ARB: A Matched Authorship-Rewriting Benchmark Dataset for AI-Text Detector Evaluation

# ARB: A Matched Authorship-Rewriting Benchmark Dataset for AI-Text Detector Evaluation
Source: [https://arxiv.org/html/2607.29539](https://arxiv.org/html/2607.29539)
\[type=author, orcid=0000\-0001\-7511\-2910\]

1\]organization=Department of Electrical Engineering and Information Technology, University of Napoli Federico II, addressline=Via Claudio 21, city=Naples, postcode=80125, country=Italy

\[bioid=1\]

\\cortext

\[cor1\]Corresponding author

###### Abstract

Standard AI\-text detection benchmarks compare human\-written text against text generated directly by large language models \(LLMs\)\. While prior work has shown that rewriting and paraphrasing can degrade detector performance, it remains unclear whether performance measured on this conventional benchmark predicts detector behavior when human\-authored content is rewritten by an LLM\. To address this gap, we introduceARB: Authorship\-Rewriting Benchmark, built from 1,800 human source texts \(600 each from XSum, WritingPrompts, and OpenWebText\) and four open\-weight generators \(Llama\-3\.2\-3B, Qwen2\.5\-7B, Mistral\-7B, Gemma\-2\-9B\)\. Each source item yields four matched variants: human\-written \(Human\), direct LLM generation \(Free\-LLM\), LLM\-rewritten human text \(H2L\), and same\-generator LLM\-rewritten LLM text \(LLM2L\)\. We evaluated five detectors \(FastDetectGPT, Binoculars\-falcon\-7b, RADAR, BERT\-Defense, RoBERTa\-Defense\) at a strict 1%\-false\-positive operating point \(TPR@1%FPR\)\. FastDetectGPT and Binoculars\-falcon\-7b detected 91\.2% and 93\.5% of direct LLM text, but only 30\.8% and 15\.1% of human text an LLM had rewritten, a drop of 60–78 percentage points\. The same detectors retained 78\.3% and 83\.0% recall when LLM text was rewritten by the same model, a much smaller decline of 10–13 points\. RADAR followed the same pattern \(66\.8% to 12\.2%\), while BERT\-Defense and RoBERTa\-Defense stayed below 3% recall across all regimes\. These results show that detector performance measured on the conventional human\-vs\-LLM benchmark does not transfer to human\-authored text revised by an LLM, even though the same detectors remain largely robust to LLM\-only rewriting\.

###### keywords:

AI\-text detection\\sepquantitative benchmarking\\seplarge language models\\sepauthorship regimes\\seprewriting robustness\\seplow false\-positive evaluation

\{highlights\}

New four\-regime benchmark separates AI\-authorship from AI\-mediated rewriting

Top detectors reach 91\-94% recall on direct AI\-generated text

Detector recall falls to 15\-31% when human text is AI\-rewritten\.

Rewriting AI text with the same model keeps recall near 78\-83%\.

Standard human\-vs\-AI benchmarks overestimate robustness to AI rewriting\.

## 1Introduction

Large language models \(LLMs\) are nowadays used in a broad range of writing workflows, including drafting, rewriting, summarization, polishing, and style transfer\. Their downstream use is not limited to free\-form generation but also includes assisted composition and the transformation of existing text\(Yang et al\.,[2024](https://arxiv.org/html/2607.29539#bib.bib52)\)\. AI\-text detection, however, is still often evaluated as a binary problem: distinguishing human\-written text from text generated directly by a model\(Gehrmann et al\.,[2019](https://arxiv.org/html/2607.29539#bib.bib10); Ippolito et al\.,[2020](https://arxiv.org/html/2607.29539#bib.bib18); Mitchell et al\.,[2023](https://arxiv.org/html/2607.29539#bib.bib30); Li et al\.,[2024](https://arxiv.org/html/2607.29539#bib.bib23)\)\. This standard benchmark is a necessary baseline, but it is incomplete as an empirical test of detector robustness\. This paper therefore addresses a benchmark\-validity question rather than only a paraphrase\-robustness question\.

The core limitation is that standardHumanvs\. LLM benchmarks conflate two factors\. The first is*content origin*: whether the ideas, facts, discourse structure, and semantic content originate from a human author or from an LLM\. The second is*linguistic surface*: whether the final wording is human\-written, freely generated by an LLM, or mediated by an LLM through rewriting\. These factors can diverge in realistic workflows\. A student, journalist, analyst, or software engineer may write an initial draft and then use an LLM to improve fluency\. In that case, the final text has human\-origin content but an LLM\-mediated surface\. Conversely, an LLM\-generated text may be passed again through the same LLM while remaining LLM\-origin\. A detector score may therefore reflect direct machine authorship, machine\-mediated rewriting, domain artifacts, decoding artifacts, generator\-specific cues, or interactions among these signals\.

Paraphrase\-oriented benchmarks have shown that rewriting, humanization, and adversarial transformation can substantially degrade detector performance\(Krishna et al\.,[2023](https://arxiv.org/html/2607.29539#bib.bib21); Sadasivan et al\.,[2025](https://arxiv.org/html/2607.29539#bib.bib36); Pu et al\.,[2023](https://arxiv.org/html/2607.29539#bib.bib33); Shi et al\.,[2024](https://arxiv.org/html/2607.29539#bib.bib40); Masrour et al\.,[2025](https://arxiv.org/html/2607.29539#bib.bib27)\)\. Benchmarks that include human paraphrases, LLM paraphrases, or mixed human–machine text confirm this pattern at scale\(Lau and Zubiaga,[2025](https://arxiv.org/html/2607.29539#bib.bib22); Wang et al\.,[2024a](https://arxiv.org/html/2607.29539#bib.bib44); Wu et al\.,[2024](https://arxiv.org/html/2607.29539#bib.bib48); Zha et al\.,[2025](https://arxiv.org/html/2607.29539#bib.bib53)\)\. Large\-scale evaluations further show that detector performance varies with generator family, domain, language, and attack type\(Wang et al\.,[2024b](https://arxiv.org/html/2607.29539#bib.bib45); Dugan et al\.,[2024](https://arxiv.org/html/2607.29539#bib.bib7); Li et al\.,[2024](https://arxiv.org/html/2607.29539#bib.bib23); Ayoobi et al\.,[2025](https://arxiv.org/html/2607.29539#bib.bib1); Stowe and Patil,[2026](https://arxiv.org/html/2607.29539#bib.bib41)\)\. These works establish that paraphrasing and rewriting can break detectors, but they primarily evaluate detector degradation under transformed text\. They do not directly test whether performance measured on the conventionalHumanvs\.Free\-LLMbenchmark transfers uniformly across matched authorship–surface regimes\.

The main empirical contribution is therefore not another demonstration that rewriting degrades detectors, but evidence that performance measured under the conventionalHumanvs\.Free\-LLMbenchmark does not transfer uniformly to matched LLM\-mediated rewriting regimes\.

ARB: Authorship\-Rewriting Benchmark operationally contrasts content\-origin and LLM\-mediated surface regimes under a matched benchmark\-transfer design\. It does not estimate a pure causal effect of source origin\. Each matched source item anchors aHumanreference, a directFree\-LLMgeneration, a human\-origin LLM\-mediated rewrite \(H2L\), and a same\-generator second\-pass rewrite of the corresponding LLM output \(LLM2L\)\. This design turns rewriting from a generic attack condition into a diagnostic comparison: ifH2Ldegrades whileLLM2Lremains close toFree\-LLM, then the conventional direct\-generation benchmark is not a reliable proxy for human\-origin LLM\-mediated writing\. We evaluate performance primarily at a conservative low\-false\-positive operating point, with global ranking separability as a secondary view, since false positives on human\-authored or human\-origin text can be costly in educational, scientific, and organizational settings\(Liang et al\.,[2023](https://arxiv.org/html/2607.29539#bib.bib24); Kirchner et al\.,[2023](https://arxiv.org/html/2607.29539#bib.bib20)\)\.

The remainder of the paper is organized as follows\. Section[2](https://arxiv.org/html/2607.29539#S2)states the research objectives and contributions\. Section[3](https://arxiv.org/html/2607.29539#S3)reviews prior work on AI\-text detection, rewriting robustness, benchmark confounding, and low\-false\-positive evaluation, and situates the objectives relative to the closest existing benchmarks\. Section[4](https://arxiv.org/html/2607.29539#S4)describes the matched four\-regime benchmark design\. Section[5](https://arxiv.org/html/2607.29539#S5)defines the evaluated detector families, metrics, block\-level estimation procedure, paired deltas, and uncertainty analysis\. Section[6](https://arxiv.org/html/2607.29539#S6)reports the empirical results across regimes, detectors, datasets, and generators, addressing the research objectives directly\. Section[7](https://arxiv.org/html/2607.29539#S7)discusses the implications for detector robustness and benchmark design, including threats to validity and ethical considerations\. The paper then concludes with the main findings and recommendations\.

## 2Research Objectives

The basic objective of this work is to test whether detector performance measured under the conventionalHumanvs\.Free\-LLMbenchmark is a valid proxy for detector performance under LLM\-mediated rewriting, and to do so with a design that separates*content origin*\(human\- or LLM\-authored\) from*linguistic surface*\(direct generation or LLM\-mediated rewriting\) rather than conflating them into a single “rewritten” class\. The objectives are stated as follows:

- •Determine whether performance estimated under direct\-generation \(Humanvs\.Free\-LLM\) benchmarking transfers to matched LLM\-mediated rewriting regimes, or whether it overestimates robustness\.
- •Design a matched four\-regime benchmark, anchored to shared source items within dataset–generator blocks, that isolates human\-origin LLM\-mediated rewriting \(H2L\) from same\-generator LLM\-origin second\-pass rewriting \(LLM2L\)\.
- •Quantify the operationalH2L–LLM2Lgap at a fixed, conservative low\-false\-positive operating point, alongside global ranking separability, and establish whether the gap is attributable to source origin, transformation strength, or both\.
- •Characterize how detector robustness varies across detector families, dataset domains, and generator models, so that conclusions are reported as stratified, block\-level estimates rather than single aggregate scores\.

ARB: Authorship\-Rewriting Benchmark is the benchmark developed to meet these objectives\. It operationally contrasts content\-origin and LLM\-mediated surface regimes under a matched benchmark\-transfer design; it does not estimate a pure causal effect of source origin\. Each matched source item anchors aHumanreference, a directFree\-LLMgeneration, a human\-origin LLM\-mediated rewrite \(H2L\), and a same\-generator second\-pass rewrite of the corresponding LLM output \(LLM2L\)\. This design turns rewriting from a generic attack condition into a diagnostic comparison: ifH2Ldegrades whileLLM2Lremains close toFree\-LLM, then the conventional direct\-generation benchmark is not a reliable proxy for human\-origin LLM\-mediated writing\. Performance is evaluated primarily at a conservative low\-false\-positive operating point, with global ranking separability as a secondary view, since false positives on human\-authored or human\-origin text can be costly in educational, scientific, and organizational settings\(Liang et al\.,[2023](https://arxiv.org/html/2607.29539#bib.bib24); Kirchner et al\.,[2023](https://arxiv.org/html/2607.29539#bib.bib20)\)\.

The main contributions of this work are as follows:

- •Conceptual contribution:a benchmark\-transfer framing for AI\-text detector evaluation, separating content origin from linguistic surface instead of pooling all LLM\-involved text into one class\.
- •Design contribution:a matched four\-regime authorship–surface design withHuman,Free\-LLM,H2L, and same\-generatorLLM2Lacross XSum, WritingPrompts, and OpenWebText\.
- •Evaluation contribution:block\-level paired deltas, macro\-averaging, bootstrap confidence intervals, andTPR@1%FPRas the primary operating endpoint, alongside AUROC\.
- •Empirical contribution:evidence that strong detectors retain high low\-FPR recall onLLM2Lbut degrade sharply onH2L, showing that the standardHumanvs\.Free\-LLMbenchmark overestimates robustness for human\-origin LLM\-mediated writing\.
- •Diagnostic contribution:textual transformation analysis and detector\-, dataset\-, and generator\-level heterogeneity results showing that the operationalH2L–LLM2Lgap is associated with both source origin and transformation strength, and is not uniform across detector families\.

ARBis designed to advance current AI\-text detection benchmarking by jointly combining matched source items across four regimes, a same\-generatorLLM2Lcontrol, paired block\-level deltas, a sharedHumanreference, and a benchmark\-transfer framing evaluated under a strict low\-FPR endpoint; Section[3\.4](https://arxiv.org/html/2607.29539#S3.SS4)positions this design against the closest prior benchmarks once they have been reviewed\. Unlike paraphrase\-robustness and humanization studies that report detector degradation under a single rewriting attack,ARBtreats rewriting as two distinct, matched authorship–surface conditions and asks whether a benchmark built on one condition \(Free\-LLM\) predicts performance on the other \(H2L,LLM2L\)\. This contributes toward a more precise account of when, and for whom, AI\-text detectors remain reliable\.

Section[6](https://arxiv.org/html/2607.29539#S6)addresses these objectives directly: it first establishes baseline detectability underHumanvs\.Free\-LLM, then quantifies degradation underH2Land under same\-generatorLLM2L, then compares the two LLM\-mediated regimes to isolate the operationalH2L–LLM2Lgap, and finally characterizes heterogeneity across detector families, dataset domains, and generator models\. Section[7](https://arxiv.org/html/2607.29539#S7)interprets the resulting evidence in light of the objectives stated above\.

