Paraphrasing evades detectors of AI-generated text, but retrieval is an effective defense

Contributions

• Vulnerability assessment: Comprehensive evaluation showing that paraphrasing attacks evade multiple AI-text detectors across three language models (GPT2-XL, OPT-13B, Text-Davinci-003).
• DIPPER paraphraser: An 11B-parameter fine-tuned T5-XXL model that paraphrases paragraphs while controlling lexical diversity, content reordering, and maintaining surrounding context. Uses discourse-aligned parallel data from French novel translations.
• Semantic preservation validation: Automatic and human evaluations confirm that DIPPER paraphrases preserve meaning (~81% rated nearly or approximately equivalent by human annotators); demonstrates superiority over simpler paraphrasing baselines.
• Retrieval-based defense: Proposes using semantic search over a database of previously generated LLM outputs. Achieves 97.3% detection of PG19 paraphrases and 80.4% of Wikipedia paraphrases at 1% false-positive rate on human text.
• Scalability analysis: Shows retrieval detection remains effective with 15M cached generations, with only 0.8% accuracy drop scaling from 1M to 10M database entries. Discusses infrastructure and privacy implications for deploying retrieval at scale.

Method

DIPPER construction:

1. Fine-tune T5-XXL (11B parameters) on parallel paraphrase data (English translations of French novels with multiple translators providing alternative paraphrases).
2. Enforce discourse-aware paraphrasing by aligning sentences between translations using semantic similarity, then shuffling aligned sentence pairs to create controllable paraphrase variations.
3. Introduce control codes at inference time: - Lexical diversity (L): Control 20, 40, 60, or 100 to vary word-level changes. - Order diversity (O): Control 0–100 via Kendall-Tau correlation to reorder sentences while preserving coherence.
4. Map control codes to context-preserving constraints: The model conditions on surrounding paragraphs (outside the target paragraph) to maintain discourse coherence while paraphrasing the target.

Retrieval-based defense:

1. Build a database of previously generated completions from an LLM API provider (e.g., ChatGPT). For a candidate text, search this database for semantically similar generations using P-SP (pretrained semantic similarity model).
2. Use BM25 and semantic search combinations; primary experiments use dense retrieval with semantic encoders.
3. Threshold decision at retrieval score; 100% accuracy on unperturbed API-generated text.

Results

Attack success (DIPPER on existing detectors):

• Watermark detector: 100% → 97.1% detection accuracy (after DIPPER paraphrasing)
• DetectGPT: 70.3% → 4.6% detection accuracy (70% absolute drop)
• OpenAI classifier: 21.6% → 19.2% detection accuracy
• GPTZero, RankGen: substantial drops across multiple LMs

Semantic preservation:

• P-SP score (semantic similarity metric): 0.76 average, indicating near-semantic equivalence
• Human evaluation: 81.1% of DIPPER paraphrases rated as "approximately equivalent" or better
• Ablations confirm contextual paraphrasing (L60, O60) produces higher-quality paraphrases than single-sentence paraphrasing

Retrieval defense performance:

• Detects 97.3% of PG19 paraphrased generations and 80.4% of Wikipedia paraphrases at 1% false-positive rate (FPR) on human-written text.
• Achieves near 100% accuracy on unparaphrased API-generated text.
• Scales linearly: only 0.8% accuracy drop when database grows from 1M to 10M entries.

Notes

Strengths:

• Comprehensive empirical evaluation across multiple detectors and LMs, including watermark-based (previously thought robust) and statistical approaches.
• Practical paraphraser (DIPPER) with fine-grained controllability; semantic preservation validated at scale via human annotation.
• Proposes a concrete, theoretically motivated defense (retrieval) with detailed scalability analysis and privacy discussion.
• Opens code and data, facilitating reproducibility and follow-up research.

Limitations:

• Retrieval defense requires API provider cooperation and scales with database size; privacy concerns about stored generation history.
• Paraphrasing quality varies with control codes; aggressive reordering (high O) can degrade coherence in some cases.
• Defense assumes API access and knowledge of when text was generated (timestamp filtering). Closed-source LLMs may resist deployment.
• Does not address very short text or constrained-output tasks (e.g., multiple-choice, sentence classification), where paraphrasing options are limited.

Open questions:

• Can detectors be trained on adversarial (paraphrased) examples to achieve robustness?
• How do watermarking and retrieval defense interact when combined?
• What are the privacy and regulatory implications of maintaining large corpora of LLM generations for retrieval-based detection?