MD-ProTector: Positioning Multiple Data-Driven Prototypes for LLM-Generated Text Detection

# MD-ProTector: Positioning Multiple Data-Driven Prototypes for LLM-Generated Text Detection
Source: [https://arxiv.org/html/2608.10459](https://arxiv.org/html/2608.10459)
Jinmo Han Jimin Hong Chanyeong Moon Ju Yeon Kang Seonuk Kim Nam Soo Kim Department of Electrical and Computer Engineering and INMC Seoul National University, Seoul, Republic of Korea \{jinmo, jimin, chanyeong\}@hi\.snu\.ac\.kr \{juyeon, seonuk\}@hi\.snu\.ac\.krnkim@snu\.ac\.kr

###### Abstract

As LLM\-generated content becomes more sophisticated, detection systems for distinguishing those texts from human\-written text must operate at scale while handling diverse writing styles, domains, languages, and generator models\. Input\-only encoder detectors are suitable for practical deployment setting, but standard binary classification supplies only the class label and does not explicitly organize the substantial variation within either class\. We proposeMD\-ProTector, which represents each class with multiple trainable reference vectors in the encoder embedding space, referred to as prototypes\. These prototypes provide separate decision boundaries for different groups of texts within the same class\. However, adding multiple prototypes alone does not determine which variation each prototype should represent\. MD\-ProTector addresses this problem with Prototype Positioning loss, which separates class\-level structure from the within\-class variation that differentiates individual prototypes\. Evaluated across five settings from three large\-scale benchmarks covering domain, generator, language, and adversarial variation, MD\-ProTector achieves the highest AvgRec on MAGE CDCM and RAID and the highest AUROC and lowest FPR95 on RAID among the compared encoder\-based methods\.

MD\-ProTector: Positioning Multiple Data\-Driven Prototypes for LLM\-Generated Text Detection

Jinmo Han Jimin Hong Chanyeong MoonJu Yeon Kang Seonuk Kim Nam Soo KimDepartment of Electrical and Computer Engineering and INMCSeoul National University, Seoul, Republic of Korea\{jinmo, jimin, chanyeong\}@hi\.snu\.ac\.kr\{juyeon, seonuk\}@hi\.snu\.ac\.krnkim@snu\.ac\.kr

## 1Introduction

As large language models have become increasingly sophisticated and widely accessible, detecting whether text is human\-written or LLM\-generated has become essential for ensuring credibility in digital communication\(Kwon and Jang,[2025](https://arxiv.org/html/2608.10459#bib.bib24)\)\. This is particularly important for blocking automated fake news and phishing attacks, as well as maintaining academic integrity\(Najjaret al\.,[2025](https://arxiv.org/html/2608.10459#bib.bib33)\)\. In large\-scale deployment scenarios, detection systems must be applied to massive volumes of content that span diverse writing styles, domains, and generator models\(Liet al\.,[2024](https://arxiv.org/html/2608.10459#bib.bib25)\)\. Treating such diversity is important for practical detection systems operating in real\-world cases including various domain, writing style, generator, and adversarial editing cases\(Wuet al\.,[2024](https://arxiv.org/html/2608.10459#bib.bib45)\)\.

![Refer to caption](https://arxiv.org/html/2608.10459v1/figures/Inference.png)Figure 1:Prototype\-Based Inference\.Given an input textxx, MD\-ProTector encodes it into a normalized embeddingzzand compares it with the machine and human prototype banks\. The detection score isS​\(z\)=s1​\(z\)−s0​\(z\)S\(z\)=s\_\{1\}\(z\)\-s\_\{0\}\(z\), wheres0​\(z\)s\_\{0\}\(z\)ands1​\(z\)s\_\{1\}\(z\)are the maximum similarities to the machine and human prototypes, respectively\.In these practical deployment settings, watermarks or model\-internal scores such as log\-likelihoods are not guaranteed to be available\(Christet al\.,[2024](https://arxiv.org/html/2608.10459#bib.bib6); Mitchellet al\.,[2023](https://arxiv.org/html/2608.10459#bib.bib32)\)\. Under these conditions, detectors based on lightweight text encoders provide a practical solution\. They operate directly on the input text without requiring access to the generation pipeline or model internals\(Kuznetsovet al\.,[2024](https://arxiv.org/html/2608.10459#bib.bib23)\)\. This also allows one encoder pipeline to be adapted across target domains without access to the generator internals\(Rodriguezet al\.,[2022](https://arxiv.org/html/2608.10459#bib.bib35)\)\.

One of the simplest designs for encoder\-based detectors is to attach a binary classification head and train it using a cross\-entropy loss\(Ippolitoet al\.,[2020](https://arxiv.org/html/2608.10459#bib.bib20)\)\. Despite such intra\-class diversity in writing style and domain, all texts are reduced to two categories during training under this design\. The standard binary classification objective is a coarse supervision signal that does not explicitly consider such intra\-class diversity\(Cuiet al\.,[2016](https://arxiv.org/html/2608.10459#bib.bib7)\)\. Several prior works have attempted to move beyond standard binary classification formulations by adding structural constraints, but still overlook intra\-class diversity within at least one of the two classes, which can limit detection performance\(Guoet al\.,[2024b](https://arxiv.org/html/2608.10459#bib.bib15); Zenget al\.,[2025](https://arxiv.org/html/2608.10459#bib.bib49)\)\. This observation motivates detectors that represent both human\-written and LLM\-generated texts with multiple local representatives rather than a single global class representation\.

A natural extension is to represent each class with multiple trainable reference vectors in the embedding space, which we call prototypes\. However, the number of prototypes alone does not determine which pattern of within\-class variation each prototype should represent\. Without a prototype\-specific objective, different prototypes may remain redundant or capture overlapping patterns\.

We therefore proposeMD\-ProTector, an input\-only encoder detector that learns data\-driven positions for separate human and machine prototypes\. MD\-ProTector separates the direction shared within each class from the variation that distinguishes groups of samples within that class\. Prototype Positioning loss uses this variation to give different prototypes distinct roles, while complementary objectives keep each prototype aligned with the corresponding human or machine class\. The learned prototype banks then directly define the human–machine detection score shown in Figure[1](https://arxiv.org/html/2608.10459#S1.F1)\.

We evaluate MD\-ProTector under mixed domain and generator conditions, adversarial perturbations, multilingual generalization, held\-out domains and held\-out generator models\. Among input\-only encoder detectors trained under the same data, backbone, and validation protocol, MD\-ProTector ranks within the top two in AvgRec across all five settings\. It achieves the highest AvgRec on MAGE CDCM and RAID, together with the highest AUROC and lowest FPR95 on RAID, while DeTeCtive remains stronger on M4\. Ablation studies show Prototype Positioning performs beter than other prototype multiplicity methods such as direct prototype repulsion and positioning before removal of the class\-shared direction\.

Our contributions are as follows:

- •We develop an input\-only LLM\-generated text detector in which separate human and machine prototype banks directly define the detection score\.
- •We introduce the Prototype Positioning loss to place each prototype to capture within\-class variation in data\-driven manner\.
- •We evaluate MD\-ProTector across five controlled input\-only encoder settings, where it leads AvgRec on MAGE and RAID and attains the highest AUROC and lowest FPR95 on RAID\.

## 2Related Works

### 2\.1LLM\-Generated Text Detection

Prior work on LLM\-generated text detection includes watermarking, zero\-shot statistical methods, and supervised classifiers, depending on model access and the types of detection signals used\(Wuet al\.,[2025a](https://arxiv.org/html/2608.10459#bib.bib44)\)\. Watermarking injects identifiable patterns during generation, enabling content source verification by model providers\(Kirchenbaueret al\.,[2023](https://arxiv.org/html/2608.10459#bib.bib34)\)\. Zero\-shot statistical detectors, such as GLTR, DetectGPT, Fast\-DetectGPT, and Binoculars, use token probabilities, probability curvature, or cross\-model likelihood ratios without task\-specific training\(Gehrmannet al\.,[2019](https://arxiv.org/html/2608.10459#bib.bib13); Mitchellet al\.,[2023](https://arxiv.org/html/2608.10459#bib.bib32); Baoet al\.,[2024](https://arxiv.org/html/2608.10459#bib.bib3); Hanset al\.,[2024](https://arxiv.org/html/2608.10459#bib.bib16)\)\. BISCOPE, ImBD, DetectAnyLLM, and PAWN further refine model\-based scoring through memorization, style\-aligned discrepancy, task\-oriented discrepancy learning, or learned token weighting\(Guoet al\.,[2024a](https://arxiv.org/html/2608.10459#bib.bib14); Chenet al\.,[2025](https://arxiv.org/html/2608.10459#bib.bib5); Fuet al\.,[2025](https://arxiv.org/html/2608.10459#bib.bib11); Miralles\-Gonzálezet al\.,[2026](https://arxiv.org/html/2608.10459#bib.bib31)\)\. Rewrite\-based methods instead use the amount or pattern of changes produced by an auxiliary LLM\(Maoet al\.,[2024](https://arxiv.org/html/2608.10459#bib.bib29); Haoet al\.,[2025](https://arxiv.org/html/2608.10459#bib.bib17)\)\. These methods can provide strong detection signals, but require access to scoring language models, auxiliary generation calls, or cooperation from the generator\.

As a practical alternative in large\-scale deployment scenarios, supervised detectors can operate directly on input text and are suitable for in\-the\-wild deployment\(Bakhtinet al\.,[2019](https://arxiv.org/html/2608.10459#bib.bib2); Uchenduet al\.,[2020](https://arxiv.org/html/2608.10459#bib.bib37); Wanget al\.,[2023](https://arxiv.org/html/2608.10459#bib.bib39)\)\. These detectors typically rely on encoder architectures such as BERT\(Devlinet al\.,[2019](https://arxiv.org/html/2608.10459#bib.bib8)\)or RoBERTa\(Liuet al\.,[2019](https://arxiv.org/html/2608.10459#bib.bib27)\)\. Ghostbuster builds a classifier from features extracted by several weaker language models, RADAR improves paraphrase robustness through adversarial training, and MoSEs models stylistic references with input\-dependent threshold estimation\(Vermaet al\.,[2024](https://arxiv.org/html/2608.10459#bib.bib38); Huet al\.,[2023](https://arxiv.org/html/2608.10459#bib.bib19); Wuet al\.,[2025b](https://arxiv.org/html/2608.10459#bib.bib46)\)\. Despite their efficiency, supervised detectors can still degrade when the domain or generator distribution changes\(Bakhtinet al\.,[2019](https://arxiv.org/html/2608.10459#bib.bib2); Liet al\.,[2024](https://arxiv.org/html/2608.10459#bib.bib25); Wuet al\.,[2024](https://arxiv.org/html/2608.10459#bib.bib45)\)\.