## 3Related Work

This section positions the study within prior work on AI\-text detection, rewriting robustness, benchmark design, and low\-false\-positive evaluation\. The goal is not to survey all detector variants exhaustively, but to identify the empirical limitations of standard human\-versus\-LLM benchmarks and motivate the need for a matched four\-regime evaluation\.

### 3\.1AI\-text detection families

AI\-text detection has been studied through several detector families\. A recent survey organizes this space along a passive/active axis: passive detectors infer authorship post hoc from a text alone, whereas active approaches, principally watermarking and generation\-log retrieval, require cooperation from the generation pipeline itself\(Xiang et al\.,[2026](https://arxiv.org/html/2607.29539#bib.bib50)\)\.ARBis restricted to passive, post\-hoc detectors; watermarking is out of scope, as it targets a different deployment setting in which the detector controls or has privileged access to the generator\. Within passive detection, statistical detectors such as GLTR expose token\-rank irregularities\(Gehrmann et al\.,[2019](https://arxiv.org/html/2607.29539#bib.bib10)\); supervised detectors fine\-tune encoders such as BERT or RoBERTa\(Ippolito et al\.,[2020](https://arxiv.org/html/2607.29539#bib.bib18); Zhuang et al\.,[2021](https://arxiv.org/html/2607.29539#bib.bib56); Li et al\.,[2024](https://arxiv.org/html/2607.29539#bib.bib23)\); likelihood\- and curvature\-based zero\-shot detectors use probability structure from a reference model, as in DetectGPT and FastDetectGPT\(Mitchell et al\.,[2023](https://arxiv.org/html/2607.29539#bib.bib30); Bao et al\.,[2024](https://arxiv.org/html/2607.29539#bib.bib3)\); contrastive zero\-shot detectors such as Binoculars compare paired observer/performer likelihoods\(Hans et al\.,[2024](https://arxiv.org/html/2607.29539#bib.bib13)\); and robustness\-oriented supervised detectors such as RADAR train against adversarial paraphrasing\(Hu et al\.,[2023](https://arxiv.org/html/2607.29539#bib.bib15)\)\. A newer rewriting\-as\-probe family instead uses an LLM’s own rewrite or correction of a candidate text as the detection signal, exploiting the finding that LLMs edit already\-LLM\-generated text less than human\-written text: RAIDAR measures the edit distance induced by an LLM rewrite of the input\(Mao et al\.,[2024](https://arxiv.org/html/2607.29539#bib.bib26)\); MAGRET instead uses rewrite similarity to detect and attribute authorship without log\-probability access\(Huang et al\.,[2025b](https://arxiv.org/html/2607.29539#bib.bib17)\); L2R fine\-tunes the rewriter to amplify the RAIDAR edit\-distance gap, improving cross\-domain AUROC\(Hao et al\.,[2025](https://arxiv.org/html/2607.29539#bib.bib14)\); and GECScore scores similarity to a grammar\-corrected version of the text, reporting robustness to cross\-domain and paraphrase attacks\(Wu et al\.,[2025](https://arxiv.org/html/2607.29539#bib.bib49)\)\. Recent work also explores more specialized zero\-shot, interpretable, or domain\-adaptive detectors, including inverse\-prompt and distribution\-alignment approaches\(Chen et al\.,[2025a](https://arxiv.org/html/2607.29539#bib.bib4),[b](https://arxiv.org/html/2607.29539#bib.bib5)\)\.

These detector families are not interchangeable: supervised encoders may learn dataset\- or generator\-specific cues and degrade under distribution shift; likelihood\-based detectors depend on the fit between the reference model and the evaluated distribution; contrastive methods can be strong on direct generation but behave differently under rewriting; and robustness\-oriented supervised detectors still need evaluation across domains, generators, and operating points\. Two recent large\-scale comparisons confirm this heterogeneity directly: one spanning classical, neural, fusion, and prompting\-based detectors under domain and generator shift, with every family losing 5–30 AUROC points\(Baidya et al\.,[2026](https://arxiv.org/html/2607.29539#bib.bib2)\); the other fusing stylometric features with transformer representations, which improves cross\-domain transfer but leaves backbone\-specific failure modes\(Mady et al\.,[2026](https://arxiv.org/html/2607.29539#bib.bib25)\)\. For this reason, a benchmark should treat detectors as the objects of evaluation and report family\-level patterns rather than only a single aggregate score\.

### 3\.2Paraphrase and humanization robustness

Paraphrasing and humanization are established challenges for AI\-text detection\.Krishna et al\. \([2023](https://arxiv.org/html/2607.29539#bib.bib21)\)showed that paraphrasing LLM\-generated text can evade detectors while preserving semantics, and proposed retrieval as a defense;Sadasivan et al\. \([2025](https://arxiv.org/html/2607.29539#bib.bib36)\)argued that reliable detection is difficult under realistic attacks and transformations\. Red\-teaming studies show that LLM\-assisted word substitution, style\-changing prompts, or learned paraphrase policies can compromise detector performance\(Shi et al\.,[2024](https://arxiv.org/html/2607.29539#bib.bib40); Weichert and Dimobi,[2024](https://arxiv.org/html/2607.29539#bib.bib47); Ranganath and Ramesh,[2026](https://arxiv.org/html/2607.29539#bib.bib35)\), and security\-oriented evaluations of deepfake text detection find that defenses degrade under adaptive settings\(Pu et al\.,[2023](https://arxiv.org/html/2607.29539#bib.bib33)\)\. Three recent systems push this threat model further: TempParaphraser simulates high\-temperature sampling through repeated normal\-temperature rewrites\(Huang et al\.,[2025a](https://arxiv.org/html/2607.29539#bib.bib16)\); GradEscape trains a lightweight paraphraser against detector gradients or a query\-extracted surrogate, evading deployed commercial detectors\(Meng et al\.,[2025](https://arxiv.org/html/2607.29539#bib.bib28)\); and HUMPA applies a decoding\-time logit shift from a preference\-tuned proxy model that transfers across writing disciplines and languages\(Wang et al\.,[2025](https://arxiv.org/html/2607.29539#bib.bib43)\)\.Weber\-Wulff et al\. \([2023](https://arxiv.org/html/2607.29539#bib.bib46)\)evaluate detection tools under machine translation and content obfuscation, showing that text transformations strongly affect tool reliability, and DAMAGE reports that many detectors struggle when processed by humanizer or paraphrasing systems\(Masrour et al\.,[2025](https://arxiv.org/html/2607.29539#bib.bib27)\)\. Even without an adversarial framing, meaning\-preserving transformation of AI\-generated text alone weakens detection: on the semantic\-invariant split of HC3 PLUS, where ChatGPT answers are translated, summarized, or paraphrased while their content is held fixed, fine\-tuned encoders that reach near\-ceiling balanced accuracy on untransformed text drop by roughly 12–13 points\(Mady et al\.,[2026](https://arxiv.org/html/2607.29539#bib.bib25)\)\.

These studies establish that rewriting and humanization can break detector\-visible signals\. They primarily frame the problem as detector degradation under adversarial or transformed input\. Unlike attack\-centered paraphrase benchmarks,H2Lis not treated only as adversarial evasion\. It is modeled as a plausible assisted\-writing workflow in which human\-origin content receives an LLM\-mediated surface through polishing, rewriting, or assisted composition\.

### 3\.3Mixed authorship and paraphrase\-origin benchmarks

A complementary line of work constructs benchmarks that go beyond binary direct\-generation detection: M4 evaluates multi\-generator, multi\-domain, multilingual settings\(Wang et al\.,[2024b](https://arxiv.org/html/2607.29539#bib.bib45)\); RAID targets robust evaluation under diverse attacks\(Dugan et al\.,[2024](https://arxiv.org/html/2607.29539#bib.bib7)\); MAGE studies detection in the wild\(Li et al\.,[2024](https://arxiv.org/html/2607.29539#bib.bib23)\); M4GT\-Bench adds mixed human–machine detection and boundary localization\(Wang et al\.,[2024a](https://arxiv.org/html/2607.29539#bib.bib44)\); and DetectRL introduces real\-world stressors including human revisions, writing errors, and mixing\(Wu et al\.,[2024](https://arxiv.org/html/2607.29539#bib.bib48)\)\. Model rankings and apparent detector quality vary substantially across datasets, metrics, and protocols\(Pröhl et al\.,[2024](https://arxiv.org/html/2607.29539#bib.bib32); Stowe and Patil,[2026](https://arxiv.org/html/2607.29539#bib.bib41)\), a pattern echoed by two further large\-scale benchmarks: a multi\-family, cross\-domain, cross\-generator evaluation whose humanization protocol, like the paraphrase\-attack studies above, rewrites only already\-LLM\-generated text rather than a human\-origin condition comparable toH2L\(Baidya et al\.,[2026](https://arxiv.org/html/2607.29539#bib.bib2)\); and CUDRT, which pursues operational rather than authorship\-origin diversity across a bilingual Create/Update/Delete/Rewrite/Translate taxonomy, finer\-grained thanARB’s four regimes but not anchored to matched source items sharing a commonHumanbaseline\(Tao et al\.,[2026](https://arxiv.org/html/2607.29539#bib.bib42)\)\.

Two recent benchmarks are particularly close to the present study\.Lau and Zubiaga \([2025](https://arxiv.org/html/2607.29539#bib.bib22)\)introduce the Human & LLM Paraphrase Collection \(HLPC\), which explicitly combines human\-written texts, LLM\-generated texts, and their paraphrases, and reports performance at the 1% FPR operating point for both types\. PADBen distinguishes paraphrasing of human\-authored content \(authorship obfuscation\) from paraphrasing of LLM\-generated content \(plagiarism evasion\) and reports a performance asymmetry between the two cases\(Zha et al\.,[2025](https://arxiv.org/html/2607.29539#bib.bib53)\)\. These works are the closest prior studies toARB, and Table[1](https://arxiv.org/html/2607.29539#S3.T1)positions them explicitly against the present design\.

HLPC and PADBen ask whether paraphrased or source\-aware transformed texts remain detectable\.ARBasks a different evaluation\-validity question: whether detector performance estimated on direct LLM generation transfers to matched LLM\-mediated regimes under a shared human reference distribution\. The distinction is in the benchmark structure and estimand, rather than in the presence of paraphrased text alone\.

Table 1:Structural comparison of the closest benchmark designs\. “Partial” indicates that a feature is present only for part of a benchmark or not used as the central evaluation design\.FeatureM4/RAID/MAGEHLPCPADBenARBMatched source itemNoPartialPartialYesFour\-regime quartetNoNoNoYesHumanbaseline reused across tasksNoPartialPartialYesSame\-generatorLLM2LcontrolNoNoNoYesPaired target\-minus\-baseline deltasNoNoNoYesLow\-FPR endpoint as primary metricPartialYesPartialYesBenchmark\-transfer framingNoNoNoYesTransformation diagnosticsPartialPartialPartialYesA related line of work audits the assumptions encoded in mixed\-authorship datasets themselves, rather than detector robustness to a fixed set of transformations\.Dycke et al\. \([2026](https://arxiv.org/html/2607.29539#bib.bib8)\)formalize AI\-text detection tasks, or “notions,” along three axes—the normative standard for acceptable AI use, the granularity of the human–AI genesis \(document\-, boundary\-, or sentence\-level\), and the attacker model—and show, via AITDNA, a dataset of naturally logged human–LLM co\-writing sessions, that synthetic benchmarks such as DetectRL, Mixset, SenDetEx, and BD misrepresent natural co\-creation in AI\-token proportion, boundary count, and human–AI linguistic gap\. Their document\-level notion is governed by an explicit parameterτ\\tau, the minimum AI\-token share for a document\-level AI label; leavingτ\\tauimplicit, as direct\-generation datasets effectively do by labeling any AI involvement as positive, produces incompatible evaluation targets\. This formalizes, at the dataset\-construction level, the same concern that motivatesARB’s regime design: collapsing content origin and linguistic surface into one label obscures what a detector is asked to recognize\. The two studies are complementary in what they hold fixed:[Dycke et al\.](https://arxiv.org/html/2607.29539#bib.bib8)vary the notion applied to a fixed corpus of natural writing to expose hidden dataset assumptions, whileARBfixes a single notion \(content origin vs\. LLM\-mediated surface\) and varies the rewriting regime under matched source items to test benchmark transfer; their analysis does not include a same\-generator second\-pass control or paired block\-level deltas\.

Overall, prior benchmarks cover important dimensions such as domain diversity, mixed authorship, paraphrase robustness, humanization, and—in the case of AITDNA—the realism of human–AI co\-writing traces underlying dataset construction\. To the best of our knowledge, existing benchmarks do not jointly combine matched source items across four regimes, a same\-generatorLLM2Lcontrol, paired block\-level deltas, a sharedHumanreference, and a benchmark\-transfer framing evaluated under a strict low\-FPR endpoint\. Prior work also shows that aggregate ranking metrics are not sufficient for evaluating AI\-text detectors in settings where false positives are costly\. Several studies therefore report detector performance at fixed low false\-positive rates, including 1% FPR or stricter operating points\(Krishna et al\.,[2023](https://arxiv.org/html/2607.29539#bib.bib21); Lau and Zubiaga,[2025](https://arxiv.org/html/2607.29539#bib.bib22); Masrour et al\.,[2025](https://arxiv.org/html/2607.29539#bib.bib27); Ayoobi et al\.,[2025](https://arxiv.org/html/2607.29539#bib.bib1); Chen et al\.,[2025b](https://arxiv.org/html/2607.29539#bib.bib5); Ranganath and Ramesh,[2026](https://arxiv.org/html/2607.29539#bib.bib35)\)\. This motivates our use ofTPR@1%FPRalongside AUROC in the evaluation protocol\.

