[2]. Therefore, the performance of the model trained by data generated from Claude is relatively worse than that trained by data generated from GPT-4. For a fair comparison, we sampled 5k prompts from wildchat and called Claude API to generate the training dataset. Then, we utilize the generated dataset to fine-tune the surrogate model and provide the results here(we will also include this in the next version): | | PubMed | Xsum | Writing | |---------------------|--------|--------|---------| | DALD(GPT-4 data) | 0.9875 | 0.9993 | 0.9977 | | DALD(Claude-3 data) | 0.9942 | 0.9994 | 0.9993 | The results show that the model trained by data generated from Claude3 is better than the one trained by data from GPT-4, demonstrating the correctness of our assumption and the consistency of experimental results. [1] Zhao, Wenting, et al. "Wildchat: 1m chatGPT interaction logs in the wild." arXiv preprint arXiv:2405.01470 (2024). [2] lodrick-the-lafted/Sao10K_Claude-3-Opus-Instruct-9.5K-ShareGPT

Reviewer yZjY2024-08-13

I'm glad for your comprehensive clarification. I'm curious about what you mentioned regarding space constraints in weakness 2, as I recall that the appendix isn't page-limited. Besides, I agree with the reviewer bnRm's weakness 1 about training on different domains. I will keep my score.

Authorsrebuttal2024-08-13

Response to Reviewer yZjY

Dear Reviewer yZjY, Thank you very much for your advice on our work, which greatly enhances the solidity of our work. We will add all related experimental results to our main text in the next version. Regarding your concern about our assumption and experimental results, as we discussed in the main text, the training data generated by GPT-4 is from WildChat[1], which is a high-quality dataset. However, WildChat does not include the data generated from Claude3. In order to save money, we didn't call Claude3 API to generate training data. The data of Claude3 was collected from the public output in Huggingface without a quality guarantee[2]. Therefore, the performance of the model trained by data generated from Claude is relatively worse than that trained by data generated from GPT-4. For a fair comparison, we sampled 5k prompts from wildchat and called Claude API to generate the training dataset. Then, we utilize the generated dataset to fine-tune the surrogate model and provide the results here(we will also include this in the next version): | | PubMed | Xsum | Writing | |---------------------|--------|--------|---------| | DALD(GPT-4 data) | 0.9875 | 0.9993 | 0.9977 | | DALD(Claude-3 data) | 0.9942 | 0.9994 | 0.9993 | The results show that the model trained by data generated from Claude3 is better than the one trained by data from GPT-4, demonstrating the correctness of our assumption and the consistency of experimental results. [1] Zhao, Wenting, et al. "Wildchat: 1m chatGPT interaction logs in the wild." arXiv preprint arXiv:2405.01470 (2024). [2] lodrick-the-lafted/Sao10K_Claude-3-Opus-Instruct-9.5K-ShareGPT

Authorsrebuttal2024-08-13

Reply to Reviewer iaeF

Dear Reviewer iaeF, This is a kind reminder. We wanted to kindly follow up on the rebuttal discussion regarding. We highly value your insights and would greatly appreciate your response at your earliest convenience. Please let me know if there is any additional information you require or if there are any concerns we can address. Thank you for your time and consideration. Authors

Program Chairsdecision2024-09-25

Decision

Accept (poster)

© 2026 NYSGPT2525 LLC