Recent work therefore imposes stronger structure on the representation space\. DeTeCtive organizes text instances through author\- and style\-aware contrastive supervision and performs KNN inference\(Guoet al\.,[2024b](https://arxiv.org/html/2608.10459#bib.bib15)\)\. DSVDD takes a one\-class approach, compacting machine\-generated embeddings and treating human\-written text as out\-of\-distribution\(Zenget al\.,[2025](https://arxiv.org/html/2608.10459#bib.bib49)\)\. SAMP represents both classes with multiple prototypes using source\-model supervision\(Xuet al\.,[2026](https://arxiv.org/html/2608.10459#bib.bib48)\)\. While these methods introduce instance\-level structure, one\-class compactness, or source\-aware prototypes, binary supervision alone does not specify how internal variation should form distinct training targets for multiple human and machine prototypes\. MD\-ProTector addresses this gap by constructing a separate positioning target for each prototype from the hub\-removed residuals of its associated samples\.

### 2\.2Prototype\-Based Representation Learning

Prototype\-based methods represent each class by one or more representative points in an embedding space and classify inputs based on their similarity to these prototypes\. A canonical example is Prototypical Networks, which compute class prototypes as the mean embeddings of support examples and classify queries by distance in a metric\-learning framework\(Snellet al\.,[2017](https://arxiv.org/html/2608.10459#bib.bib36)\)\. ProtoFewRoBERTa applies this episodic formulation to few\-shot detection of AI\-generated reviews, while ProtoryNet learns sentence\-level reference patterns and classifies documents from their prototype trajectories\(Agrahariet al\.,[2025](https://arxiv.org/html/2608.10459#bib.bib1); Honget al\.,[2023](https://arxiv.org/html/2608.10459#bib.bib18)\)\. These methods establish prototypes as data\-driven class summaries or interpretable reference patterns\.

Prototype\-based representations have also been applied beyond standard classification\. Prototypical Contrastive Learning estimates prototypes as latent cluster variables for representation learning\(Liet al\.,[2021](https://arxiv.org/html/2608.10459#bib.bib26)\)\. OOD methods use class prototypes, diversified prototypes, or mixtures of prototypes to represent the known data distribution and score unfamiliar inputs\(Chenet al\.,[2024](https://arxiv.org/html/2608.10459#bib.bib4); Jiaet al\.,[2025](https://arxiv.org/html/2608.10459#bib.bib21); Luet al\.,[2024](https://arxiv.org/html/2608.10459#bib.bib28)\)\. Multiple normal prototypes have similarly been used in anomaly detection, and multi\-prototype modeling has been applied to open\-set noisy\-label learning\(Donget al\.,[2024](https://arxiv.org/html/2608.10459#bib.bib9); Zhanget al\.,[2025](https://arxiv.org/html/2608.10459#bib.bib50)\)\.

Prior multi\-prototype methods learn prototypes from full sample embeddings or through assignment and separation objectives, leaving the respective roles of the class\-shared direction and the variation that differentiates individual prototypes underdetermined\. Without this distinction, the learning objective does not specify which component should preserve the class decision and which component should organize multiple representatives within the class\. MD\-ProTector resolves this ambiguity by preserving the shared direction through the class hub and using assignment\-weighted, hub\-orthogonal residuals to position each prototype\.

## 3Proposed Method

![Refer to caption](https://arxiv.org/html/2608.10459v1/figures/TrainingLoss.png)Figure 2:Overview of the training objectives\. Circles denote class hubs, stars denote learnable prototypes, dots denote sample embeddings, and diamonds denote assignment\-weighted aggregates of sample residuals\. Prototype\-to\-Class aligns prototypes with their class hubs\. Sample\-to\-Prototype associates samples with the prototype bank of their ground\-truth class\. Prototype Positioning aligns the residual vector of each prototype with the aggregate constructed for that prototype after removing the class\-hub direction\. In panel \(c\),pc,s⟂p\_\{c,s\}^\{\\perp\}denotes the residual vector of another prototype withs≠rs\\neq r\.MD\-ProTector jointly learns an encoder and separate prototype banks for human\-written and LLM\-generated text\. Prototype Positioning organizes each prototype according to the residual variation of its associated samples, while Prototype\-to\-Class and Sample\-to\-Prototype preserve class alignment and sample association\. The learned prototype banks are used directly for detection\.

### 3\.1Problem Formulation and Encoder

Given an input textxix\_\{i\}, each sample has a binary labelyi∈\{0,1\}y\_\{i\}\\in\\\{0,1\\\}, whereyi=0y\_\{i\}=0denotes LLM\-generated text andyi=1y\_\{i\}=1denotes human\-written text\. A lightweight encoderfθf\_\{\\theta\}maps the input into token\-level representations, which are mean\-pooled and normalized as

zi=norm​\(fθ​\(xi\)\),z\_\{i\}=\\mathrm\{norm\}\\left\(f\_\{\\theta\}\(x\_\{i\}\)\\right\),\(1\)wherenorm​\(v\)=v/∥v∥2\\mathrm\{norm\}\(v\)=v/\\lVert v\\rVert\_\{2\}denotesℓ2\\ell\_\{2\}normalization\.

For a mini\-batchBBin which both classes are represented, letBc=\{i∈B:yi=c\}B\_\{c\}=\\\{i\\in B:y\_\{i\}=c\\\}\. The class hub is

hc=norm​\(1\|Bc\|​∑i∈Bczi\)\.h\_\{c\}=\\mathrm\{norm\}\\left\(\\frac\{1\}\{\|B\_\{c\}\|\}\\sum\_\{i\\in B\_\{c\}\}z\_\{i\}\\right\)\.\(2\)It represents the direction shared by class\-ccsamples in the current mini\-batch\.

For each classc∈\{0,1\}c\\in\\\{0,1\\\}, we maintainRRlearnable prototypes:

𝒫c=\{pc,1,…,pc,R\},∥pc,r∥2=1\.\\mathcal\{P\}\_\{c\}=\\\{p\_\{c,1\},\\ldots,p\_\{c,R\}\\\},\\qquad\\lVert p\_\{c,r\}\\rVert\_\{2\}=1\.\(3\)The full prototype bank is𝒫=𝒫0∪𝒫1\\mathcal\{P\}=\\mathcal\{P\}\_\{0\}\\cup\\mathcal\{P\}\_\{1\}\. The objectives below preserve class\-level alignment while allowing different groups of same\-class samples to orient the residual component of each prototype\.

### 3\.2Data\-Driven Prototype Initialization

Before training, we extract embeddings from the training set and apply K\-Means separately within each class\(MacQueen,[1967](https://arxiv.org/html/2608.10459#bib.bib30)\)\. The resulting centroids initialize𝒫c\(0\)=\{pc,r\(0\)\}r=1R\\mathcal\{P\}\_\{c\}^\{\(0\)\}=\\\{p\_\{c,r\}^\{\(0\)\}\\\}\_\{r=1\}^\{R\}\. The centroids are normalized and subsequently optimized as learnable parameters together with the encoder\. This initialization places the prototype banks in the observed class distributions rather than at random directions\.

### 3\.3Training Objectives

For compact notation, define

ϕ​\(u,v\)=exp⁡\(u⊤​v/τ\),\\phi\(u,v\)=\\exp\\\!\\left\(u^\{\\top\}v/\\tau\\right\),\(4\)whereτ\\tauis a temperature parameter\.

#### Prototype\-to\-Class Loss\.

The first objective aligns each prototype with the hub of its own class:

ℒP2C=−12​R​∑c=01∑r=1Rlog⁡ϕ​\(pc,r,hc\)∑d=01ϕ​\(pc,r,hd\)\.\\mathcal\{L\}\_\{\\mathrm\{P2C\}\}=\-\\frac\{1\}\{2R\}\\sum\_\{c=0\}^\{1\}\\sum\_\{r=1\}^\{R\}\\log\\frac\{\\phi\(p\_\{c,r\},h\_\{c\}\)\}\{\\sum\_\{d=0\}^\{1\}\\phi\(p\_\{c,r\},h\_\{d\}\)\}\.\(5\)This objective preserves the class\-level orientation of each prototype bank\.

#### Sample\-to\-Prototype Loss\.

We compute a soft assignment over the prototypes of the ground\-truth class:

qi,r=ϕ​\(zi,pyi,r\)∑k=1Rϕ​\(zi,pyi,k\)\.q\_\{i,r\}=\\frac\{\\phi\(z\_\{i\},p\_\{y\_\{i\},r\}\)\}\{\\sum\_\{k=1\}^\{R\}\\phi\(z\_\{i\},p\_\{y\_\{i\},k\}\)\}\.\(6\)The assignment is treated as a stop\-gradient target in the Sample\-to\-Prototype loss:

ℒS2P\\displaystyle\\mathcal\{L\}\_\{\\mathrm\{S2P\}\}=−1\|B\|​∑i∈B∑r=1Rsg​\(qi,r\)\\displaystyle=\-\\frac\{1\}\{\|B\|\}\\sum\_\{i\\in B\}\\sum\_\{r=1\}^\{R\}\\mathrm\{sg\}\(q\_\{i,r\}\)\(7\)⋅log⁡ϕ​\(zi,pyi,r\)∑p∈𝒫ϕ​\(zi,p\)\.\\displaystyle\\quad\\cdot\\log\\frac\{\\phi\(z\_\{i\},p\_\{y\_\{i\},r\}\)\}\{\\sum\_\{p\\in\\mathcal\{P\}\}\\phi\(z\_\{i\},p\)\}\.Here,sg​\(⋅\)\\mathrm\{sg\}\(\\cdot\)denotes the stop\-gradient operator\. This objective associates each sample with its ground\-truth prototype bank while separating it from the opposite\-class bank\.