### 3\.4Remaining gap: matched benchmark transfer

The comparison in Table[1](https://arxiv.org/html/2607.29539#S3.T1)shows that existing benchmarks address several adjacent problems: detector robustness, mixed\-authorship detection, paraphrase effects, and humanization attacks\. The remaining gap is narrower but important: whether performance measured on the conventionalHumanvs\.Free\-LLMbenchmark transfers to matched LLM\-mediated rewriting regimes under a shared human reference distribution\.

ARBaddresses this gap by anchoring all regimes to matched source items and by using the same\-generatorLLM2Las a controlled second\-pass condition rather than another paraphrase attack\. This design enables paired comparisons among direct LLM generation, human\-origin LLM rewriting, and LLM\-origin second\-pass rewriting within the same dataset–generator blocks, rather than treating rewritten samples as unrelated pooled positives, and thereby tests whether detectors that perform well under conventionalHumanvs\.Free\-LLMevaluation retain low\-FPR recall under matchedH2LandLLM2Lregimes\.

## 4ARBBenchmark Design

This section describes the end\-to\-end construction ofARB\. Figure[1](https://arxiv.org/html/2607.29539#S4.F1)summarizes the transformation flow used to generate the benchmark dataset: each sampled human source item anchors theHumancondition, provides the topic basis forFree\-LLMgeneration, is rewritten to produceH2L, and links the correspondingFree\-LLMoutput to the same\-generatorLLM2Lrewrite\. The pipeline starts from the training splits of three Hugging Face datasets \(XSum, WritingPrompts, and OpenWebText\) applies source preprocessing, and draws a seeded stratified random sample of 600 human texts from each dataset\. Each sampled text is assigned a stable matched\-source identity and then follows three paths: the original text is retained asHuman; a dataset\-specific topic is passed to a generation prompt to createFree\-LLM; and the original human text is passed to a rewrite prompt to createH2L\. The resultingFree\-LLMtext is subsequently rewritten by the same generator to createLLM2L\. Detectors are then applied to every regime variant, after which detection metrics are computed\.

Source datasetsFiltering andlength\-stratified samplingMatched source itemHumanTopic extractionH2Lrewrite promptFree\-LLMgeneration promptH2LFree\-LLMLLM2Lrewrite promptsame generatorLLM2LValid matched blockDetector scoring

Figure 1:End\-to\-endARBconstruction and evaluation workflow\. A filtered, length\-stratified human source item anchors four matched regimes\.Humanretains the source text;Free\-LLMis generated from a dataset\-specific topic;H2Lrewrites the human source; andLLM2Lrewrites the correspondingFree\-LLMoutput with the same generator\. Only complete validated quartets proceed to detector scoring and paired block\-level analysis\.### 4\.1Four\-regime design

The benchmark operationally contrasts content\-origin and LLM\-mediated surface regimes under a matched benchmark\-transfer design\. Table[2](https://arxiv.org/html/2607.29539#S4.T2)defines the four regimes\.Humanis the reference human condition\.Free\-LLMis the baseline machine\-generation condition\.H2LandLLM2Lare experimental conditions in which an LLM mediates the final surface through rewriting\.

Table 2:Four\-regime benchmark design\.RegimeContent originLinguistic surfaceHumanhumanhuman\-writtenFree\-LLMLLMLLM\-generatedH2LhumanLLM\-mediated rewriteLLM2LLLMLLM\-mediated rewriteFor each source sample,Humanis the original human text\.Free\-LLMis generated from a topic derived from the same source item\.H2Lis produced by rewriting the human source text\.LLM2Lis produced by applying the same rewriting protocol to the correspondingFree\-LLMtext\.Free\-LLMis not intended to be a semantic paraphrase of theHumansource; it represents the conventional topic\-conditioned direct\-generation baseline\.H2LandLLM2Linstead instantiate rewriting regimes\. Comparisons are therefore interpreted as benchmark\-transfer contrasts rather than semantic\-equivalence contrasts across all four regimes\. In the main experiment,LLM2Lis generated by the same model that produced the correspondingFree\-LLMtext\. This same\-generator design avoids adding a crossed generator–rewriter factor and makesLLM2La controlled second\-pass condition\. It tests whether a second LLM\-mediated surface pass, by itself, makes LLM\-origin text resemble the harderH2Lcondition\.

### 4\.2Datasets and domains

We used three English datasets selected to represent distinct textual domains: XSum for news and factual writing\(Narayan et al\.,[2018](https://arxiv.org/html/2607.29539#bib.bib31)\), WritingPrompts for creative and narrative writing\(Fan et al\.,[2018](https://arxiv.org/html/2607.29539#bib.bib9)\), and OpenWebText for web/general writing\(Gokaslan et al\.,[2019](https://arxiv.org/html/2607.29539#bib.bib11)\)\.

XSum is a dataset for evaluating summarization models\. Each dataset entry has a “document” component that provides detailed narrative information and a “summary” component that captures the key points\. WritingPrompts is a large FAIR dataset containing human\-written stories paired with prompts from an online forum\. OpenWebText is an open\-source replication of the WebText dataset from OpenAI provided by Aaron Gokaslan\. The dataset has been created by extracting URL links from the “Reddit submission dataset” and parsing the HTML pages of related Reddit posts\.

The topic used in the prompt template to generate theFree\-LLMtexts was dataset\-dependent \(Table[3](https://arxiv.org/html/2607.29539#S4.T3)\): the summary field for XSum, the prompt for WritingPrompts, and the first two cleaned sentences from the text column, with a maximum of 40 words for OpenWebText\. For exact replication, the sources were loaded with the Hugging Facedatasetslibrary using thetrainsplit in all three cases\. Dataset\-specific identifiers and fields are reported in Table[3](https://arxiv.org/html/2607.29539#S4.T3)\. The use of multiple domains is a validity control against conclusions driven by a single genre or source distribution\.

Table 3:Dataset\-specific source fields and topic extraction forFree\-LLMgeneration\.DatasetHugging Face identifierHuman\-text fieldTopic forFree\-LLMXSumEdinburghNLP/xsumdocumentsummaryWritingPromptseuclaise/writingpromptsstorypromptOpenWebTextSkylion007/openwebtexttextfirst two cleaned sentences, at most 40 words
### 4\.3Source preprocessing and stratified random sampling

Detector performance can depend on the amount of available text\. We therefore restricted the eligible source pool to texts of 150–500 whitespace\-delimited words and removed source items rejected by the implemented structural\-artifact and content\-suitability preprocessing\. Each eligible human text was assigned to one of three length strata: short texts contained 150–220 words, medium texts 221–350 words, and long texts 351–500 words\. For each dataset, we then used stratified random sampling with seed 42 to draw 200 rows from each stratum\. The resulting sample contains exactly 600 rows per dataset, i\.e\., 1,800 human source rows in total\.

### 4\.4Generator models

The benchmark uses four open\-weight instruction\-tuned generator families\. We focus on open\-weight generators to ensure reproducibility and release\-compatible benchmarking\. The resulting estimates should not be generalized to closed\-source proprietary systems without additional evaluation\. For each source\-item–generator pair, the selected model creates theFree\-LLMtext, rewrites the human source asH2L, and performs the same\-generator second pass fromFree\-LLMtoLLM2L\.

All four models were loaded inbfloat16precision and received the same fixed system prompt and the same fixed regime\-specific user templates\. No model\-specific prompt wording or prompt tuning was used\. For each source item, only the prompt template variables were instantiated \(Section[4\.5](https://arxiv.org/html/2607.29539#S4.SS5)\): the topic and stratum bounds forFree\-LLM, the human source text forH2L, and the correspondingFree\-LLMoutput forLLM2L\. Table[4](https://arxiv.org/html/2607.29539#S4.T4)therefore reports only model\-specific information\. Model\-family references are provided where a stable technical report or model paper is available\(Grattafiori et al\.,[2024](https://arxiv.org/html/2607.29539#bib.bib12); Mesnard et al\.,[2024](https://arxiv.org/html/2607.29539#bib.bib29); Jiang et al\.,[2023](https://arxiv.org/html/2607.29539#bib.bib19); Qwen Team et al\.,[2024](https://arxiv.org/html/2607.29539#bib.bib34)\)\.

Table 4:Generator models and exact Hugging Face identifiers\.AliasHugging Face model identifierParametersllama32\_3bmeta\-llama/Llama\-3\.2\-3B\-Instruct3Bqwen25\_7bQwen/Qwen2\.5\-7B\-Instruct7Bmistral7bmistralai/Mistral\-7B\-Instruct\-v0\.37Bgemma2\_9bgoogle/gemma\-2\-9b\-it9BThe decoding configuration was specified before detector evaluation and was not tuned post hoc to maximize detector degradation\. The design objective was methodological rather than adversarial: to construct benchmark texts that were sufficiently diverse to avoid trivially templatic outputs, while remaining coherent, semantically faithful, and comparable across generator families\. This choice follows prior work showing that sampling decisions mediate a quality–diversity trade\-off in generated text and can materially affect downstream evaluation conclusions\(Ippolito et al\.,[2020](https://arxiv.org/html/2607.29539#bib.bib18); Chung et al\.,[2023](https://arxiv.org/html/2607.29539#bib.bib6); Zhou et al\.,[2025](https://arxiv.org/html/2607.29539#bib.bib54)\)\. Accordingly, we adopted a moderate stochastic decoding regime rather than deterministic decoding or aggressively high\-temperature sampling, together with the fixed task and output constraints described above\.

To ensure transparent and reproducible generation, we fix the decoding settings across models and regimes\. Generation uses the Hugging Face Transformers backend withdo\_sample=True,temperature=0\.7,top\_p=0\.9,top\_k=40, andmax\_new\_tokens=512\. The global random seed is fixed to 42 for sampling and bootstrap evaluation\. Prompts are rendered through the model chat template before decoding\. For Gemma\-family models, which did not use the same system\-role template in our implementation, the system instruction is merged into the user prompt to preserve a consistent output\-only generation policy\.

### 4\.5Prompt design

This section explains the rationale behind the prompt design, while Appendix[A](https://arxiv.org/html/2607.29539#A1)reports the prompt templates verbatim\.

After sampling, the human text, its source\-dataset identifier, its original source index, and its length band defined the matched source item\. Each source item was used to generate texts using the generator models described in Section[4\.4](https://arxiv.org/html/2607.29539#S4.SS4)\.

Prompt wording can materially affect model behavior\. We therefore treated it as a controlled component of the benchmark rather than tuning it separately by dataset or model\(Zhou et al\.,[2022](https://arxiv.org/html/2607.29539#bib.bib55); Sahoo et al\.,[2024](https://arxiv.org/html/2607.29539#bib.bib37); Schulhoff et al\.,[2024](https://arxiv.org/html/2607.29539#bib.bib39)\)\.

Prompts are composed of two parts: a fixed system prompt and a parametrized task\-dependent prompt\.

They are designed to be short, explicit, neutral in style, and aligned with the three operations being studied\. We deliberately avoided instructions such as “humanize,” named stylistic personas, or detector\-evasion objectives, because these would introduce a separate adversarial or stylistic manipulation\.

The minimal system prompt aims to reduce prompt\-induced formatting artifacts\. It asks every model to return only the requested text and suppresses prefaces, explanations, headings, and Markdown\. This reduces output\-format artifacts that are unrelated to the authorship regime\.

#### Free\-LLMtemplate\.

For each matched source item and generator model, theFree\-LLMtemplate requests fluent, self\-contained English text on the extracted topic, requires original wording and structure, and prohibits references to the source text, headings, and bullet points\.

Topic extraction is dataset\-specific and deterministic: XSum uses the dataset’ssummaryfield, WritingPrompts uses itspromptfield, and OpenWebText uses the first two cleaned sentences, falling back to the first sentence and truncating it to 40 words when necessary\. The topic is an input only to theFree\-LLMbranch, while the complete human text is the input to theH2Lbranch\.min\_wordsandmax\_wordsvariables are also set to the boundaries of the sampled source’s length stratum \(150–220, 221–350, or 351–500 words\)\. Thus, length is controlled from the pre\-generation stratum without supplying the human article itself as generation content\.

#### H2Ltemplate\.

Independently, theH2Ltemplate supplies the complete human source and requests a fluent rewrite that \(i\) preserves meaning, factual claims, entities, and relationships, \(ii\) adds no new information, \(iii\) removes no important information, \(iv\) changes wording and sentence structure where possible, \(v\) and remains approximately the same length\.

#### LLM2Ltemplate\.

TheLLM2Ltemplate applies an analogous meaning\-preserving rewrite instruction to the correspondingFree\-LLMoutput\. The same model that createdFree\-LLMperforms this second pass, soHuman→\\rightarrowH2LandFree\-LLM→\\rightarrowLLM2Ldiffer in input\-content origin while retaining a closely parallel rewriting operation\. Across all datasets and generator families, the templates remain fixed: only the topic, source text, generated text, and the stratum\-derived length variables are instantiated\.

### 4\.6Matched blocks and comparison readiness

A matched unit is defined at the level ofsample\_id×\\timesgenerator\_model\. It contains the unchangedHumantext and theFree\-LLM,H2L, andLLM2Loutputs associated with the same one of the 1,800 sampled source items and generator model\. Source rows are not replaced or resampled after generation; the fixed stratified sample is the basis for all three prompt applications\. Balance by dataset and human\-source length stratum therefore originates in the initial sampling step rather than in post\-generation selection\.