#### Prototype Positioning Loss\.

Sample\-to\-Prototype associates samples with prototypes but does not provide a prototype\-specific target for within\-class variation\. We therefore remove the class\-hub component from the samples and prototypes:

zi⟂=zi−\(zi⊤​hyi\)​hyi,z\_\{i\}^\{\\perp\}=z\_\{i\}\-\(z\_\{i\}^\{\\top\}h\_\{y\_\{i\}\}\)h\_\{y\_\{i\}\},\(8\)pc,r⟂=norm​\(pc,r−\(pc,r⊤​hc\)​hc\)\.p\_\{c,r\}^\{\\perp\}=\\mathrm\{norm\}\\left\(p\_\{c,r\}\-\(p\_\{c,r\}^\{\\top\}h\_\{c\}\)h\_\{c\}\\right\)\.\(9\)Here,pc,r⟂p\_\{c,r\}^\{\\perp\}is the normalized residual vector of prototypepc,rp\_\{c,r\}after removing its class\-hub component\.

Using the assignments in Equation[6](https://arxiv.org/html/2608.10459#S3.E6), we construct a residual aggregate for each prototype:

gc,r⟂=∑i∈Bcqi,r​zi⟂,z¯c,r⟂=norm​\(gc,r⟂\)\.g\_\{c,r\}^\{\\perp\}=\\sum\_\{i\\in B\_\{c\}\}q\_\{i,r\}z\_\{i\}^\{\\perp\},\\qquad\\bar\{z\}\_\{c,r\}^\{\\perp\}=\\mathrm\{norm\}\\left\(g\_\{c,r\}^\{\\perp\}\\right\)\.\(10\)The vectorz¯c,r⟂\\bar\{z\}\_\{c,r\}^\{\\perp\}summarizes the residual variation of class\-ccsamples associated with prototypepc,rp\_\{c,r\}\.

Let𝒫⟂=\{pd,k⟂\}d,k\\mathcal\{P\}^\{\\perp\}=\\\{p\_\{d,k\}^\{\\perp\}\\\}\_\{d,k\}denote the set of prototype residual vectors\. The Prototype Positioning loss is

ℒPP=−12​R​∑c=01∑r=1Rlog⁡ϕ​\(z¯c,r⟂,pc,r⟂\)∑p⟂∈𝒫⟂ϕ​\(z¯c,r⟂,p⟂\)\.\\mathcal\{L\}\_\{\\mathrm\{PP\}\}=\-\\frac\{1\}\{2R\}\\sum\_\{c=0\}^\{1\}\\sum\_\{r=1\}^\{R\}\\log\\frac\{\\phi\(\\bar\{z\}\_\{c,r\}^\{\\perp\},p\_\{c,r\}^\{\\perp\}\)\}\{\\sum\_\{p^\{\\perp\}\\in\\mathcal\{P\}^\{\\perp\}\}\\phi\(\\bar\{z\}\_\{c,r\}^\{\\perp\},p^\{\\perp\}\)\}\.\(11\)Equation[11](https://arxiv.org/html/2608.10459#S3.E11)is a softmax cross\-entropy over the prototype residual vectors, with a separate data\-derived target constructed for each prototype\. Residual vectors from both classes appear in the denominator and therefore compete in the shared embedding space\. Becausepc,r⟂p\_\{c,r\}^\{\\perp\}is normalized, Prototype Positioning controls the direction of the residual component\. Prototype\-to\-Class preserves class alignment, and Sample\-to\-Prototype connects the resulting prototype to same\-class samples\.

#### Final Training Objective\.

The final objective is

ℒtrain=ℒP2C\+ℒS2P\+ℒPP\.\\mathcal\{L\}\_\{\\mathrm\{train\}\}=\\mathcal\{L\}\_\{\\mathrm\{P2C\}\}\+\\mathcal\{L\}\_\{\\mathrm\{S2P\}\}\+\\mathcal\{L\}\_\{\\mathrm\{PP\}\}\.\(12\)We jointly optimize the encoder and prototype parameters and renormalize the prototypes after each update\.

### 3\.4Inference

Given an input textxx, we computez=norm​\(fθ​\(x\)\)z=\\mathrm\{norm\}\(f\_\{\\theta\}\(x\)\)and score each class by its most similar prototype:

sc​\(z\)=maxr∈\{1,…,R\}⁡z⊤​pc,r\.s\_\{c\}\(z\)=\\max\_\{r\\in\\\{1,\\ldots,R\\\}\}z^\{\\top\}p\_\{c,r\}\.\(13\)The detection score and prediction are

S​\(z\)=s1​\(z\)−s0​\(z\),y^=𝟏​\{S​\(z\)\>δ\}\.S\(z\)=s\_\{1\}\(z\)\-s\_\{0\}\(z\),\\qquad\\hat\{y\}=\\mathbf\{1\}\\\{S\(z\)\>\\delta\\\}\.\(14\)Appendix[B\.2](https://arxiv.org/html/2608.10459#A2.SS2)evaluates a weighted within\-class alternative using the same frozen model parameters\.

## 4Experiments

Table 1:Benchmark\-level evaluation results\. Each cell reports AvgRec with HumanRec/MachineRec in parentheses\. MAGE CDCM evaluates mixed domain and generator conditions, RAID evaluates adversarial and decoding robustness, and M4 evaluates language shift\. Bold and underline indicate the best and second\-best AvgRec within each setting, respectively\.Table 2:MAGE leave\-one\-out evaluation results\. Each cell reports AvgRec with HumanRec/MachineRec in parentheses\. MAGE Unseen Domains and MAGE Unseen Models report averages over 10 independently trained leave\-one\-out\-domain scenarios and 7 independently trained leave\-one\-generator\-family\-out scenarios, respectively\. Bold and underline indicate the best and second\-best AvgRec within each setting\.### 4\.1Experimental Setup

#### Evaluation Settings\.

We evaluate MD\-ProTector on MAGE, RAID, and M4, which cover distinct deployment scenarios\. MAGE is used to evaluate domain and generator generalization: MAGE Cross\-Domain Cross\-Model \(MAGE CDCM\) tests mixed domain/generator conditions, while MAGE Unseen Domains and MAGE Unseen Models test leave\-one\-out domain and leave\-one\-out generator\-family generalization\(Liet al\.,[2024](https://arxiv.org/html/2608.10459#bib.bib25)\)\. M4 evaluates multilingual and unseen\-language generalization\(Wanget al\.,[2024](https://arxiv.org/html/2608.10459#bib.bib42)\)\. RAID evaluates robustness to adversarial attacks and decoding\-related variations\(Duganet al\.,[2024](https://arxiv.org/html/2608.10459#bib.bib10)\)\. Each MAGE leave\-one\-out scenario trains a separate detector, yielding 10 domain\-shift and 7 generator\-family\-shift evaluations\. Detailed dataset statistics and split construction are provided in Appendix[A](https://arxiv.org/html/2608.10459#A1)\.

#### Baselines\.

We compare input\-only encoder detectors under a common data and model\-access protocol\. Binary CE and SupCon provide standard classification and supervised contrastive references, while DeTeCtive and DSVDD introduce structured representation objectives through hierarchical contrastive learning with KNN inference and machine\-class compactness, respectively\(Guoet al\.,[2024b](https://arxiv.org/html/2608.10459#bib.bib15); Zenget al\.,[2025](https://arxiv.org/html/2608.10459#bib.bib49)\)\. All methods use the same data splits, encoder backbone, training budget, checkpoint selection, and validation\-based threshold selection\. The comparison isolates the detector formulation without access to model internals or auxiliary generation\.

#### Evaluation Metrics\.

Following MAGE\(Liet al\.,[2024](https://arxiv.org/html/2608.10459#bib.bib25)\), we use Average Recall \(AvgRec\), the mean of HumanRec and MachineRec, as the primary metric and report the values in the main tables\. AvgRec evaluates the two class recalls with equal weight at the fixed decision threshold, preventing high recall on one class from masking failure on the other\. We chooseδ\\deltaon the validation split to maximize AvgRec and keep it fixed on the test split\. Section[4\.2](https://arxiv.org/html/2608.10459#S4.SS2)discusses AUROC and FPR95, while complete F1, Accuracy, AUROC, AUPR, FPR95, and per\-scenario results are provided in Appendix[D](https://arxiv.org/html/2608.10459#A4)\.

#### Implementation Details\.

Unless otherwise specified, all encoder\-based methods use the same backbone encoder within each evaluation setting\. Pretrained encoder checkpoints are loaded from the HuggingFace model hub and used with the HuggingFace Transformers implementation\(Wolfet al\.,[2020](https://arxiv.org/html/2608.10459#bib.bib43)\)\. We use 125M Unsupervised SimCSE\-RoBERTa as the default encoder\(Gaoet al\.,[2021](https://arxiv.org/html/2608.10459#bib.bib12)\)\. All models are trained with a batch size of 256 using AdamW with a learning rate of2×10−52\\times 10^\{\-5\}\. Models are trained for 30 epochs with 2,000 warmup steps\. The checkpoint with the best AvgRec on the validation set is selected for evaluation\. For MD\-ProTector, the number of prototypes per class is set toR=8R=8\. All experiments are conducted on a single NVIDIA B200 GPU with mixed BF16 precision\.

Table 3:Ablation studies on the MAGE CDCM dataset\. All entries report AvgRec\. The default configuration uses the full objective,R=8R=8,τ=0\.15\\tau=0\.15, K\-Means initialization, and the unsupervised SimCSE\-RoBERTa encoder\. “PP w/o residual” denotes Prototype Positioning without removing the class hub direction\.

### 4\.2Evaluation Results

Tables[1](https://arxiv.org/html/2608.10459#S4.T1)and[2](https://arxiv.org/html/2608.10459#S4.T2)report AvgRec together with the recall for each class under the five evaluation settings\.

#### Mixed and Adversarial Conditions\.

MD\-ProTector obtains the highest AvgRec on both MAGE CDCM and RAID\. On MAGE CDCM, it reaches 95\.14 AvgRec with balanced recalls of 95\.81 for human and 94\.47 for machine text\. Its AUROC of 98\.41 and FPR95 of 4\.89 are also second\-best, indicating that the AvgRec gain is accompanied by strong score\-level separation under mixed domain and generator conditions\. On RAID, MD\-ProTector achieves the highest AvgRec \(88\.18\), HumanRec \(82\.52\), and AUROC \(95\.41\), together with the lowest FPR95 \(27\.78\)\.

#### Held\-Out Generator and Domain Shifts\.

Under unseen\-generator\-family evaluation, MD\-ProTector obtains the second\-highest AvgRec of 91\.34 and the lowest FPR95 of 11\.44\. Its HumanRec of 95\.63 is the highest among the evaluated methods, although MachineRec remains lower than that of DeTeCtive\. Under unseen\-domain evaluation, MD\-ProTector again ranks second in AvgRec at 78\.59, narrowly below DSVDD at 79\.08\. DSVDD retains stronger AUROC and FPR95 in this setting, showing that the prototype organization improves class\-balanced performance more consistently than score ordering under every type of domain shift\.

#### Language Shift\.

M4 remains the most challenging setting for MD\-ProTector\. It obtains the second\-highest AvgRec of 86\.03, improving HumanRec to 76\.87 compared with 54\.56 for Binary CE, 72\.37 for SupCon, and 63\.13 for DSVDD, while retaining 95\.20 MachineRec\. However, its AUROC and FPR95 remain below Binary CE and DSVDD\. The remaining error is therefore concentrated in representing human\-written text in unseen languages, rather than in detecting machine\-generated text\. Appendix[B\.2](https://arxiv.org/html/2608.10459#A2.SS2)reports that a weighted average of prototype similarities improves the frozen checkpoint AvgRec without retraining\. Across the five settings, MD\-ProTector ranks within the top two in AvgRec\.

### 4\.3Ablation Studies

Table[3](https://arxiv.org/html/2608.10459#S4.T3)examines Prototype Positioning together with the main configuration choices on MAGE CDCM\. The objective ablation retains Prototype\-to\-Class and Sample\-to\-Prototype and uses the same initialization, prototype count, and temperature across all variants\. RemovingℒPP\\mathcal\{L\}\_\{\\mathrm\{PP\}\}lowers AvgRec from 95\.14 to 94\.78\. Replacing Prototype Positioning with simple prototype repulsion yields 94\.55, while positioning prototypes without removing the class\-hub direction yields 94\.33\. These comparisons support the proposed formulation, in which each prototype is positioned using the residual variation of its associated samples\.

K\-Means initialization improves AvgRec from 94\.50 to 95\.14 relative to random initialization, indicating that the observed class distributions provide a useful starting point for optimization\. Increasing the number of prototypes fromR=1R=1toR=2R=2raises AvgRec from 94\.50 to 95\.03, and reaches its maximum atR=8R=8and declines with larger prototype banks\. Once multiple prototypes are available, their organization remains important rather than capacity itself\.

AvgRec remains between 94\.91 and 95\.14 forτ∈\[0\.07,0\.20\]\\tau\\in\[0\.07,0\.20\]and decreases to 93\.97 atτ=0\.50\\tau=0\.50\. Across encoder backbones, AvgRec ranges from 92\.86 to 95\.14, with unsupervised SimCSE\-RoBERTa obtaining the highest value\.

### 4\.4Prototype Analysis

![Refer to caption](https://arxiv.org/html/2608.10459v1/figures/tsne_deepfake_domain.png)

\(a\) Colored by domain

![Refer to caption](https://arxiv.org/html/2608.10459v1/figures/tsne_deepfake_model.png)

\(b\) Colored by generator model

Figure 3:Prototype visualization on the MAGE CDCM dataset\. Both panels show the same t\-SNE projection of normalized test embeddings and learned prototypes\. The left panel colors samples by domain, and the right panel colors samples by generator model\. Dots denote test samples\. Blue and red stars indicate human and machine prototypes, respectively\.\(a\) Machine prototypes

\(b\) Human prototypes

Table 4:Selected groups of texts assigned to prototypes\. Top domain and generator are the largest shares among assigned texts\. Writing\-cue percentages are the fractions containing each cue\. Complete summaries and cue definitions are provided in Appendix[C](https://arxiv.org/html/2608.10459#A3)\.Figure[3](https://arxiv.org/html/2608.10459#S4.F3)shows the learned prototypes distributed across multiple occupied regions of the human and machine embedding spaces\. All prototypes show their own test sample covers, showing that both banks retain multiple active representatives and avoid complete assignment collapse\.

We use M0–M7 and H0–H7 to identify the machine and human prototypes\. Table[4](https://arxiv.org/html/2608.10459#S4.T4)summarizes selected groups characterized by instructional, review, and academic writing cues\. The same cues appear in both classes and describe recurring patterns within each class\. The largest generator share among the machine prototypes is 24\.8%, indicating that each group includes texts from multiple generators\. These results show that the prototype banks organize distinct same\-class text groups across domain and generator boundaries\. Complete cue definitions and summaries for all prototypes are provided in Appendix[C](https://arxiv.org/html/2608.10459#A3)\.

## 5Conclusion

In this work, we introduced MD\-ProTector, an input\-only encoder detector that represents human\-written and LLM\-generated text with separate banks of trainable prototypes\. By separating class\-level alignment from prototype\-specific residual positioning, MD\-ProTector organizes multiple prototypes using the variation observed within each class while retaining direct prototype\-based inference\. Across five controlled settings, the method achieves the highest AvgRec on MAGE CDCM and RAID\. On RAID, it also attains the highest AUROC and lowest FPR95 among the compared methods\. Ablations on MAGE CDCM further show that residual positioning yields stronger performance than the single\-prototype, direct\-repulsion, and raw\-space positioning variants\. These results support data\-derived positioning as an effective mechanism for organizing multiple class prototypes for LLM\-generated text detection\.

## Limitations

This work assumes a fixed\-label binary detection setting in which each input is classified as either human\-written or LLM\-generated, and does not address more complex scenarios such as partial generation, human–machine co\-editing, or estimating degrees of machine involvement\. In addition, the number of prototypes per class is treated as an empirically fixed design choice\. Adaptive mechanisms for adjusting prototype cardinality based on data characteristics are not explored\. Finally, our experiments are conducted under fixed training, validation, and test splits\. In practical deployment, the distribution of generators, prompts, writing styles, and adversarial perturbations may change over time\. While MD\-ProTector initializes and optimizes prototypes from training data, continual prototype adaptation under temporal distribution drift remains future work\.

## Ethics Statement

The datasets utilized do not include private data or non\-public personally identifiable information\. The development of reliable text detection systems is crucial for maintaining trust in digital information\. However, we acknowledge that detection technologies can potentially be used in a dual\-use manner—adversaries might use our detector as a discriminator to train more sophisticated generators that evade detection\. Additionally, while we strove to use diverse datasets, the "Human" class in our training data is sourced from web texts \(e\.g\., Reddit, Wikipedia\), which may contain inherent biases\. Users should be cautious when deploying this model in sensitive contexts, as false positives could unfairly penalize human writers\.