Each generation call was allotted up to three retry attempts, but no call exhausted this budget: every one of the 7,200 attempted source\-item–generator combinations \(1,800 source items×\\times4 generators\) produced a complete quartet, so all 7,200 quartets \(23,400 individual texts; Table[5](https://arxiv.org/html/2607.29539#S4.T5)\) entered detector scoring and paired analysis\. Beyond the prompt\-level constraints described in Section[4\.5](https://arxiv.org/html/2607.29539#S4.SS5)\(the stratum\-derived target length forFree\-LLM, and the meaning\-preservation and approximate\-length instructions forH2LandLLM2L\), no post\-hoc semantic, length, or language filtering was applied to the released benchmark\. Retention was therefore not conditioned on output quality, and a small fraction of generated texts deviate from the intended target profile: automated checks on the released dataset identify 0\.64% of generated texts shorter than 50 words, 0\.08% matching a refusal or policy\-disclaimer pattern \(e\.g\., “I can’t fulfill this request\.”\), 0\.03% flagged as non\-English by automatic language identification, and 0\.01% exact duplicates; these categories overlap, and their union covers 0\.67% \(145/21,600\) of generated texts\. These cases are retained in the released dataset rather than silently dropped, and can be identified and excluded using the released text and word\-count metadata\. Section[7\.5](https://arxiv.org/html/2607.29539#S7.SS5)discusses the resulting limitation\.

The retained identifiers provide the joins required for replication:sample\_idlinks the four regime variants, the source index traces the item to the sampled dataset, and the generator identifier records the model used for all generated variants in that block\. The resolved experiment configuration fixes dataset names and splits, preprocessing settings, length bands, random seed, prompt templates, decoding parameters, and output paths\. These artifacts separate benchmark construction from detector evaluation and permit the complete quartet to be reconstructed before any detector score is inspected\.

Matched comparisons are subsequently computed within the same dataset×\\timesgenerator block\. For example,Δ\\DeltaTPR@1%FPRforH2LcomparesHumanvs\.H2LwithHumanvs\.Free\-LLMunder matched block conditions, before the paired deltas are macro\-averaged across blocks\. The same alignment is used forLLM2Land for the directLLM2L–H2Lsource\-origin comparison\. This avoids comparisons between unrelated pooled samples and carries the construction\-stage matching into statistical estimation\. The matched blocks then enter the detector\-scoring procedure defined in Section[5](https://arxiv.org/html/2607.29539#S5)\.

### 4\.7Dataset description and final statistics

ARBis an English\-language text collection of 23,400 samples: 1,800Humansource texts \(600 per dataset; Section[4\.3](https://arxiv.org/html/2607.29539#S4.SS3)\) and, for each of the four generator models in Table[4](https://arxiv.org/html/2607.29539#S4.T4), oneFree\-LLM,H2L, andLLM2Ltext per source item, i\.e\., 7,200 texts per generated regime \(1,800 source items×\\times4 generators\)\. As reported in Section[4\.6](https://arxiv.org/html/2607.29539#S4.SS6), every attempted source\-item–generator combination is complete, so these figures also describe the exact set of matched quartets used in the paired analyses of Sections[6](https://arxiv.org/html/2607.29539#S6)and[7](https://arxiv.org/html/2607.29539#S7)\.

Table[5](https://arxiv.org/html/2607.29539#S4.T5)reports the final composition by source dataset and regime, together with word\-count statistics computed on whitespace\-delimited tokens\.Humantexts are length\-stratified by construction and therefore fall within 150–500 words in every dataset\.Free\-LLM,H2L, andLLM2Ltexts are only softly constrained by the generation and rewriting prompts \(a target stratum forFree\-LLM, an approximate\-length instruction for the rewrites; Section[4\.5](https://arxiv.org/html/2607.29539#S4.SS5)\) and consequently show a wider spread around a lower mean, withLLM2Ltexts on average the shortest as a result of two successive LLM\-mediated passes\.

Table 5:Final composition ofARBby source dataset and regime\. Each cell reports the number of texts and, in parentheses, the mean±\\pmstandard deviation word count\. Within every dataset×\\timesregime cell, texts are balanced exactly across the four generator models \(Table[4](https://arxiv.org/html/2607.29539#S4.T4)\);Humantexts are shared across generator blocks and are therefore not multiplied by generator\.DatasetHumanFree\-LLMH2LLLM2LXSum600 \(295±\\pm102\)2400 \(234±\\pm105\)2400 \(232±\\pm72\)2400 \(204±\\pm96\)WritingPrompts600 \(298±\\pm104\)2400 \(254±\\pm107\)2400 \(240±\\pm76\)2400 \(229±\\pm99\)OpenWebText600 \(297±\\pm103\)2400 \(224±\\pm107\)2400 \(209±\\pm72\)2400 \(196±\\pm97\)Total1800 \(297±\\pm103\)7200 \(237±\\pm107\)7200 \(227±\\pm75\)7200 \(210±\\pm99\)Licensing\.XSum source articles are BBC news text; the canonical Hugging Face release \(EdinburghNLP/xsum\) does not declare an explicit dataset license and is distributed by its authors for research use\(Narayan et al\.,[2018](https://arxiv.org/html/2607.29539#bib.bib31)\)\. WritingPrompts originates from user\-submitted posts on Reddit’s r/WritingPrompts, compiled byFan et al\. \([2018](https://arxiv.org/html/2607.29539#bib.bib9)\); the Hugging Face mirror used for sourcing \(euclaise/writingprompts\) is tagged with the MIT license\. OpenWebText packaging is released under a CC0 dedication by its curators, who do not claim ownership of the underlying scraped web text and provide a notice\-and\-takedown mechanism for copyright holders\(Gokaslan et al\.,[2019](https://arxiv.org/html/2607.29539#bib.bib11)\)\.ARBitself is released under the Apache License 2\.0 \(Section[Data Availability](https://arxiv.org/html/2607.29539#Sx2)\); as stated there, downstream users remain responsible for the licensing terms of the three source corpora summarized above\.

## 5Evaluation Protocol

This section defines how detectors are evaluated on the benchmark\. We describe the detector families, primary metrics, aggregation and bootstrapping sampling strategies, and textual transformation diagnostics\.

### 5\.1Detectors

The objects of evaluation are AI\-text detectors representing complementary detector families\. We include supervised encoder baselines, a paraphrase\-robust supervised detector, a zero\-shot likelihood/curvature detector, and a zero\-shot contrastive likelihood detector\.ARBis not intended to rank detectors exhaustively\. Its purpose is to test whether detector families preserve performance ordering and low\-FPR recall when moving from direct\-generation evaluation to matched rewriting regimes\.

Table 6:Detector families included in the benchmark and rationale for inclusion\.DetectorFamilySettingRoleBERT\-DefenseSupervised encoderTrainedEncoder baseline\(Pu et al\.,[2023](https://arxiv.org/html/2607.29539#bib.bib33)\)RoBERTa\-DefenseSupervised encoderTrainedRoBERTa encoder baseline\(Pu et al\.,[2023](https://arxiv.org/html/2607.29539#bib.bib33); Zhuang et al\.,[2021](https://arxiv.org/html/2607.29539#bib.bib56)\)RADARRobust supervisedTrainedParaphrase\-robust detector\(Hu et al\.,[2023](https://arxiv.org/html/2607.29539#bib.bib15)\)Binoculars\-falcon\-7bContrastive likelihoodZero\-shotLikelihood\-ratio detector\(Hans et al\.,[2024](https://arxiv.org/html/2607.29539#bib.bib13)\)FastDetectGPTLikelihood/curvatureZero\-shotDetectGPT\-style detector\(Mitchell et al\.,[2023](https://arxiv.org/html/2607.29539#bib.bib30); Bao et al\.,[2024](https://arxiv.org/html/2607.29539#bib.bib3)\)Detector configurations followed the released implementations or paper\-recommended settings whenever available\. Hardware\-driven adjustments were applied only when needed to run the experiments on the available workstation, for example, through precision, quantization, or maximum observed sequence length\. These choices were made for execution feasibility and were not tuned onARBlabels or on regime\-specific performance\. Each detector configuration was kept fixed across all datasets, generator models, and regimes, avoiding detector retuning as a confounding factor in the comparison amongFree\-LLM,H2L, andLLM2L\.

For BERT\-Defense and RoBERTa\-Defense, we used the pretrained checkpoints from the experimental setup ofPu et al\. \([2023](https://arxiv.org/html/2607.29539#bib.bib33)\)\. These encoder baselines are not included as state\-of\-the\-art competitors but as representative supervised detectors whose behavior under distribution shift provides a lower\-bound comparison against zero\-shot and robustness\-oriented methods\.

RADAR was included as a supervised detector explicitly designed for robustness to adversarial paraphrasing\. We used the released checkpoint without additional training or task\-specific adaptation\. Since RADAR follows a detector\-specific score convention in its released implementation, its output orientation was standardized before metric computation\.

For Binoculars\-falcon\-7b, we used the Falcon\-7B observer and Falcon\-7B\-Instruct performer configuration following the released Binoculars setup\. Since the released Binoculars decision rule assigns AI\-generated labels to scores below its threshold, its raw score has a lower\-is\-more\-AI orientation\. We retained the raw scores for reproducibility but used a sign\-reversed score for AUROC andTPR@1%FPRcomputation, so that larger standardized scores always correspond to stronger evidence for the positive class\. No detector\-specific threshold was tuned onARB\.

For FastDetectGPT, we used a fixed sampling/scoring model pair for all evaluated generators\. We did not change the detector backbone according to the generator model, because doing so would introduce a confounding factor between generator identity and detector configuration\. Following the updated recommendation of the official FastDetectGPT repository, we used Llama3\-8B as the sampling model and Llama3\-8B\-Instruct as the scoring model\. To make the paired zero\-shot detector feasible on the available 32 GB GPU setup, inference was run with 8\-bit quantization\. This was an execution constraint, not a detector calibration step; no FastDetectGPT component was fine\-tuned or threshold\-tuned onARB\.

For every detector, raw scores and standardized scores were stored\. AUROC andTPR@1%FPRwere computed from standardized continuous scores, not from detector\-specific default labels\. Detector\-specific default thresholds were retained only for reproducibility and auxiliary inspection\. This standardization ensures that all pairwise comparisons use a common score orientation, withHumanas the negative class and the target regime as the positive class\.

### 5\.2Experimental setup

All experiments were conducted on a Linux workstation running Ubuntu 24\.04\.4 LTS with kernel 6\.8\.0\-124\-generic\. The machine was equipped with an Intel Core Ultra 9 285K CPU, 62 GiB of RAM, and a 1\.9 TB Samsung NVMe SSD formatted with ext4\. GPU\-based experiments were executed on a single NVIDIA GeForce RTX 5090 with 32 GB of VRAM, using NVIDIA driver 590\.48\.01\.

The software environment used Python 3\.12\.3 and PyTorch 2\.11\.0\+cu128\. CUDA was available through PyTorch 12\.8 with cuDNN 9\.1\.9, while the NVIDIA\-SMI interface reported CUDA compatibility version 13\.1\. Detector configurations were therefore selected to be executable under this single\-GPU setup while remaining fixed across regimes, datasets, and generator models\.

### 5\.3Primary metrics

We useTPR@1%FPRas the primary operating metric\. It is defined as the fraction of positive examples detected when the false\-positive rate on the human class is constrained to 1%\. This conservative endpoint is important because false accusations of AI authorship can create fairness and accountability concerns, including biases against non\-native English writers\(Liang et al\.,[2023](https://arxiv.org/html/2607.29539#bib.bib24)\)\.

We report AUROC as a complementary secondary metric\. AUROC measures global ranking separability: the probability that a randomly selected positive example receives a higher machine\-likeness score than a randomly selected human example\. It is threshold\-independent and useful across the full score range, but it does not indicate whether a detector retains useful recall under the prespecified low\-FPR constraint\.

For each detector, dataset, and generator, we evaluated three matched binary detection tasks:Humanvs\.Free\-LLM,Humanvs\.H2L, andHumanvs\.LLM2L\. In each task,Humantexts are the negative class and the target\-regime texts are the positive class\. The sameHumanset is reused across the three tasks within each block to keep the human reference distribution fixed\. This prevents changes in the human negative class from confounding comparisons amongFree\-LLM,H2L, andLLM2L\.

In the interpretation of results, we therefore lead withTPR@1%FPRand use AUROC as a secondary view of global separability\. This distinction is essential because detectors can retain non\-trivial AUROC while having near\-zero low\-FPR recall\.

### 5\.4Block\-level estimation, aggregation, and uncertainty

All performance estimates were first computed within each dataset×\\timesgenerator block\. For each detector and block, we computedTPR@1%FPRand AUROC for three binary comparisons:Humanvs\.Free\-LLM,Humanvs\.H2L, andHumanvs\.LLM2L\.

To quantify transfer from the conventional direct\-generation benchmark, we computed paired target\-minus\-Free\-LLMdeltas within each block\. A negative delta means that the detector performed worse in the target regime than in theFree\-LLMbaseline under the same dataset and generator\. These deltas were computed separately forH2LandLLM2L\. To compare the two LLM\-mediated regimes directly, we computed an operationalH2L–LLM2Lgap asLLM2LminusH2Lwithin the same block\. A positive gap means thatLLM2Lwas more detectable thanH2Lunder the same dataset and generator\.

Detector\-level results were then obtained by macro\-averaging across dataset×\\timesgenerator blocks\. This gave each block equal weight and prevented larger or easier blocks from dominating the aggregate estimate\. Deltas and operational gaps were computed within blocks before macro\-averaging, rather than as differences between pooled averages\.