## References

- Can you really trust that review? ProtoFewRoBERTa and DetectAIRev: a prototypical few\-shot method and multi\-domain benchmark for detecting AI\-generated reviews\.InProceedings of the 14th International Joint Conference on Natural Language Processing and the 4th Conference of the Asia\-Pacific Chapter of the Association for Computational Linguistics,Mumbai, India,pp\. 2118–2140\.External Links:[Document](https://dx.doi.org/10.18653/v1/2025.findings-ijcnlp.132),[Link](https://aclanthology.org/2025.findings-ijcnlp.132/)Cited by:[§2\.2](https://arxiv.org/html/2608.10459#S2.SS2.p1.1)\.
- A\. Bakhtin, S\. Gross, M\. Ott, Y\. Deng, M\. Ranzato, and A\. Szlam \(2019\)Real or fake? learning to discriminate machine from human generated text\.arXiv preprint arXiv:1906\.03351\.External Links:[Link](https://arxiv.org/abs/1906.03351)Cited by:[§2\.1](https://arxiv.org/html/2608.10459#S2.SS1.p2.1)\.
- G\. Bao, Y\. Zhao, Z\. Teng, L\. Yang, and Y\. Zhang \(2024\)Fast\-detectGPT: efficient zero\-shot detection of machine\-generated text via conditional probability curvature\.InInternational Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=Bpcgcr8E8Z)Cited by:[§2\.1](https://arxiv.org/html/2608.10459#S2.SS1.p1.1)\.
- J\. Chen, X\. Zhu, T\. Liu, Y\. Chen, X\. Chen, Y\. Yuan, C\. T\. Leong, Z\. Li, L\. Tang, L\. Zhang, C\. Yan, G\. Mei, J\. Zhang, and L\. Zhang \(2025\)Imitate before detect: aligning machine stylistic preference for machine\-revised text detection\.Proceedings of the AAAI Conference on Artificial Intelligence39\(22\),pp\. 23559–23567\.External Links:[Document](https://dx.doi.org/10.1609/aaai.v39i22.34525)Cited by:[§2\.1](https://arxiv.org/html/2608.10459#S2.SS1.p1.1)\.
- J\. Chen, J\. Mei, L\. Chen, F\. Zhao, Y\. Xing, and Y\. Hu \(2024\)Proto\-OOD: enhancing OOD object detection with prototype feature similarity\.arXiv preprint arXiv:2409\.05466\.External Links:[Link](https://doi.org/10.48550/arXiv.2409.05466)Cited by:[§2\.2](https://arxiv.org/html/2608.10459#S2.SS2.p2.1)\.
- M\. Christ, S\. Gunn, and O\. Zamir \(2024\)Undetectable watermarks for language models\.InProceedings of Thirty Seventh Conference on Learning Theory,Proceedings of Machine Learning Research, Vol\.247,pp\. 1125–1139\.External Links:[Link](https://proceedings.mlr.press/v247/christ24a.html)Cited by:[§1](https://arxiv.org/html/2608.10459#S1.p2.1)\.
- Y\. Cui, F\. Zhou, Y\. Lin, and S\. Belongie \(2016\)Fine\-grained categorization and dataset bootstrapping using deep metric learning with humans in the loop\.InIEEE Conference on Computer Vision and Pattern Recognition,Las Vegas, NV, USA,pp\. 1153–1162\.External Links:[Document](https://dx.doi.org/10.1109/CVPR.2016.130),[Link](https://doi.org/10.1109/CVPR.2016.130)Cited by:[§1](https://arxiv.org/html/2608.10459#S1.p3.1)\.
- J\. Devlin, M\. Chang, K\. Lee, and K\. Toutanova \(2019\)BERT: pre\-training of deep bidirectional transformers for language understanding\.InProceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 \(Long and Short Papers\),Minneapolis, Minnesota,pp\. 4171–4186\.External Links:[Document](https://dx.doi.org/10.18653/v1/N19-1423),[Link](https://aclanthology.org/N19-1423/)Cited by:[§B\.1](https://arxiv.org/html/2608.10459#A2.SS1.SSS0.Px3.p1.1),[§2\.1](https://arxiv.org/html/2608.10459#S2.SS1.p2.1)\.
- Z\. Dong, H\. Liu, B\. Ren, W\. Xiong, and Z\. Wu \(2024\)Reconstruction\-based multi\-normal prototypes learning for weakly supervised anomaly detection\.arXiv preprint arXiv:2408\.14498\.External Links:[Link](https://arxiv.org/abs/2408.14498)Cited by:[§2\.2](https://arxiv.org/html/2608.10459#S2.SS2.p2.1)\.
- L\. Dugan, A\. Hwang, F\. Trhlík, A\. Zhu, J\. M\. Ludan, H\. Xu, D\. Ippolito, and C\. Callison\-Burch \(2024\)RAID: a shared benchmark for robust evaluation of machine\-generated text detectors\.InProceedings of the 62nd Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\),Bangkok, Thailand,pp\. 12463–12492\.External Links:[Document](https://dx.doi.org/10.18653/v1/2024.acl-long.674),[Link](https://aclanthology.org/2024.acl-long.674/)Cited by:[Appendix A](https://arxiv.org/html/2608.10459#A1.SS0.SSS0.Px3.p1.1),[§4\.1](https://arxiv.org/html/2608.10459#S4.SS1.SSS0.Px1.p1.1)\.
- J\. Fu, C\. Guo, and C\. Li \(2025\)DetectAnyLLM: towards generalizable and robust detection of machine\-generated text across domains and models\.InProceedings of the 33rd ACM International Conference on Multimedia,pp\. 11229–11238\.External Links:[Document](https://dx.doi.org/10.1145/3746027.3754862)Cited by:[§2\.1](https://arxiv.org/html/2608.10459#S2.SS1.p1.1)\.
- T\. Gao, X\. Yao, and D\. Chen \(2021\)SimCSE: simple contrastive learning of sentence embeddings\.InProceedings of the 2021 Conference on Empirical Methods in Natural Language Processing,Online and Punta Cana, Dominican Republic,pp\. 6894–6910\.External Links:[Document](https://dx.doi.org/10.18653/v1/2021.emnlp-main.552),[Link](https://aclanthology.org/2021.emnlp-main.552/)Cited by:[§B\.1](https://arxiv.org/html/2608.10459#A2.SS1.SSS0.Px3.p1.1),[§4\.1](https://arxiv.org/html/2608.10459#S4.SS1.SSS0.Px4.p1.2)\.
- S\. Gehrmann, H\. Strobelt, and A\. Rush \(2019\)GLTR: statistical detection and visualization of generated text\.InProceedings of the 57th Annual Meeting of the Association for Computational Linguistics: System Demonstrations,Florence, Italy,pp\. 111–116\.External Links:[Document](https://dx.doi.org/10.18653/v1/P19-3019),[Link](https://aclanthology.org/P19-3019/)Cited by:[§2\.1](https://arxiv.org/html/2608.10459#S2.SS1.p1.1)\.
- H\. Guo, S\. Cheng, X\. Jin, Z\. Zhang, K\. Zhang, G\. Tao, G\. Shen, and X\. Zhang \(2024a\)BISCOPE: AI\-generated text detection by checking memorization of preceding tokens\.InAdvances in Neural Information Processing Systems,Vol\.37,pp\. 104065–104090\.External Links:[Document](https://dx.doi.org/10.52202/079017-3307),[Link](https://proceedings.neurips.cc/paper_files/paper/2024/hash/bc808cf2d2444b0abcceca366b771389-Abstract-Conference.html)Cited by:[§2\.1](https://arxiv.org/html/2608.10459#S2.SS1.p1.1)\.
- X\. Guo, S\. Zhang, Y\. He, T\. Zhang, W\. Feng, H\. Huang, and C\. Ma \(2024b\)DeTeCtive: detecting AI\-generated text via multi\-level contrastive learning\.InAdvances in Neural Information Processing Systems,Vol\.37,pp\. 88320–88347\.External Links:[Document](https://dx.doi.org/10.52202/079017-2802),[Link](https://proceedings.neurips.cc/paper_files/paper/2024/hash/a117a3cd54b7affad04618c77c2fb18b-Abstract-Conference.html)Cited by:[§1](https://arxiv.org/html/2608.10459#S1.p3.1),[§2\.1](https://arxiv.org/html/2608.10459#S2.SS1.p3.1),[§4\.1](https://arxiv.org/html/2608.10459#S4.SS1.SSS0.Px2.p1.1)\.
- A\. Hans, A\. Schwarzschild, V\. Cherepanova, H\. Kazemi, A\. Saha, M\. Goldblum, J\. Geiping, and T\. Goldstein \(2024\)Spotting LLMs with binoculars: zero\-shot detection of machine\-generated text\.InProceedings of the 41st International Conference on Machine Learning,Proceedings of Machine Learning Research, Vol\.235,pp\. 17519–17537\.External Links:[Link](https://proceedings.mlr.press/v235/hans24a.html)Cited by:[§2\.1](https://arxiv.org/html/2608.10459#S2.SS1.p1.1)\.
- W\. Hao, R\. Li, W\. Zhao, J\. Yang, and C\. Mao \(2025\)Learning to rewrite: generalized LLM\-generated text detection\.InProceedings of the 63rd Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\),Vienna, Austria,pp\. 6421–6434\.External Links:[Document](https://dx.doi.org/10.18653/v1/2025.acl-long.322),[Link](https://aclanthology.org/2025.acl-long.322/)Cited by:[§2\.1](https://arxiv.org/html/2608.10459#S2.SS1.p1.1)\.
- D\. Hong, T\. Wang, and S\. Baek \(2023\)ProtoryNet: interpretable text classification via prototype trajectories\.Journal of Machine Learning Research24\(264\),pp\. 1–39\.External Links:[Link](http://jmlr.org/papers/v24/21-0899.html)Cited by:[§2\.2](https://arxiv.org/html/2608.10459#S2.SS2.p1.1)\.
- X\. Hu, P\. Chen, and T\. Ho \(2023\)RADAR: robust AI\-text detection via adversarial learning\.InAdvances in Neural Information Processing Systems,Vol\.36\.External Links:[Link](https://proceedings.neurips.cc/paper_files/paper/2023/hash/30e15e5941ae0cdab7ef58cc8d59a4ca-Abstract-Conference.html)Cited by:[§2\.1](https://arxiv.org/html/2608.10459#S2.SS1.p2.1)\.
- D\. Ippolito, D\. Duckworth, C\. Callison\-Burch, and D\. Eck \(2020\)Automatic detection of generated text is easiest when humans are fooled\.InProceedings of the 58th Annual Meeting of the Association for Computational Linguistics,Online,pp\. 1808–1822\.External Links:[Document](https://dx.doi.org/10.18653/v1/2020.acl-main.164),[Link](https://aclanthology.org/2020.acl-main.164/)Cited by:[§1](https://arxiv.org/html/2608.10459#S1.p3.1)\.
- Y\. Jia, J\. Li, G\. Zhao, S\. Liu, W\. Sun, L\. Lin, and G\. Li \(2025\)Enhancing out\-of\-distribution detection via diversified multi\-prototype contrastive learning\.Pattern Recognition161,pp\. 111214\.External Links:[Document](https://dx.doi.org/10.1016/j.patcog.2024.111214)Cited by:[§2\.2](https://arxiv.org/html/2608.10459#S2.SS2.p2.1)\.
- J\. Kirchenbauer, J\. Geiping, Y\. Wen, J\. Katz, I\. Miers, and T\. Goldstein \(2023\)A watermark for large language models\.InProceedings of the 40th International Conference on Machine Learning,Proceedings of Machine Learning Research, Vol\.202,pp\. 17061–17084\.External Links:[Link](https://proceedings.mlr.press/v202/kirchenbauer23a.html)Cited by:[§2\.1](https://arxiv.org/html/2608.10459#S2.SS1.p1.1)\.
- K\. Kuznetsov, E\. Tulchinskii, L\. Kushnareva, G\. Magai, S\. Barannikov, S\. Nikolenko, and I\. Piontkovskaya \(2024\)Robust AI\-generated text detection by restricted embeddings\.InFindings of the Association for Computational Linguistics: EMNLP 2024,Miami, Florida, USA,pp\. 17036–17055\.External Links:[Document](https://dx.doi.org/10.18653/v1/2024.findings-emnlp.992),[Link](https://aclanthology.org/2024.findings-emnlp.992/)Cited by:[§1](https://arxiv.org/html/2608.10459#S1.p2.1)\.
- S\. Kwon and B\. Jang \(2025\)A comprehensive survey of fake text detection on misinformation and LM\-generated texts\.IEEE Access13,pp\. 25301–25324\.External Links:[Document](https://dx.doi.org/10.1109/ACCESS.2025.3538805)Cited by:[§1](https://arxiv.org/html/2608.10459#S1.p1.1)\.
- J\. Li, P\. Zhou, C\. Xiong, and S\. Hoi \(2021\)Prototypical contrastive learning of unsupervised representations\.InInternational Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=KmykpuSrjcq)Cited by:[§2\.2](https://arxiv.org/html/2608.10459#S2.SS2.p2.1)\.
- Y\. Li, Q\. Li, L\. Cui, W\. Bi, Z\. Wang, L\. Wang, L\. Yang, S\. Shi, and Y\. Zhang \(2024\)MAGE: machine\-generated text detection in the wild\.InProceedings of the 62nd Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\),Bangkok, Thailand,pp\. 36–53\.External Links:[Document](https://dx.doi.org/10.18653/v1/2024.acl-long.3),[Link](https://aclanthology.org/2024.acl-long.3/)Cited by:[Appendix A](https://arxiv.org/html/2608.10459#A1.SS0.SSS0.Px1.p1.1),[§1](https://arxiv.org/html/2608.10459#S1.p1.1),[§2\.1](https://arxiv.org/html/2608.10459#S2.SS1.p2.1),[§4\.1](https://arxiv.org/html/2608.10459#S4.SS1.SSS0.Px1.p1.1),[§4\.1](https://arxiv.org/html/2608.10459#S4.SS1.SSS0.Px3.p1.1)\.
- Y\. Liu, M\. Ott, N\. Goyal, J\. Du, M\. Joshi, D\. Chen, O\. Levy, M\. Lewis, L\. Zettlemoyer, and V\. Stoyanov \(2019\)RoBERTa: a robustly optimized BERT pretraining approach\.arXiv preprint arXiv:1907\.11692\.External Links:[Link](https://arxiv.org/abs/1907.11692)Cited by:[§B\.1](https://arxiv.org/html/2608.10459#A2.SS1.SSS0.Px3.p1.1),[§2\.1](https://arxiv.org/html/2608.10459#S2.SS1.p2.1)\.
- H\. Lu, D\. Gong, S\. Wang, J\. Xue, L\. Yao, and K\. Moore \(2024\)Learning with mixture of prototypes for out\-of\-distribution detection\.InInternational Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=uNkKaD3MCs)Cited by:[§2\.2](https://arxiv.org/html/2608.10459#S2.SS2.p2.1)\.
- J\. MacQueen \(1967\)Some methods for classification and analysis of multivariate observations\.InProceedings of the Fifth Berkeley Symposium on Mathematical Statistics and Probability,pp\. 281–297\.External Links:[Link](https://digicoll.lib.berkeley.edu/record/113015/files/math_s5_v1_article-17)Cited by:[§3\.2](https://arxiv.org/html/2608.10459#S3.SS2.p1.1)\.
- C\. Mao, C\. Vondrick, H\. Wang, and J\. Yang \(2024\)RAIDAR: generative AI detection via rewriting\.InInternational Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=bQWE2UqXmf)Cited by:[§2\.1](https://arxiv.org/html/2608.10459#S2.SS1.p1.1)\.
- P\. Miralles\-González, J\. Huertas\-Tato, A\. Martín, and D\. Camacho \(2026\)Not all tokens are created equal: perplexity attention weighted networks for AI\-generated text detection\.Information Fusion125,pp\. 103465\.External Links:[Document](https://dx.doi.org/10.1016/j.inffus.2025.103465)Cited by:[§2\.1](https://arxiv.org/html/2608.10459#S2.SS1.p1.1)\.
- E\. Mitchell, Y\. Lee, A\. Khazatsky, C\. D\. Manning, and C\. Finn \(2023\)DetectGPT: zero\-shot machine\-generated text detection using probability curvature\.InProceedings of the 40th International Conference on Machine Learning,Proceedings of Machine Learning Research, Vol\.202,pp\. 24950–24962\.External Links:[Link](https://proceedings.mlr.press/v202/mitchell23a.html)Cited by:[§1](https://arxiv.org/html/2608.10459#S1.p2.1),[§2\.1](https://arxiv.org/html/2608.10459#S2.SS1.p1.1)\.
- A\. A\. Najjar, H\. I\. Ashqar, O\. A\. Darwish, and E\. M\. Hammad \(2025\)Detecting ai\-generated text in educational content: leveraging machine learning and explainable AI for academic integrity\.arXiv preprint arXiv:2501\.03203\.External Links:[Link](https://arxiv.org/abs/2501.03203)Cited by:[§1](https://arxiv.org/html/2608.10459#S1.p1.1)\.
- J\. D\. Rodriguez, T\. Hay, D\. Gros, Z\. Shamsi, and R\. Srinivasan \(2022\)Cross\-domain detection of GPT\-2\-generated technical text\.InProceedings of the 2022 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies,Seattle, United States,pp\. 1213–1233\.External Links:[Document](https://dx.doi.org/10.18653/v1/2022.naacl-main.88),[Link](https://aclanthology.org/2022.naacl-main.88/)Cited by:[§1](https://arxiv.org/html/2608.10459#S1.p2.1)\.
- J\. Snell, K\. Swersky, and R\. Zemel \(2017\)Prototypical networks for few\-shot learning\.InAdvances in Neural Information Processing Systems,Vol\.30,pp\. 4077–4087\.External Links:[Link](https://proceedings.neurips.cc/paper_files/paper/2017/hash/cb8da6767461f2812ae4290eac7cbc42-Abstract.html)Cited by:[§2\.2](https://arxiv.org/html/2608.10459#S2.SS2.p1.1)\.
- A\. Uchendu, T\. Le, K\. Shu, and D\. Lee \(2020\)Authorship attribution for neural text generation\.InProceedings of the 2020 Conference on Empirical Methods in Natural Language Processing,Online,pp\. 8384–8395\.External Links:[Document](https://dx.doi.org/10.18653/v1/2020.emnlp-main.673),[Link](https://aclanthology.org/2020.emnlp-main.673/)Cited by:[§2\.1](https://arxiv.org/html/2608.10459#S2.SS1.p2.1)\.
- V\. Verma, E\. Fleisig, N\. Tomlin, and D\. Klein \(2024\)Ghostbuster: detecting text ghostwritten by large language models\.InProceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies \(Volume 1: Long Papers\),Mexico City, Mexico,pp\. 1702–1717\.External Links:[Document](https://dx.doi.org/10.18653/v1/2024.naacl-long.95),[Link](https://aclanthology.org/2024.naacl-long.95/)Cited by:[§2\.1](https://arxiv.org/html/2608.10459#S2.SS1.p2.1)\.
- L\. Wang, N\. Yang, X\. Huang, B\. Jiao, L\. Yang, D\. Jiang, R\. Majumder, and F\. Wei \(2022\)Text embeddings by weakly\-supervised contrastive pre\-training\.arXiv preprint arXiv:2212\.03533\.External Links:[Link](https://arxiv.org/abs/2212.03533)Cited by:[§B\.1](https://arxiv.org/html/2608.10459#A2.SS1.SSS0.Px3.p1.1)\.
- Y\. Wang, J\. Mansurov, P\. Ivanov, J\. Su, A\. Shelmanov, A\. Tsvigun, C\. Whitehouse, O\. Mohammed Afzal, T\. Mahmoud, T\. Sasaki, T\. Arnold, A\. F\. Aji, N\. Habash, I\. Gurevych, and P\. Nakov \(2024\)M4: multi\-generator, multi\-domain, and multilingual black\-box machine\-generated text detection\.InProceedings of the 18th Conference of the European Chapter of the Association for Computational Linguistics \(Volume 1: Long Papers\),St\. Julian’s, Malta,pp\. 1369–1407\.External Links:[Document](https://dx.doi.org/10.18653/v1/2024.eacl-long.83),[Link](https://aclanthology.org/2024.eacl-long.83/)Cited by:[Appendix A](https://arxiv.org/html/2608.10459#A1.SS0.SSS0.Px2.p1.1),[§4\.1](https://arxiv.org/html/2608.10459#S4.SS1.SSS0.Px1.p1.1)\.
- Z\. Wang, J\. Cheng, C\. Cui, and C\. Yu \(2023\)Implementing BERT and fine\-tuned RoBERTa to detect AI\-generated news by ChatGPT\.arXiv preprint arXiv:2306\.07401\.External Links:[Link](https://doi.org/10.48550/arXiv.2306.07401)Cited by:[§2\.1](https://arxiv.org/html/2608.10459#S2.SS1.p2.1)\.
- T\. Wolf, L\. Debut, V\. Sanh, J\. Chaumond, C\. Delangue, A\. Moi, P\. Cistac, T\. Rault, R\. Louf, M\. Funtowicz, J\. Davison, S\. Shleifer, P\. von Platen, C\. Ma, Y\. Jernite, J\. Plu, C\. Xu, T\. Le Scao, S\. Gugger, M\. Drame, Q\. Lhoest, and A\. Rush \(2020\)Transformers: state\-of\-the\-art natural language processing\.InProceedings of the 2020 Conference on Empirical Methods in Natural Language Processing: System Demonstrations,Online,pp\. 38–45\.External Links:[Document](https://dx.doi.org/10.18653/v1/2020.emnlp-demos.6),[Link](https://aclanthology.org/2020.emnlp-demos.6/)Cited by:[§4\.1](https://arxiv.org/html/2608.10459#S4.SS1.SSS0.Px4.p1.2)\.
- J\. Wu, S\. Yang, R\. Zhan, Y\. Yuan, L\. S\. Chao, and D\. F\. Wong \(2025a\)A survey on LLM\-generated text detection: necessity, methods, and future directions\.Computational Linguistics51\(1\),pp\. 275–338\.External Links:[Document](https://dx.doi.org/10.1162/coli%5Fa%5F00549),[Link](https://aclanthology.org/2025.cl-1.8/)Cited by:[§2\.1](https://arxiv.org/html/2608.10459#S2.SS1.p1.1)\.
- J\. Wu, R\. Zhan, D\. Wong, S\. Yang, X\. Yang, Y\. Yuan, and L\. Chao \(2024\)DetectRL: benchmarking LLM\-generated text detection in real\-world scenarios\.InAdvances in Neural Information Processing Systems,Vol\.37,pp\. 100369–100401\.External Links:[Document](https://dx.doi.org/10.52202/079017-3186),[Link](https://proceedings.neurips.cc/paper_files/paper/2024/hash/b61bdf7e9f64c04ec75a26e781e2ad51-Abstract-Datasets_and_Benchmarks_Track.html)Cited by:[§1](https://arxiv.org/html/2608.10459#S1.p1.1),[§2\.1](https://arxiv.org/html/2608.10459#S2.SS1.p2.1)\.
- J\. Wu, J\. Wang, Z\. Liu, B\. Chen, D\. Hu, H\. Wu, and S\. Xia \(2025b\)MoSEs: uncertainty\-aware AI\-generated text detection via mixture of stylistics experts with conditional thresholds\.InProceedings of the 2025 Conference on Empirical Methods in Natural Language Processing,Suzhou, China,pp\. 5786–5805\.External Links:[Document](https://dx.doi.org/10.18653/v1/2025.emnlp-main.294),[Link](https://aclanthology.org/2025.emnlp-main.294/)Cited by:[§2\.1](https://arxiv.org/html/2608.10459#S2.SS1.p2.1)\.
- S\. Xiao, Z\. Liu, P\. Zhang, N\. Muennighoff, D\. Lian, and J\. Nie \(2024\)C\-Pack: packed resources for general Chinese embeddings\.InProceedings of the 47th International ACM SIGIR Conference on Research and Development in Information Retrieval,Washington, DC, USA,pp\. 641–649\.External Links:[Document](https://dx.doi.org/10.1145/3626772.3657878)Cited by:[§B\.1](https://arxiv.org/html/2608.10459#A2.SS1.SSS0.Px3.p1.1)\.
- Y\. Xu, W\. Yang, Y\. Yin, H\. Lv, Z\. Wang, J\. He, X\. Jia, and X\. Wang \(2026\)SAMP: source\-aware multi\-prototype learning for machine\-generated text detection\.Research Square\.Note:PreprintExternal Links:[Document](https://dx.doi.org/10.21203/rs.3.rs-9598516/v1),[Link](https://doi.org/10.21203/rs.3.rs-9598516/v1)Cited by:[§2\.1](https://arxiv.org/html/2608.10459#S2.SS1.p3.1)\.
- C\. Zeng, S\. Tang, Y\. Chen, Z\. Shen, W\. Yu, X\. Zhao, H\. Chen, W\. Cheng, and Z\. Xu \(2025\)Human texts are outliers: detecting LLM\-generated texts via out\-of\-distribution detection\.InAdvances in Neural Information Processing Systems,Vol\.38\.External Links:[Link](https://proceedings.neurips.cc/paper_files/paper/2025/hash/ef52fd1e24634cb8f7003ebbfb3644d9-Abstract-Conference.html)Cited by:[Appendix A](https://arxiv.org/html/2608.10459#A1.SS0.SSS0.Px3.p1.1),[§1](https://arxiv.org/html/2608.10459#S1.p3.1),[§2\.1](https://arxiv.org/html/2608.10459#S2.SS1.p3.1),[§4\.1](https://arxiv.org/html/2608.10459#S4.SS1.SSS0.Px2.p1.1)\.
- Y\. Zhang, Y\. Chen, C\. Fang, Q\. Wang, J\. Wu, and J\. Xin \(2025\)Learning from open\-set noisy labels based on multi\-prototype modeling\.Pattern Recognition157,pp\. 110902\.External Links:[Document](https://dx.doi.org/10.1016/j.patcog.2024.110902)Cited by:[§2\.2](https://arxiv.org/html/2608.10459#S2.SS2.p2.1)\.