We reported 95% confidence intervals using a block\-structured bootstrap with 5,000 resamples and random seed 42\. Within each dataset×\\timesgenerator block, rows were resampled with replacement, andTPR@1%FPRand AUROC were recomputed for each replicate\. For deltas and operational gaps, the aligned rows across matched regimes were resampled jointly, preserving the pairing between regimes\. Confidence intervals were reported as percentile intervals over the resulting bootstrap distribution\. These intervals quantify uncertainty in the aggregate estimates, and heterogeneity across domains and generators is reported separately using heatmaps and stratified diagnostics\.

### 5\.5Textual transformation diagnostics

We computed textual transformation diagnostics for the two rewriting paths\. ForH2L, the source text was the originalHumantext and the target text was its LLM\-mediated rewrite\. ForLLM2L, the source text was the correspondingFree\-LLMoutput, and the target text was the same\-generator second\-pass rewrite\.

For each source–target pair, we measured word ratio, token\-level normalized edit distance \(NED\), lexical overlap using Jaccard similarity, and semantic similarity\. These diagnostics were not used as detector inputs\. They were used only to characterize how much each rewriting path changed its source text\.

## 6Results

This section reports the benchmark results in order of the research objectives\. We first establish baseline detectability under the conventionalHumanvs\.Free\-LLMcondition, then quantify degradation underH2LandLLM2L, compare the two LLM\-mediated regimes, and finally analyze heterogeneity across detectors, datasets, generators, and textual transformation features\.

### 6\.1Baseline detectability underHumanvs\.Free\-LLM

This first analysis evaluates the standard detector benchmark: distinguishingHumantexts from directly generatedFree\-LLMtexts\. Table[7](https://arxiv.org/html/2607.29539#S6.T7)reportsTPR@1%FPRand AUROC for all regimes; theFree\-LLMrows are the baseline control\.

At the primary operating point, FastDetectGPT and Binoculars\-falcon\-7b obtain the strongest baselineTPR@1%FPRvalues,0\.9120\.912and0\.9350\.935, respectively; RADAR reaches0\.6680\.668\. Their secondary AUROC values are also high \(0\.9900\.990,0\.9830\.983, and0\.9130\.913\)\. In contrast, RoBERTa\-Defense has near\-zeroTPR@1%FPR\(0\.0190\.019\) despite moderate AUROC \(0\.5690\.569\), while BERT\-Defense has negligibleTPR@1%FPR\(0\.0010\.001\) and very low AUROC \(0\.2100\.210\)\.

These results establish that direct LLM generation is detectable by the strongest zero\-shot detectors and by RADAR, but not by all detector families at a strict low\-FPR operating point\. The baseline therefore provides a necessary control for interpreting subsequent robustness losses\.

Table 7:Pairwise detection performance across regimes, with the primary low\-FPR endpoint reported first\. Values are macro\-averaged block\-level estimates with 95% confidence intervals across dataset×\\timesgenerator blocks\. Bold values indicate the best score for each comparison and metric\.DetectorComparisonTPR@1%FPRAUROCBERT\-DefenseHumanvs\.Free\-LLM0\.001 \[0\.000, 0\.003\]0\.210 \[0\.203, 0\.217\]BERT\-DefenseHumanvs\.H2L0\.012 \[0\.008, 0\.015\]0\.453 \[0\.444, 0\.463\]BERT\-DefenseHumanvs\.LLM2L0\.002 \[0\.001, 0\.004\]0\.233 \[0\.226, 0\.240\]RoBERTa\-DefenseHumanvs\.Free\-LLM0\.019 \[0\.011, 0\.030\]0\.569 \[0\.560, 0\.578\]RoBERTa\-DefenseHumanvs\.H2L0\.025 \[0\.016, 0\.038\]0\.586 \[0\.577, 0\.595\]RoBERTa\-DefenseHumanvs\.LLM2L0\.016 \[0\.009, 0\.025\]0\.538 \[0\.528, 0\.547\]FastDetectGPTHumanvs\.Free\-LLM0\.912 \[0\.892, 0\.929\]0\.990 \[0\.989, 0\.992\]FastDetectGPTHumanvs\.H2L0\.308 \[0\.264, 0\.347\]0\.874 \[0\.868, 0\.879\]FastDetectGPTHumanvs\.LLM2L0\.783 \[0\.754, 0\.808\]0\.971 \[0\.968, 0\.973\]Binoculars\-falcon\-7bHumanvs\.Free\-LLM0\.935 \[0\.924, 0\.942\]0\.983 \[0\.980, 0\.985\]Binoculars\-falcon\-7bHumanvs\.H2L0\.151 \[0\.135, 0\.166\]0\.666 \[0\.658, 0\.674\]Binoculars\-falcon\-7bHumanvs\.LLM2L0\.830 \[0\.816, 0\.842\]0\.952 \[0\.948, 0\.955\]RADARHumanvs\.Free\-LLM0\.668 \[0\.636, 0\.694\]0\.913 \[0\.909, 0\.918\]RADARHumanvs\.H2L0\.122 \[0\.101, 0\.141\]0\.596 \[0\.588, 0\.604\]RADARHumanvs\.LLM2L0\.646 \[0\.617, 0\.670\]0\.903 \[0\.899, 0\.908\]
### 6\.2Robustness underH2Lrewriting

This analysis measures transfer from theFree\-LLMbaseline to theH2Lregime\. Table[8](https://arxiv.org/html/2607.29539#S6.T8)reports paired target\-minus\-Free\-LLMdeltas for both rewriting regimes; this subsection focuses on theH2Lcolumns\. Negative values indicate degradation relative to direct LLM generation\. Figure[2](https://arxiv.org/html/2607.29539#S6.F2)shows how meanΔ\\DeltaTPR@1%FPRvaries across detectors and datasets after averaging the paired block\-level deltas across generators\.

The strongest baseline detectors experience the largestH2Llosses\. FastDetectGPT decreases fromTPR@1%FPR0\.9120\.912inFree\-LLMto0\.3080\.308inH2L, corresponding toΔ\\DeltaTPR@1%FPR=−0\.605=\-0\.605\. Binoculars\-falcon\-7b decreases from0\.9350\.935to0\.1510\.151, corresponding toΔ\\DeltaTPR@1%FPR=−0\.784=\-0\.784\. RADAR decreases from0\.6680\.668to0\.1220\.122, corresponding toΔ\\DeltaTPR@1%FPR=−0\.546=\-0\.546\. Figure[2](https://arxiv.org/html/2607.29539#S6.F2)shows that these losses are not uniform across datasets: Binoculars\-falcon\-7b and RADAR show particularly large degradation on XSum and OpenWebText, whereas WritingPrompts is comparatively less severe for some detectors\.

The AUROC losses are also visible but less operationally severe than the low\-FPR losses\. FastDetectGPT drops by−0\.117\-0\.117AUROC, while Binoculars\-falcon\-7b and RADAR drop by−0\.316\-0\.316and−0\.318\-0\.318, respectively\. BERT\-Defense and RoBERTa\-Defense show small or positive deltas, but these values should not be interpreted as robustness: both detectors have near\-zeroTPR@1%FPRin the baseline and remain near zero underH2L\.

Table 8:Regime deltas relative toFree\-LLM\. Deltas are computed as paired target\-minus\-Free\-LLMdifferences within dataset×\\timesgenerator blocks and then macro\-averaged\. Negative values indicate degradation\.DetectorΔ\\DeltaTPR@1%FPRH2LΔ\\DeltaAUROCH2LΔ\\DeltaTPR@1%FPRLLM2LΔ\\DeltaAUROCLLM2LBERT\-Defense0\.010 \[0\.007, 0\.014\]0\.243 \[0\.235, 0\.251\]0\.001 \[\-0\.001, 0\.002\]0\.023 \[0\.020, 0\.025\]RoBERTa\-Defense0\.006 \[\-0\.002, 0\.014\]0\.017 \[0\.008, 0\.025\]\-0\.003 \[\-0\.008, 0\.001\]\-0\.032 \[\-0\.036, \-0\.027\]FastDetectGPT\-0\.605 \[\-0\.645, \-0\.569\]\-0\.117 \[\-0\.122, \-0\.111\]\-0\.130 \[\-0\.146, \-0\.115\]\-0\.020 \[\-0\.021, \-0\.018\]Binoculars\-falcon\-7b\-0\.784 \[\-0\.802, \-0\.767\]\-0\.316 \[\-0\.325, \-0\.308\]\-0\.104 \[\-0\.114, \-0\.096\]\-0\.031 \[\-0\.034, \-0\.028\]RADAR\-0\.546 \[\-0\.575, \-0\.514\]\-0\.318 \[\-0\.326, \-0\.310\]\-0\.023 \[\-0\.030, \-0\.015\]\-0\.010 \[\-0\.012, \-0\.008\]

![Refer to caption](https://arxiv.org/html/2607.29539v1/x1.png)Figure 2:MeanΔ\\DeltaTPR@1%FPRunderH2Lby detector and dataset\. Each cell is the mean across generators of the paired block\-level difference betweenH2LandFree\-LLM\(H2LminusFree\-LLM\)\. Negative values indicate degradation relative to direct LLM generation\.Thus,H2Lsubstantially weakens detector performance for detectors that are effective in the standard baseline condition\. The effect is strongest at the low false\-positive operating point\.

### 6\.3Robustness under same\-generatorLLM2Lsecond pass

This analysis evaluates whether a second pass through the same generator weakens detector signals in already LLM\-origin text\. TheLLM2Ldeltas in Table[8](https://arxiv.org/html/2607.29539#S6.T8)are substantially smaller than the correspondingH2Ldeltas for detectors with strong baselines\.

Figure[3](https://arxiv.org/html/2607.29539#S6.F3)reports the meanΔ\\DeltaTPR@1%FPRunderLLM2Lfor each detector and dataset after averaging the paired block\-level deltas across generators\.

![Refer to caption](https://arxiv.org/html/2607.29539v1/x2.png)Figure 3:MeanΔ\\DeltaTPR@1%FPRunderLLM2Lby detector and dataset\. Each cell is the mean across generators of the paired block\-level difference betweenLLM2LandFree\-LLM\(LLM2LminusFree\-LLM\)\. Negative values indicate degradation relative to direct LLM generation\.FastDetectGPT decreases fromTPR@1%FPR0\.9120\.912inFree\-LLMto0\.7830\.783inLLM2L, withΔ\\DeltaTPR@1%FPR=−0\.130=\-0\.130\. Binoculars\-falcon\-7b decreases from0\.9350\.935to0\.8300\.830, withΔ\\DeltaTPR@1%FPR=−0\.104=\-0\.104\. RADAR is nearly stable, decreasing from0\.6680\.668to0\.6460\.646, withΔ\\DeltaTPR@1%FPR=−0\.023=\-0\.023\. The corresponding AUROC deltas are also small:−0\.020\-0\.020for FastDetectGPT,−0\.031\-0\.031for Binoculars\-falcon\-7b, and−0\.010\-0\.010for RADAR\.

The dataset\-level pattern in Figure[3](https://arxiv.org/html/2607.29539#S6.F3)confirms thatLLM2Ldegradation is weaker than theH2Ldegradation reported in Figure[2](https://arxiv.org/html/2607.29539#S6.F2)\. Same\-generator second\-pass rewriting therefore does not erase machine\-origin signals to the same degree as human\-origin LLM rewriting\. For detectors that are informative in the baseline benchmark,LLM2Lremains much closer toFree\-LLMthan toH2L\.

### 6\.4OperationalH2L–LLM2Lgap under LLM\-mediated surface

This analysis comparesH2LandLLM2Ldirectly\. Both regimes have an LLM\-mediated final surface, but they differ in source origin and in observed transformation strength:H2Lstarts from human\-authored content and undergoes a stronger measured transformation, whereasLLM2Lstarts from LLM\-origin content\. Table[9](https://arxiv.org/html/2607.29539#S6.T9)reports the operationalLLM2LminusH2Lgap with bootstrap uncertainty\. Gaps are computed as pairedLLM2L\-minus\-H2Ldifferences within dataset×\\timesgenerator blocks and macro\-averaged across blocks\.

Figure[4](https://arxiv.org/html/2607.29539#S6.F4)provides the complementary absolute\-performance view, comparing meanTPR@1%FPRacrossFree\-LLM,LLM2L, andH2Lfor every detector\. It shows that the large negativeH2Ldeltas in Figure[2](https://arxiv.org/html/2607.29539#S6.F2)arise from a sharp reduction relative to the direct\-generation baseline, whereasLLM2Lgenerally remains much closer toFree\-LLM\.

![Refer to caption](https://arxiv.org/html/2607.29539v1/x3.png)Figure 4:Detection performance across generation regimes\. Bars show the detector\-level meanTPR@1%FPRforFree\-LLM,LLM2L, andH2L, macro\-averaged across dataset×\\timesgenerator blocks\. Error bars denote block\-structured bootstrap 95% confidence intervals\. The contrast betweenH2LandLLM2Lvisualizes the source\-origin gap under LLM\-mediated surface\.For the strongest baseline detectors,LLM2Lis much more detectable thanH2L\. Binoculars\-falcon\-7b has aTPR@1%FPRgap of0\.6800\.680\(95% CI\[0\.661,0\.698\]\[0\.661,0\.698\]\), RADAR has a gap of0\.5240\.524\(\[0\.493,0\.551\]\[0\.493,0\.551\]\), and FastDetectGPT has a gap of0\.4750\.475\(\[0\.444,0\.511\]\[0\.444,0\.511\]\)\. All three intervals exclude zero\. These gaps show that the presence of an LLM\-mediated final surface is not sufficient to explain detector performance:H2LandLLM2Lremain substantially different at the low\-FPR operating point\.