## Appendix AEvaluation Set and Protocol Details

This section reports dataset statistics and protocol details for MAGE, M4, and RAID\. All datasets are cast as binary human\-written versus machine\-generated text detection, and human\-written text is treated as the positive class in our metric implementation\. Validation data are used only to select checkpoints, thresholds, and hyperparameters\. Test labels are not used for any of these choices\.

MAGE CDCMSplitTotalHumanMachineTrain319,07193,318225,753Valid56,79228,79927,993Test56,81928,74128,078
M4 MultilingualSplitTotalHumanMachineTrain172,41783,84688,571Valid4,0002,0002,000Test42,37820,23822,140
RAIDSplitTotalHumanMachineTrain303,2478,571294,676Valid33,69495232,742Test112,3173,232109,085

Table 5:Split sizes after preprocessing\. Each panel reports the total number of examples and the counts for each class for one evaluation setting\. MAGE CDCM denotes the cross\-domain cross\-model setting of MAGE\. For M4, Valid corresponds to the official development split and is not merged into training\. For RAID, Train and Valid are obtained by a deterministic 90%/10% split of the processed RAID training data\.MAGE Unseen DomainsDomainTotalHumanMachineCMV4,9172,4032,514ELI56,3513,1563,195HellaSwag6,3473,2923,055ROC6,4623,2753,187SciGen4,7892,5382,251SQuAD5,0042,5082,496TLDR4,9772,5352,442WP6,2363,0993,137XSum6,5373,2833,254Yelp5,1992,6522,547
MAGE Unseen ModelsGenerator Model FamilyTotalHumanMachineGLM\-130B1,838919919LLaMA7,4203,7103,710BigScience5,3862,6932,693FLAN\-T59,3204,6604,660OpenAI13,2846,6426,642EleutherAI2,8841,4421,442OPT16,0248,0128,012

Table 6:Test sizes for the MAGE leave\-one\-out evaluations\. The left panel lists leave\-one\-domain\-out scenarios, and the right panel lists leave\-one\-generator\-family\-out scenarios\. Each row corresponds to an independently trained leave\-one\-out evaluation scenario\.#### MAGE Splits\.

MAGE CDCM uses the cross\-domain cross\-model setting of MAGE\(Liet al\.,[2024](https://arxiv.org/html/2608.10459#bib.bib25)\)\. The processed split contains 10 source domains: CMV, ELI5, HellaSwag, ROC, SciGen, SQuAD, TLDR, WP, XSum, and Yelp\. Machine\-generated texts are produced by 27 model variants grouped into seven Generator Model Families: LLaMA, BigScience, FLAN\-T5, GLM\-130B, EleutherAI, OpenAI, and OPT\. For MAGE Unseen Domains, each leave\-one\-domain\-out scenario excludes one source domain from training and validation and evaluates on that domain\. For MAGE Unseen Models, each leave\-one\-generator\-family\-out scenario excludes one Generator Model Family from training and validation and evaluates on that family\. Specifically, we used LLaMA\-7B, BLOOM\-7B, FLAN\-T5\-Small, GLM\-130B, GPT\-J, GPT\-3\.5\-Turbo and OPT\-125M model for the unseen\-model setting evaluation\. The test sizes for the leave\-one\-out scenarios are listed in Table[6](https://arxiv.org/html/2608.10459#A1.T6)\.

#### M4 Split\.

M4 is a multi\-generator, multi\-domain, and multilingual benchmark for black\-box machine\-generated text detection\(Wanget al\.,[2024](https://arxiv.org/html/2608.10459#bib.bib42)\)\. We use the SemEval\-2024 M4 Subtask A multilingual protocol with the multilingual train, development, and test splits\. The development split is used to select the checkpoint and threshold and is not merged into training\. The training split spans nine sources, while the multilingual test split contains Arabic, German, Italian, and English\. The test\-time generator labels include BLOOMZ, ChatGPT, Cohere, Davinci, Dolly, JAIS\-30B, and LLaMA2 fine\-tuned\.

#### RAID Split\.

RAID is designed to evaluate detector robustness across domains, generators, decoding strategies, and adversarial perturbations\(Duganet al\.,[2024](https://arxiv.org/html/2608.10459#bib.bib10)\)\. In our experiments, we use the RAID split preprocessed byZenget al\.\([2025](https://arxiv.org/html/2608.10459#bib.bib49)\)\. We apply a 90%/10% split to the processed RAID training data, stratified by binary label\. The resulting train split is used for fitting, valid is used to select the checkpoint and threshold, and the processed RAID test split is used for final evaluation\.

RAID covers eight domains: abstracts, books, news, poetry, recipes, Reddit, reviews, and Wiki\. The machine\-generated side spans several generator families, including GPT\-series, Cohere, LLaMA, Mistral, and MPT variants, alongside human\-written text\. The train and validation splits contain clean examples, while the final test split contains both clean and perturbed examples\. The perturbations include paraphrase, homoglyph, whitespace, zero\-width\-space, synonym, and spelling or formatting perturbations\. Thus, RAID evaluates test\-time robustness to adversarial and decoding\-related variation, while model selection is performed only on clean validation data\.

#### MAGE Leave\-one\-out Settings\.

For MAGE Unseen Domains and MAGE Unseen Models, each leave\-one\-out scenario trains a separate detector\. Aggregate metrics are computed as arithmetic means over scenario\-level results:

mUD=110​∑d∈𝒟UDmd,mUM=17​∑g∈𝒢UMmg\.m\_\{\\mathrm\{UD\}\}=\\frac\{1\}\{10\}\\sum\_\{d\\in\\mathcal\{D\}\_\{\\mathrm\{UD\}\}\}m\_\{d\},\\qquad m\_\{\\mathrm\{UM\}\}=\\frac\{1\}\{7\}\\sum\_\{g\\in\\mathcal\{G\}\_\{\\mathrm\{UM\}\}\}m\_\{g\}\.Thus, MAGE leave\-one\-out results are scenario\-wise macro averages\. All metrics in Appendix[D](https://arxiv.org/html/2608.10459#A4)are reported as percentages\.

## Appendix BAblation Definitions and Additional Analyses

This appendix provides the exact definitions of the nonstandard variants evaluated in Table[3](https://arxiv.org/html/2608.10459#S4.T3)and reports the weighted\-inference and mini\-batch\-hub analyses\. The ablation results and their interpretation are presented in Section[4\.3](https://arxiv.org/html/2608.10459#S4.SS3)and are not repeated here\.

### B\.1Ablation Definitions

#### Prototype Repulsion\.

We replace Prototype Positioning with a direct same\-class prototype repulsion loss\. Because the prototypes are normalized, their inner products correspond to cosine similarity:

ℒrep\\displaystyle\\mathcal\{L\}\_\{\\mathrm\{rep\}\}=12​R​\(R−1\)​∑c=01∑r=1R∑k≠r\[max⁡\(0,pc,r⊤​pc,k\)\]2\.\\displaystyle=\\frac\{1\}\{2R\(R\-1\)\}\\sum\_\{c=0\}^\{1\}\\sum\_\{r=1\}^\{R\}\\sum\_\{k\\neq r\}\\left\[\\max\\left\(0,p\_\{c,r\}^\{\\top\}p\_\{c,k\}\\right\)\\right\]^\{2\}\.\(15\)This objective separates same\-class prototype vectors without using sample\-dependent positioning targets\. All other objectives and training settings remain unchanged\.

#### Raw\-Space Prototype Positioning\.

We also evaluate Prototype Positioning without removing the class\-hub direction\. For each prototype, the assignment\-weighted aggregate is formed directly from the normalized sample embeddings:

gc,r=∑i∈ℬcqi,r​zi,z¯c,r=normε⁡\(gc,r\)\.g\_\{c,r\}=\\sum\_\{i\\in\\mathcal\{B\}\_\{c\}\}q\_\{i,r\}z\_\{i\},\\qquad\\bar\{z\}\_\{c,r\}=\\operatorname\{norm\}\_\{\\varepsilon\}\(g\_\{c,r\}\)\.\(16\)The corresponding objective is

ℒPP​\-​raw=−12​R​∑c=01∑r=1Rlog⁡ϕ​\(z¯c,r,pc,r\)∑p∈𝒫ϕ​\(z¯c,r,p\)\.\\mathcal\{L\}\_\{\\mathrm\{PP\\text\{\-\}raw\}\}=\-\\frac\{1\}\{2R\}\\sum\_\{c=0\}^\{1\}\\sum\_\{r=1\}^\{R\}\\log\\frac\{\\phi\(\\bar\{z\}\_\{c,r\},p\_\{c,r\}\)\}\{\\sum\_\{p\\in\\mathcal\{P\}\}\\phi\(\\bar\{z\}\_\{c,r\},p\)\}\.\(17\)This variant retains prototype\-specific sample aggregation while omitting the decomposition into class\-shared and residual components\.

#### Encoder Backbones\.

The encoder rows in Table[3](https://arxiv.org/html/2608.10459#S4.T3)cover backbones from the SimCSE, RoBERTa, BERT, E5, and BGE families\(Gaoet al\.,[2021](https://arxiv.org/html/2608.10459#bib.bib12); Liuet al\.,[2019](https://arxiv.org/html/2608.10459#bib.bib27); Devlinet al\.,[2019](https://arxiv.org/html/2608.10459#bib.bib8); Wanget al\.,[2022](https://arxiv.org/html/2608.10459#bib.bib41); Xiaoet al\.,[2024](https://arxiv.org/html/2608.10459#bib.bib47)\)\. All backbone variants use the same prototype configuration and training protocol\.

### B\.2Weighted Prototype Inference

The main method scores each class using its maximum prototype similarity\. We additionally evaluate a weighted class score using the same temperature as the within\-class assignments in Equation[6](https://arxiv.org/html/2608.10459#S3.E6):

wc,r​\(z\)\\displaystyle w\_\{c,r\}\(z\)=exp⁡\(z⊤​pc,r/τ\)∑k=1Rexp⁡\(z⊤​pc,k/τ\),\\displaystyle=\\frac\{\\exp\(z^\{\\top\}p\_\{c,r\}/\\tau\)\}\{\\sum\_\{k=1\}^\{R\}\\exp\(z^\{\\top\}p\_\{c,k\}/\\tau\)\},\(18\)s~c​\(z\)\\displaystyle\\widetilde\{s\}\_\{c\}\(z\)=∑r=1Rwc,r​\(z\)​z⊤​pc,r,\\displaystyle=\\sum\_\{r=1\}^\{R\}w\_\{c,r\}\(z\)\\,z^\{\\top\}p\_\{c,r\},\(19\)S~​\(z\)\\displaystyle\\widetilde\{S\}\(z\)=s~1​\(z\)−s~0​\(z\)\.\\displaystyle=\\widetilde\{s\}\_\{1\}\(z\)\-\\widetilde\{s\}\_\{0\}\(z\)\.\(20\)All model parameters remain frozen; only the rule used to combine prototype similarities within each class is changed\.

Table 7:AvgRec under hard\-maximum and weighted prototype inference\.Weighted inference leaves MAGE CDCM and RAID nearly unchanged and improves M4 without retraining\. Its effect is therefore most pronounced under the M4 evaluation setting\.

### B\.3Mini\-Batch Hub Stability

We sample frozen training embeddings using the same sampler and batch size as training and compare each mini\-batch hub with the corresponding class direction computed from the full training set\.

Table 8:Mean mini\-batch composition and cosine similarity between mini\-batch hubs and the corresponding full\-training\-data class directions\. Batch counts are rounded to the nearest sample\.The mini\-batch hubs remain closely aligned with the corresponding full\-data directions across all three datasets\. This alignment is also maintained for the human class in RAID, despite its substantially smaller batch count\.

## Appendix CDetails of Prototype Analysis

This appendix reports the residual\-to\-full preference analysis, defines the writing cues used in Section[4\.4](https://arxiv.org/html/2608.10459#S4.SS4), and provides complete summaries of assigned texts together with their split\-half stability\. The cue definitions are fixed before prototype\-wise aggregation\.

### C\.1Residual\-to\-Full Prototype Preference

For a class\-ccvector, define its normalized hub\-removed representation as

Rc​\(v\)=norm​\(v−\(v⊤​hc\)​hc\)\.R\_\{c\}\(v\)=\\mathrm\{norm\}\\left\(v\-\(v^\{\\top\}h\_\{c\}\)h\_\{c\}\\right\)\.\(21\)For each test sampleii, we compare the same\-class full\-space and hub\-removed preferences,

rifull\\displaystyle r\_\{i\}^\{\\mathrm\{full\}\}=arg⁡maxr⁡zi⊤​pyi,r,\\displaystyle=\\arg\\max\_\{r\}z\_\{i\}^\{\\top\}p\_\{y\_\{i\},r\},\(22\)ri⟂\\displaystyle r\_\{i\}^\{\\perp\}=arg⁡maxr⁡Ryi​\(zi\)⊤​Ryi​\(pyi,r\)\.\\displaystyle=\\arg\\max\_\{r\}R\_\{y\_\{i\}\}\(z\_\{i\}\)^\{\\top\}R\_\{y\_\{i\}\}\(p\_\{y\_\{i\},r\}\)\.\(23\)The analysis uses the sameR=8R=8hard\-max checkpoint and 7,200\-sample MAGE CDCM test capture, containing 3,600 machine and 3,600 human samples\. The two preferences agree for 98\.9% of machine samples and 98\.3% of human samples\. Thus, the prototype preferred after removing the class hub is almost always the same prototype selected in the full space at inference\.

### C\.2Writing Cue Definitions

We compute 21 post\-hoc measurements for every MAGE CDCM test sample\. Table[9](https://arxiv.org/html/2608.10459#A3.T9)defines the cue names used in the main paper, and Tables[10](https://arxiv.org/html/2608.10459#A3.T10)and[11](https://arxiv.org/html/2608.10459#A3.T11)report the complete prototype summaries\. The analysis implementation fixes the lexicons, regular expressions, tokenizer, and sentence\-segmentation rules before prototype\-wise aggregation\.

Table 9:The 21 post\-hoc measurements used in the prototype analysis\. Continuous cues use word and sentence statistics\. Binary cues use fixed lexicons or regular expressions\.The review\-vocabulary cue uses the fixed, case\-insensitive term list shown in Table[9](https://arxiv.org/html/2608.10459#A3.T9); it is not a learned review classifier\.

### C\.3Stability of Prototype Descriptions

We recompute the 21\-dimensional feature\-association vector for every prototype over 50 label\-by\-domain\-stratified split halves\. Within each half, each feature is standardized across the 16 prototypes before comparing the two vectors for the same prototype\. The mean split\-half cosine is 0\.837 for machine prototypes and 0\.908 for human prototypes\. All 16 prototypes receive at least 20 hard assignments in the 7,200\-sample test capture\.

### C\.4Complete Prototype Summaries

Tables[10](https://arxiv.org/html/2608.10459#A3.T10)and[11](https://arxiv.org/html/2608.10459#A3.T11)summarize the texts assigned to all machine and human prototypes\. The cue names match the inventory in Table[9](https://arxiv.org/html/2608.10459#A3.T9)\.

Table 10:Complete summaries of texts assigned to the machine prototypes\. Top domain and top generator denote the largest metadata shares within each assigned group\. Distinctive characteristics report cue frequencies or comparisons with the remaining machine texts\.Table 11:Complete summaries of texts assigned to the human prototypes\. Top domain denotes the largest metadata share within each assigned group\. Distinctive characteristics report cue frequencies or comparisons with the remaining human texts\.

## Appendix DFull Results

We provide full results for all methods, including aggregate evaluation settings and detailed MAGE leave\-one\-out scenarios\. Each table reports AvgRec, HumanRec, MachineRec, F1, Accuracy, AUROC, AUPR, and FPR95\. MAGE\-UD and MAGE\-UM denote MAGE Unseen Domains and MAGE Unseen Models, respectively\.

Table 12:Full results for Binary CE\.Table 13:Full results for SupCon\.Table 14:Full results for DeTeCtive\.Table 15:Full results for DSVDD\.Table 16:Full results for MD\-ProTector\.