However, the textual diagnostics in Section[6\.6](https://arxiv.org/html/2607.29539#S6.SS6)show thatH2Lalso applies stronger surface transformation thanLLM2L\(NED0\.6020\.602vs\.0\.3480\.348; Jaccard0\.4630\.463vs\.0\.5870\.587\)\. The gap between the two regimes therefore reflects some combination of source origin and transformation strength; the two factors are partially confounded in the current design\. For this reason, we interpret the result as an operational source\-origin\-associated gap rather than as a causal estimate of source origin alone\.

For BERT\-Defense and RoBERTa\-Defense, the operational gaps are not diagnostically useful because both detectors have near\-zeroTPR@1%FPRin all regimes\. Their small or negative gaps reflect poor operating\-point performance rather than evidence of robustness\.

Table 9:Paired operational gap betweenLLM2LandH2L\. Positive values indicate thatLLM2Lis more detectable thanH2L\. Values are macro\-averaged across dataset×\\timesgenerator blocks; brackets report block\-structured bootstrap 95% confidence intervals\.DetectorTPR@1%FPRgap \[95% CI\]AUROC gap \[95% CI\]BERT\-Defense\-0\.010 \[\-0\.013, \-0\.007\]\-0\.220 \[\-0\.228, \-0\.213\]RoBERTa\-Defense\-0\.009 \[\-0\.017, \-0\.002\]\-0\.048 \[\-0\.057, \-0\.040\]FastDetectGPT0\.475 \[0\.444, 0\.511\]0\.097 \[0\.092, 0\.102\]Binoculars\-falcon\-7b0\.680 \[0\.661, 0\.698\]0\.285 \[0\.277, 0\.294\]RADAR0\.524 \[0\.493, 0\.551\]0\.308 \[0\.300, 0\.315\]
### 6\.5Detector\-family, dataset, and generator heterogeneity

This analysis examines whether theH2Ldegradation is uniform across detectors, datasets, and generator models\. The full AUROC andTPR@1%FPRheatmaps for theH2Lregime are reported in Appendix[B](https://arxiv.org/html/2607.29539#A2); each panel corresponds to one detector, and each cell represents a generator×\\timesdataset block\.

The largest differences are observed across detector families\. FastDetectGPT is the most robust detector underH2L, although it still loses substantialTPR@1%FPR\. Binoculars\-falcon\-7b and RADAR are strong inFree\-LLMandLLM2Lbut degrade sharply inH2L\. BERT\-Defense and RoBERTa\-Defense remain weak at the low\-FPR operating point across regimes\.

Dataset effects are also visible\. UnderH2L, Binoculars\-falcon\-7b is comparatively stronger on WritingPrompts but degrades on OpenWebText and XSum\. RADAR shows a different pattern: it can obtain strong AUROC on XSum while retaining only moderateTPR@1%FPR, illustrating that ranking quality and conservative\-threshold recall can diverge\.

Generator\-level variation is present but less uniform than dataset\-level variation\. No generator is uniformly easy or difficult across all detectors\. However, qwen25\_7b appears more challenging for selected detectors, especially in low\-FPR recall, while llama32\_3b is often easier to detect for FastDetectGPT and Binoculars\-falcon\-7b\. These observations should be interpreted as block\-level heterogeneity rather than as causal properties of individual generators\.

Overall, this heterogeneity analysis shows that robustness is driven primarily by the detector family, with additional variation in datasets and generators that would be hidden by pooled benchmark\-level averages\.

### 6\.6Textual transformation analysis

As a supporting diagnostic analysis, we compare source and target texts using target\-to\-source word ratio, token\-level normalized edit distance, lexical overlap, and semantic similarity\. ForH2L, the source is the originalHumantext and the target is its LLM\-mediated rewrite\. ForLLM2L, the source is the correspondingFree\-LLMoutput and the target is the same\-generator second\-pass output\.

Table[10](https://arxiv.org/html/2607.29539#S6.T10)compares the textual change induced by the two rewriting paths, while Figure[5](https://arxiv.org/html/2607.29539#S6.F5)provides a compact visual summary\.H2Lproduces shorter outputs thanLLM2L, with a word ratio of0\.7980\.798compared with0\.8870\.887\. It also introduces stronger token\-level changes, with normalized edit distance0\.6020\.602compared with0\.3480\.348forLLM2L\. Lexical overlap is lower inH2L\(0\.4630\.463\) than inLLM2L\(0\.5870\.587\)\. Both paths retain high semantic similarity, althoughLLM2Lis more conservative: semantic similarity is0\.8860\.886forH2Land0\.9490\.949forLLM2L\.

These diagnostics characterizeH2Las a broadly meaning\-preserving but more surface\-altering rewrite thanLLM2L\. This pattern is consistent with the larger detection loss underH2L, but it does not establish that any single textual feature causes the loss\.

Table 10:Textual change induced by the two rewriting paths\.H2Lmeasures the transformation fromHumantoH2L, whereasLLM2Lmeasures the transformation fromFree\-LLMtoLLM2L\. Values report mean estimates with 95% confidence intervals\.AspectHuman→\\rightarrowH2LFree\-LLM→\\rightarrowLLM2LInterpretationWord ratio0\.798 \[0\.746, 0\.845\]0\.887 \[0\.857, 0\.916\]More compression inH2LToken NED0\.602 \[0\.575, 0\.628\]0\.348 \[0\.301, 0\.395\]Greater surface change inH2LJaccard overlap0\.463 \[0\.436, 0\.489\]0\.587 \[0\.534, 0\.648\]Less vocabulary overlap inH2LSemantic similarity0\.886 \[0\.866, 0\.904\]0\.949 \[0\.939, 0\.958\]LLM2Lis more conservative![Refer to caption](https://arxiv.org/html/2607.29539v1/x4.png)Figure 5:Textual change induced by the two rewriting paths\.H2Lcorresponds toHuman→\\rightarrowH2L, whereasLLM2Lcorresponds toFree\-LLM→\\rightarrowLLM2L\. The figure shows thatH2Lintroduces stronger surface changes, whileLLM2Lis a more conservative second\-pass rewrite\. Error bars denote block\-structured bootstrap 95% confidence intervals\.

## 7Discussion

The results have implications for detector robustness, benchmark validity, and deployment under LLM\-mediated rewriting\. Section[7\.3](https://arxiv.org/html/2607.29539#S7.SS3)makes explicit how these results advance theory relative to prior paraphrase\-robustness and benchmark\-transfer work, and what they imply for detector selection and deployment in practice\.

### 7\.1Interpretation

The main empirical finding is a benchmark\-transfer failure: standardHumanvs\.Free\-LLMevaluation overestimates robustness when the target includes human\-origin LLM\-mediated rewriting\. FastDetectGPT, Binoculars\-falcon\-7b, and RADAR remain comparatively stable under same\-generatorLLM2Lbut degrade sharply underH2L, so an additional LLM pass does not by itself make LLM\-origin text resemble the harderH2Lcondition\. This is a benchmark\-transfer failure across matched regimes, however, not a pure causal effect of source origin\.H2Lalso changes its source more extensively thanLLM2L\(Section[6\.6](https://arxiv.org/html/2607.29539#S6.SS6)\), so theH2L–LLM2Lgap should be read as an operational source\-origin\-associated gap under LLM\-mediated surface, rather than as evidence that source origin alone causes degradation; isolating source origin would require rewriting conditions explicitly matched on transformation strength \(see Section[7\.5](https://arxiv.org/html/2607.29539#S7.SS5)for how this bears on interpretation\)\.

Two independent detection\-method literatures corroborate the direction of this asymmetry through an entirely different mechanism, rewrite\-induced similarity or edit distance rather than classifier scoring\.Huang et al\. \([2025b](https://arxiv.org/html/2607.29539#bib.bib17)\)show that a model’s own rewrite of its output stays measurably closer to that model’s typical generations than any human text, stable across generator families, decoding temperatures, and top\-ppvalues\. RAIDAR\(Mao et al\.,[2024](https://arxiv.org/html/2607.29539#bib.bib26)\)and its generalization L2R\(Hao et al\.,[2025](https://arxiv.org/html/2607.29539#bib.bib14)\)build on the complementary premise, that human\-origin text is edited more than LLM\-origin text under LLM rewriting, to construct a detector directly from that edit distance, validating the asymmetry across 21 domains and four generator families\. Where we treat this asymmetry as a source of benchmark\-transfer failure for existing classifier\-based detectors, these works treat it as an exploitable detection signal in its own right; together, the two perspectives suggest that content\-origin sensitivity under LLM\-mediated rewriting is a structural property of current LLMs rather than an artifact of any one detector or dataset\.

### 7\.2Comparison with prior benchmarks

Prior work shows that detector performance is sensitive to paraphrasing, rewriting, adversarial prompting, and benchmark construction\(Krishna et al\.,[2023](https://arxiv.org/html/2607.29539#bib.bib21); Sadasivan et al\.,[2025](https://arxiv.org/html/2607.29539#bib.bib36); Shi et al\.,[2024](https://arxiv.org/html/2607.29539#bib.bib40); Dugan et al\.,[2024](https://arxiv.org/html/2607.29539#bib.bib7)\)\. PADBen studies paraphrase attack trajectories for human\- and LLM\-authored content, while HLPC measures the effects of human and LLM paraphrases at a 1% FPR operating point\(Zha et al\.,[2025](https://arxiv.org/html/2607.29539#bib.bib53); Lau and Zubiaga,[2025](https://arxiv.org/html/2607.29539#bib.bib22)\)\.ARBcomplements these studies by treating the problem as benchmark transfer: whether performance under conventional direct generation predicts performance across matched LLM\-mediated authorship–surface regimes under a shared human reference distribution\. The same\-generatorLLM2Lcontrol makes this a matched comparison of two LLM\-mediated regimes within each dataset–generator block, revealing an asymmetry consistent with PADBen’s distinction between authorship obfuscation and plagiarism evasion while avoiding a pooled “rewritten” class that would conceal differences between human\- and LLM\-origin inputs\(Zha et al\.,[2025](https://arxiv.org/html/2607.29539#bib.bib53)\); the contribution is therefore not another demonstration that rewriting reduces detection performance, but evidence that direct\-generation benchmarks transfer differently to two distinct rewriting paths\.

The content\-origin/linguistic\-surface distinction underlying Table[2](https://arxiv.org/html/2607.29539#S4.T2)echoes the genesis\-based notion taxonomy ofDycke et al\. \([2026](https://arxiv.org/html/2607.29539#bib.bib8)\), who likewise separate what a text’s tokens objectively are from the normative target a detector is asked to recognize, and who recommend that notion parameters, such as the minimum AI\-token ratio required to call a document AI\-generated, be stated explicitly rather than left implicit in the data\-generation procedure\. Our four\-regime design can be read as instantiating their document\-level notion twice, once with a human genesis and once with an LLM genesis, specifically to isolate the transfer gap between the two; our regime labels play the same explicitness role for the content\-origin/surface\-mediation split as theirτ\\tauplays for genesis granularity\.

A related asymmetry appears inBaidya et al\. \([2026](https://arxiv.org/html/2607.29539#bib.bib2)\)’s humanization study: rewriting already\-LLM\-generated text with a separate instruction\-tuned model leaves AUROC unchanged or higher at light intensity for every detector, and even their heaviest setting keeps every detector above AUROC0\.8570\.857, consistent with our ownLLM2Lresults, where an LLM\-mediated second pass over LLM\-origin text produces only a smallΔ\\DeltaTPR@1%FPRrelative toFree\-LLM\(Section[6\.3](https://arxiv.org/html/2607.29539#S6.SS3)\)\. Because their rewriting is applied exclusively to LLM\-origin text, their result cannot indicate whether the same pipeline applied to human\-origin text would reproduce the much sharperH2L\-style degradation we observe;ARB’s matched design is what makes that comparison possible\.

### 7\.3Theoretical and Practical Implications

Theoretical implications\.The core theoretical contribution is reframing paraphrase robustness as a benchmark\-transfer problem rather than a single robustness scalar\. Prior paraphrase\-robustness studies typically report one degradation curve per detector under an increasingly aggressive rewriter\(Krishna et al\.,[2023](https://arxiv.org/html/2607.29539#bib.bib21); Sadasivan et al\.,[2025](https://arxiv.org/html/2607.29539#bib.bib36); Shi et al\.,[2024](https://arxiv.org/html/2607.29539#bib.bib40)\), which conflates two logically independent quantities: how much a rewriting step changes the surface form, and whether the content being rewritten originated from a human or a machine\.ARB’s matched four\-regime design separates these quantities by holding the rewriting instruction and generator fixed while varying only the origin of the input text \(H2Lvs\.LLM2L\)\. This isolates a previously under\-specified property of current detectors and LLMs: detector scores are sensitive to content origin under LLM\-mediated surface, not only to surface distance from the training distribution of direct machine text\. This complements the rewrite\-similarity and edit\-distance mechanisms proposed byHuang et al\. \([2025b](https://arxiv.org/html/2607.29539#bib.bib17)\),Mao et al\. \([2024](https://arxiv.org/html/2607.29539#bib.bib26)\), andHao et al\. \([2025](https://arxiv.org/html/2607.29539#bib.bib14)\)\(Section[7\.1](https://arxiv.org/html/2607.29539#S7.SS1)\) with a classifier\-level demonstration of the same asymmetry, suggesting that content\-origin sensitivity is a structural property of the human\-LLM rewriting relationship rather than an artifact specific to one detection paradigm \(statistical, watermark\-based, or edit\-distance\-based\)\. It also refines the genesis\-based notion framework ofDycke et al\. \([2026](https://arxiv.org/html/2607.29539#bib.bib8)\): our results show empirically, rather than only conceptually, why a fixed genesis label and a fixed detection notion need to be crossed explicitly, since the same nominal “LLM\-involved” text can sit far apart in detectability depending on which side of the human/LLM boundary supplied the original content\.

Practical implications\.These findings have direct consequences for how detectors are selected, evaluated, and deployed\. First, procurement and audit decisions that rely onHumanvs\.Free\-LLMbenchmarks alone \(the current de facto standard reported by most detector papers\) risk substantially overestimating robustness for the increasingly common case of human drafts revised by an LLM, a workflow now standard in academic, journalistic, and professional writing\. A detector that looks strong under direct\-generation testing, such as FastDetectGPT or Binoculars\-falcon\-7b, can lose most of its low\-FPR recall underH2Lwithout any change in its published AUROC on the vendor’s own benchmark\. Second, theH2L–LLM2Lgap gives practitioners a concrete pre\-deployment test: before trusting a detector in a setting where human\-authored, LLM\-polished text is in scope \(e\.g\., plagiarism review, academic integrity, or content\-provenance pipelines\), the detector should be evaluated on anH2L\-style condition specifically, not inferred fromFree\-LLMorLLM2Lresults\. Third, because degradation is uneven across detector families \(RADAR and Binoculars degrade more underH2Lthan under adversarialLLM2L\-style rewriting; BERT/RoBERTa baselines are weak throughout\), a single aggregate leaderboard score is an unreliable basis for tool selection; deployers need regime\-, domain\-, and generator\-stratified numbers of the kindARBreports\. We detail the operating\-point and reporting practices that follow from this in Section[7\.4](https://arxiv.org/html/2607.29539#S7.SS4)\.

### 7\.4Validity and deployment implications

AUROC andTPR@1%FPRcapture different aspects of robustness\. A detector may retain some global ranking ability while recovering few positives at a threshold constrained to misclassify only 1% of human texts, a distinction that matters where false accusations carry fairness costs, including documented bias against non\-native English writers\(Liang et al\.,[2023](https://arxiv.org/html/2607.29539#bib.bib24)\), and that supports recent calls to assess low\-FPR recall or threshold stability rather than treat detector scores as conclusive evidence\(Kirchner et al\.,[2023](https://arxiv.org/html/2607.29539#bib.bib20); Lau and Zubiaga,[2025](https://arxiv.org/html/2607.29539#bib.bib22); Ayoobi et al\.,[2025](https://arxiv.org/html/2607.29539#bib.bib1); Chen et al\.,[2025b](https://arxiv.org/html/2607.29539#bib.bib5); Masrour et al\.,[2025](https://arxiv.org/html/2607.29539#bib.bib27)\)\.

At this operating point, detector families separate clearly, and not always in the direction a paraphrase\-robustness label would suggest\. RADAR, although designed for paraphrase robustness\(Hu et al\.,[2023](https://arxiv.org/html/2607.29539#bib.bib15)\), remains reliable underLLM2Lbut degrades underH2L; this stability underLLM2Lshould be read against its attacker model, since ourFree\-LLM→\\toLLM2Lrewrite is a plain, meaning\-preserving instruction with no detector\-evasion objective, whereas a detector\-in\-the\-loop attack that explicitly selects paraphrase candidates to minimize a target detector’s score drives RADAR’s accuracy from 90\.0% to 45\.4% on the same class of LLM\-generated text\(Huang et al\.,[2025a](https://arxiv.org/html/2607.29539#bib.bib16)\)\. The two results isolate different factors, content origin in our matched design and an explicit adversarial objective in theirs, and together suggest that RADAR’s paraphrase robustness holds for non\-adversarial LLM\-mediated rewriting but not for rewriting optimized against it\. The supervised BERT/RoBERTa baselines provide little utility across regimes, consistent with concerns about distribution shift and benchmark transfer\(Pu et al\.,[2023](https://arxiv.org/html/2607.29539#bib.bib33); Li et al\.,[2024](https://arxiv.org/html/2607.29539#bib.bib23); Schaaff et al\.,[2024](https://arxiv.org/html/2607.29539#bib.bib38)\)and with a broader pattern in which the same backbones reach near\-ceiling in\-domain scores yet degrade sharply once the evaluation distribution shifts\(Mady et al\.,[2026](https://arxiv.org/html/2607.29539#bib.bib25)\); here the shift is content origin under a fixed low\-FPR bar, which BERT\-Defense and RoBERTa\-Defense fail to clear even in theFree\-LLMbaseline\.

Robustness cannot be reduced to detector family alone: the block\-level analyses show substantial dataset effects and less uniform generator effects, in line with evidence that rankings change with domain, generator, task, and metric\(Dugan et al\.,[2024](https://arxiv.org/html/2607.29539#bib.bib7); Wu et al\.,[2024](https://arxiv.org/html/2607.29539#bib.bib48); Pröhl et al\.,[2024](https://arxiv.org/html/2607.29539#bib.bib32); Stowe and Patil,[2026](https://arxiv.org/html/2607.29539#bib.bib41); Baidya et al\.,[2026](https://arxiv.org/html/2607.29539#bib.bib2); Mady et al\.,[2026](https://arxiv.org/html/2607.29539#bib.bib25)\), so aggregate results should be accompanied by stratified diagnostics rather than interpreted as regime\- or domain\-invariant properties\.

These patterns motivate concrete evaluation and deployment practice\. Benchmarks should define the positive class explicitly, reportingFree\-LLM,H2L, andLLM2Lseparately rather than collapsing them into one LLM\-involved class, and should preserve the matched structure of the data: compute regime deltas within dataset×\\timesgenerator blocks, distinguish macro\-averages from pooled estimates, report uncertainty that respects the hierarchy, and retain domain\- and generator\-level diagnostics, aligning with emerging benchmarks centered on robustness, domain shift, and mixed authorship\(Wang et al\.,[2024a](https://arxiv.org/html/2607.29539#bib.bib44); Ayoobi et al\.,[2025](https://arxiv.org/html/2607.29539#bib.bib1); Zha et al\.,[2025](https://arxiv.org/html/2607.29539#bib.bib53)\)\. HoldingTPR@1%FPRat a single, fixed 1% threshold across all regimes, datasets, and generators mirrors an independently converging recommendation to calibrate a decision threshold once on held\-out data and keep it fixed rather than re\-tuned per target distribution, since re\-tuning at test time can otherwise mask the operating\-point trade\-offs that matter for deployment\(Mady et al\.,[2026](https://arxiv.org/html/2607.29539#bib.bib25)\)\. The same distinctions apply in deployment: detector scores are not regime\-invariant evidence of machine authorship, so validation data should reflect the intended use case and include human\-origin revised text whenever it is in scope, and reports should present performance at a prespecified false\-positive constraint, false\-positive behavior on relevant human populations, domain\-specific estimates, and uncertainty\. Given the residual error and distribution sensitivity observed here, detector output is better treated as one uncertain signal than as a stand\-alone basis for high\-stakes authorship judgments\.

### 7\.5Threats to Validity and Limitations

Construct validity\.The benchmark evaluates score separability betweenHumantexts and texts produced or mediated by LLMs\. It does not establish that a detector identifies a single construct such as authorship, intent, originality, plagiarism, or amount of AI assistance\. We mitigate this risk by defining four explicit regimes in terms of content origin and linguistic surface, and by interpreting detector scores as regime\-specific separability estimates rather than as direct authorship judgments\. This distinction is especially important forH2L, where the content is human\-origin but the final linguistic surface is LLM\-mediated\.

Internal validity\.Prompt wording, decoding settings, source preprocessing, and sampling can affect the final text distribution\. We mitigate these risks through fixed prompts, fixed decoding settings, matched source items, generator\-specific blocks, seeded length\-stratified sampling, and a single preprocessing pipeline applied before sampling\. Nevertheless, different rewriting prompts, temperatures, decoding strategies, or preprocessing choices could produce different surface properties\. Residual formatting artifacts or source\-specific cues cannot be ruled out completely\. The same\-generatorLLM2Lcondition controls the second pass within each generator family, but it does not cover cross\-model rewriting, multi\-step rewriting, or human\-edited rewriting\. Because no post\-hoc semantic or length filtering was applied to the released generated texts \(Section[4\.7](https://arxiv.org/html/2607.29539#S4.SS7)\), a small union of 0\.67% of generated texts are atypically short, refusal\-like, or non\-English; at the sample sizes used for block\-level and macro\-averaged estimation, this is expected to contribute negligible additional noise, but it remains a residual source of measurement error at the level of individual scored items\.

Transformation\-strength confounding\.A central limitation is thatH2Linduces stronger surface change than same\-generatorLLM2L\(Token NED0\.6020\.602vs\.0\.3480\.348; Jaccard overlap0\.4630\.463vs\.0\.5870\.587\)\. We mitigate this issue by reporting textual transformation diagnostics and by avoiding a causal claim that source origin alone explains theH2L–LLM2Lgap\. The current design supports a source\-origin\-associated interpretation, but it does not fully disentangle source origin from transformation intensity\. A stronger design would include same\-intensity rewriting conditions or additional controls that explicitly match transformation strength acrossH2LandLLM2L\.

Implementation validity\.Detectors were evaluated using released implementations or paper\-recommended configurations whenever available, with hardware\-driven adjustments only for execution feasibility\. We mitigate implementation bias by keeping each detector configuration fixed across all regimes, datasets, and generator models, so that detector retuning does not confound comparisons amongFree\-LLM,H2L, andLLM2L\. However, implementation details such as maximum observed sequence length, numerical precision, quantization, tokenizer behavior, and library versions can affect detector scores\. The reported results should therefore be interpreted as estimates for the evaluated implementations, not as universal properties of the underlying detector families\.

External validity\.The benchmark uses English texts from XSum, WritingPrompts, and OpenWebText; four open\-weight generator families; and the detector implementations listed in Table[6](https://arxiv.org/html/2607.29539#S5.T6)\. We mitigate over\-specialization by using multiple domains, multiple generator families, and complementary detector families\. However, the results should not be generalized without further evaluation to other languages, longer documents, specialized professional domains, closed\-source generators, multimodal content, or detectors trained specifically onH2Lexamples\. Bilingual evidence from CUDRT indicates that language and operation type are both first\-order factors for detector generalization\(Tao et al\.,[2026](https://arxiv.org/html/2607.29539#bib.bib42)\), so the English\-only scope here is a substantive limitation rather than a minor one\. The dataset choices provide domain diversity, but they are not exhaustive\.

Statistical conclusion validity\.The data are matched at the dataset×\\timesgenerator block level, and regime comparisons share source material within each block\. Treating pooled texts as independent would understate uncertainty and obscure the paired design\. We mitigate this risk by using block\-level estimates, paired deltas within blocks, macro\-averages across blocks, and a block\-structured bootstrap with 5,000 resamples for confidence intervals\. These intervals quantify uncertainty in aggregate estimates, but they do not replace block\-level heterogeneity analysis\. Because multiple detector\-regime comparisons are reported, results should be interpreted as benchmark estimates rather than as isolated null\-hypothesis tests\.

Benchmark realism and deployment representativeness\.H2LandLLM2Lapproximate controlled rewriting workflows, but real users may interact with LLMs iteratively, manually edit outputs, combine multiple models, use different instructions, or mix generated and human\-written passages within a single document\. We mitigate this limitation by operationally varying authorship and surface regimes in a matched design, which is more realistic than direct\-generation\-only evaluation\. However, the benchmark remains a controlled approximation of human–LLM writing workflows rather than an observational study of real\-world writing behavior\.

### 7\.6Ethical Considerations

This work is intended to improve the evaluation of AI\-text detectors and to reduce overconfident deployment under distribution shift\. The benchmark involves generation and rewriting procedures that could also be interpreted as evasion\-relevant\. We mitigate this dual\-use risk by framing rewriting as an evaluation condition, reporting detector\-side implications, and avoiding operational guidance for bypassing deployed systems\.ARB’s scope is therefore narrower than dedicated evasion research: unlike gradient\-based evaders explicitly optimized against a victim detector and demonstrated against deployed commercial systems\(Meng et al\.,[2025](https://arxiv.org/html/2607.29539#bib.bib28)\), ourH2LandLLM2Lrewrites use a single fixed, non\-adversarial instruction with no detector in the loop, and we do not target or report evasion rates against any specific product\. The study uses existing public datasets and locally generated text variants; no human subjects or user studies are involved\. The releasedARBassets are intended for scientific benchmarking, auditing, and robustness evaluation rather than for high\-stakes authorship accusations or operational bypassing of deployed systems\. Dataset licenses and provenance are documented in the released artifacts\.

## 8Conclusion

This paper presented a matched quantitative benchmark of AI\-text detectors across authorship and rewriting regimes\.ARBoperationally contrastsHuman,Free\-LLM,H2L, and same\-generatorLLM2Lunder a benchmark\-transfer design\. The study evaluates existing detectors as objects of benchmarking and reportsTPR@1%FPR, AUROC, paired deltas, and operationalH2L–LLM2Lgaps over dataset×\\timesgenerator blocks\.

The results show that performance estimated under the standardHumanvs\.Free\-LLMcondition does not necessarily transfer toH2L\. FastDetectGPT, Binoculars\-falcon\-7b, and RADAR perform well on direct LLM generation and remain substantially closer to that baseline underLLM2L, but lose much more low\-FPR recall underH2L\. BERT\-Defense and RoBERTa\-Defense remain weak atTPR@1%FPRacross regimes\. The comparison betweenH2LandLLM2Lsuggests that rewriting alone does not fully explain the degradation; source origin and transformation strength both plausibly contribute to the gap \(Section[7\.1](https://arxiv.org/html/2607.29539#S7.SS1)\)\.

These findings support detector evaluations that include human\-origin rewriting, same\-generator second\-pass controls, block\-level paired deltas, domain and generator breakdowns, and low false\-positive operating points in addition to AUROC\. This recommendation is consistent with recent benchmark work emphasizing mixed\-authorship text, humanization, detector stability, and metric sensitivity\(Wang et al\.,[2024a](https://arxiv.org/html/2607.29539#bib.bib44); Masrour et al\.,[2025](https://arxiv.org/html/2607.29539#bib.bib27); Ayoobi et al\.,[2025](https://arxiv.org/html/2607.29539#bib.bib1); Stowe and Patil,[2026](https://arxiv.org/html/2607.29539#bib.bib41)\)\. The results also support a more precise deployment vocabulary: direct machine generation and LLM\-mediated rewriting are not equivalent detection targets\.

Future work should extendARBalong three main directions\. First, stronger causal isolation of source origin requires same\-intensity rewriting controls, in whichH2LandLLM2Lare matched not only by the source item and the generator block but also by the transformation strength\. Second, broader external validation should include additional languages, longer documents, specialized professional domains, closed\-source generators, cross\-model rewriting, and mixed\-authorship documents with paragraph\- or sentence\-level attribution\. Third, future detector evaluations should test whether detectors trained or calibrated onH2Lexamples generalize to unseen rewriting styles, domains, and generators, rather than only improving on the specific benchmark distribution\.

## Declaration of Generative AI and AI\-assisted Technologies in the Writing Process

During the preparation of this work, the authors used generative AI and AI\-assisted writing tools to support language editing, improve readability, and refine the manuscript’s academic presentation\. These tools were used for wording, grammar, stylistic revision, and organizing explanatory text\.

Generative AI tools were also used to assist with non\-substantive drafting support, such as improving section transitions, clarifying methodological descriptions, and formatting parts of the manuscript\. They were not used to generate the experimental results, detector scores, statistical estimates, tables, or figures reported in the study\. The benchmark construction, detector evaluation, metric computation, bootstrap analysis, and interpretation of results were conducted and verified by the authors\.

All AI\-assisted content was reviewed, edited, and validated by the authors to ensure accuracy, consistency with the experimental evidence, and alignment with the paper’s claims\. The authors take full responsibility for the content of the manuscript\.

## Data Availability

The text dataset underlyingARBis publicly released on Hugging Face111The url will be inserted after the anonymized review process

The public release contains all four regimes used in the benchmark \(Human,Free\-LLM,H2L, andLLM2L\) and is distributed as a Hugging Face\-compatible Parquet dataset that can be loaded directly with thedatasetslibrary\. Each released row corresponds to one text sample and includes stable identifiers, the text, regime labels, content\-origin and surface\-origin labels, source\-dataset provenance, generator\-model metadata, source and pairing indices, a normalized\-text SHA\-256 hash, and word\-count metadata\. The release exposes the fieldsid,text,label,label\_id,regime,source\_dataset,source\_dataset\_short,generator\_model,source\_index,pair\_id,text\_sha256, andword\_count\.

The releasedARBtext collection is derived from XSum, WritingPrompts, and OpenWebText, and includes rewrites produced by Gemma 2 9B, Llama 3\.2 3B, Mistral 7B, and Qwen2\.5 7B\. The source code for data processing, evaluation, and figure/table reproduction is released separately in the Git repository \([https://anonymous\.4open\.science/r/arb\-0E1C/](https://anonymous.4open.science/r/arb-0E1C/)\)\. The public dataset and repository jointly provide the text samples, pairing metadata, detector scores, block\-level metrics, configuration files, and reproduction scripts required to reproduce the analyses reported in this paper\. The configuration files are fixed using theHydraPython configuration framework\(Yadan,[2019](https://arxiv.org/html/2607.29539#bib.bib51)\)\. The framework ensures reproducible, explicit settings for the dataset, generator, detector, decoding, and bootstrap\.

The dataset is released under the Apache License 2\.0, with the caveat that users remain responsible for respecting the licenses and usage terms of the original source datasets \(XSum, WritingPrompts, and OpenWebText; licensing details for each are reported in Section[4\.7](https://arxiv.org/html/2607.29539#S4.SS7)\)\.

## References

- Ayoobi et al\. \(2025\)Ayoobi, N\., Shahriar, S\., Mukherjee, A\. \(2025\)\.Beyond Easy Wins: A Text Hardness\-Aware Benchmark for LLM\-generated Text Detection\.\[Preprint\]\. arXiv\.[https://doi\.org/10\.48550/arXiv\.2507\.15286](https://doi.org/10.48550/arXiv.2507.15286)\.
- Baidya et al\. \(2026\)Baidya, M\.S\., Baidya, S\.S\., Chawla, C\. \(2026\)\.Detecting the Machine: A Comprehensive Benchmark of AI\-Generated Text Detectors Across Architectures, Domains, and Adversarial Conditions\.\[Preprint\]\. arXiv\.[https://doi\.org/10\.48550/arXiv\.2603\.17522](https://doi.org/10.48550/arXiv.2603.17522)\.
- Bao et al\. \(2024\)Bao, G\., Zhao, Y\., Teng, Z\., Yang, L\., Zhang, Y\. \(2024\)\.Fast\-DetectGPT: Efficient Zero\-Shot Detection of Machine\-Generated Text via Conditional Probability Curvature, in: The Twelfth International Conference on Learning Representations\.
- Chen et al\. \(2025a\)Chen, Z\., Feng, Y\., He, C\., Deng, Y\., Pu, H\., Li, B\. \(2025a\)\.IPAD: Inverse Prompt for AI Detection – A Robust and Explainable LLM\-Generated Text Detector\.\[Preprint\]\. arXiv\.[https://doi\.org/10\.48550/arXiv\.2502\.15902](https://doi.org/10.48550/arXiv.2502.15902)\.
- Chen et al\. \(2025b\)Chen, Z\., He, K\., Huang, Y\., Zhu, Y\., Feng, M\. \(2025b\)\.DivScore: Zero\-Shot Detection of LLM\-Generated Text in Specialized Domains, in: Christodoulopoulos, C\., Chakraborty, T\., Rose, C\., Peng, V\. \(Eds\.\), Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing, Association for Computational Linguistics, Suzhou, China\. pp\. 19231–19253\.[https://doi\.org/10\.18653/v1/2025\.emnlp\-main\.971](https://doi.org/10.18653/v1/2025.emnlp-main.971)\.
- Chung et al\. \(2023\)Chung, J\., Kamar, E\., Amershi, S\. \(2023\)\.Increasing Diversity While Maintaining Accuracy: Text Data Generation with Large Language Models and Human Interventions, in: Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\), Association for Computational Linguistics, Toronto, Canada\. pp\. 575–593\.[https://doi\.org/10\.18653/v1/2023\.acl\-long\.34](https://doi.org/10.18653/v1/2023.acl-long.34)\.
- Dugan et al\. \(2024\)Dugan, L\., Hwang, A\., Trhlik, F\., Ludan, J\.M\., Zhu, A\., Xu, H\., Ippolito, D\., Callison\-Burch, C\. \(2024\)\.RAID: A Shared Benchmark for Robust Evaluation of Machine\-Generated Text Detectors, in: Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\), Association for Computational Linguistics, Bangkok, Thailand\. pp\. 12463–12492\.[https://doi\.org/10\.18653/v1/2024\.acl\-long\.674](https://doi.org/10.18653/v1/2024.acl-long.674)\.
- Dycke et al\. \(2026\)Dycke, N\., Sakharova, M\., Daheim, N\., Gurevych, I\. \(2026\)\.’Your AI Text is not Mine’: Redefining and Evaluating AI\-generated Text Detection under Realistic Assumptions\.\[Preprint\]\. arXiv\.[https://doi\.org/10\.48550/arXiv\.2606\.04906](https://doi.org/10.48550/arXiv.2606.04906)\.
- Fan et al\. \(2018\)Fan, A\., Lewis, M\., Dauphin, Y\. \(2018\)\.Hierarchical Neural Story Generation, in: Gurevych, I\., Miyao, Y\. \(Eds\.\), Proceedings of the 56th Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\), Association for Computational Linguistics, Melbourne, Australia\. pp\. 889–898\.[https://doi\.org/10\.18653/v1/P18\-1082](https://doi.org/10.18653/v1/P18-1082)\.
- Gehrmann et al\. \(2019\)Gehrmann, S\., Strobelt, H\., Rush, A\.M\. \(2019\)\.GLTR: Statistical Detection and Visualization of Generated Text, in: Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics: System Demonstrations, Association for Computational Linguistics, Florence, Italy\. pp\. 111–116\.[https://doi\.org/10\.18653/v1/P19\-3019](https://doi.org/10.18653/v1/P19-3019)\.
- Gokaslan et al\. \(2019\)Gokaslan, A\., Cohen, V\., Pavlick, E\., Tellex, S\. \(2019\)\.OpenWebText Corpus\.[http://Skylion007\.github\.io/OpenWebTextCorpus](http://skylion007.github.io/OpenWebTextCorpus)\.
- Grattafiori et al\. \(2024\)Grattafiori, A\., Dubey, A\., Jauhri, A\., Pandey, A\., Kadian, A\., Al\-Dahle, A\., Letman, A\., Mathur, A\., Schelten, A\., Vaughan, A\., Yang, A\., Fan, A\., Goyal, A\., Hartshorn, A\., Yang, A\., Mitra, A\., Sravankumar, A\., Korenev, A\., Hinsvark, A\., Rao, A\., Zhang, A\., Rodriguez, A\., Gregerson, A\., Spataru, A\., Roziere, B\., Biron, B\., Tang, B\., Chern, B\., Caucheteux, C\., Nayak, C\., Bi, C\., Marra, C\., McConnell, C\., Keller, C\., Touret, C\., Wu, C\., Wong, C\., Ferrer, C\.C\., Nikolaidis, C\., Allonsius, D\., Song, D\., Pintz, D\., Livshits, D\., Wyatt, D\., Esiobu, D\., Choudhary, D\., Mahajan, D\., Garcia\-Olano, D\., Perino, D\., Hupkes, D\., Lakomkin, E\., AlBadawy, E\., Lobanova, E\., Dinan, E\., Smith, E\.M\., Radenovic, F\., Guzmán, F\., Zhang, F\., Synnaeve, G\., Lee, G\., Anderson, G\.L\., Thattai, G\., Nail, G\., Mialon, G\., Pang, G\., Cucurell, G\., Nguyen, H\., Korevaar, H\., Xu, H\., Touvron, H\., Zarov, I\., Ibarra, I\.A\., Kloumann, I\., Misra, I\., Evtimov, I\., Zhang, J\., Copet, J\., Lee, J\., Geffert, J\., Vranes, J\., Park, J\., Mahadeokar, J\., Shah, J\., van der Linde, J\., Billock, J\., Hong, J\., Lee, J\., Fu, J\., Chi, J\., Huang, J\., Liu, J\., Wang, J\., Yu, J\., Bitton, J\., Spisak, J\., Park, J\., Rocca, J\., Johnstun, J\., Saxe, J\., Jia, J\., Alwala, K\.V\., Prasad, K\., Upasani, K\., Plawiak, K\., Li, K\., Heafield, K\., Stone, K\., El\-Arini, K\., Iyer, K\., Malik, K\., Chiu, K\., Bhalla, K\., Lakhotia, K\., Rantala\-Yeary, L\., van der Maaten, L\., Chen, L\., Tan, L\., Jenkins, L\., Martin, L\., Madaan, L\., Malo, L\., Blecher, L\., Landzaat, L\., de Oliveira, L\., Muzzi, M\., Pasupuleti, M\., Singh, M\., Paluri, M\., Kardas, M\., Tsimpoukelli, M\., Oldham, M\., Rita, M\., Pavlova, M\., Kambadur, M\., Lewis, M\., Si, M\., Singh, M\.K\., Hassan, M\., Goyal, N\., Torabi, N\., Bashlykov, N\., Bogoychev, N\., Chatterji, N\., Zhang, N\., Duchenne, O\., Çelebi, O\., Alrassy, P\., Zhang, P\., Li, P\., Vasic, P\., Weng, P\., Bhargava, P\., Dubal, P\., Krishnan, P\., Koura, P\.S\., Xu, P\., He, Q\., Dong, Q\., Srinivasan, R\., Ganapathy, R\., Calderer, R\., Cabral, R\.S\., Stojnic, R\., Raileanu, R\., Maheswari, R\., Girdhar, R\., Patel, R\., Sauvestre, R\., Polidoro, R\., Sumbaly, R\., Taylor, R\., Silva, R\., Hou, R\., Wang, R\., Hosseini, S\., Chennabasappa, S\., Singh, S\., Bell, S\., Kim, S\.S\., Edunov, S\., Nie, S\., Narang, S\., Raparthy, S\., Shen, S\., Wan, S\., Bhosale, S\., Zhang, S\., Vandenhende, S\., Batra, S\., Whitman, S\., Sootla, S\., Collot, S\., Gururangan, S\., Borodinsky, S\., Herman, T\., Fowler, T\., Sheasha, T\., Georgiou, T\., Scialom, T\., Speckbacher, T\., Mihaylov, T\., Xiao, T\., Karn, U\., Goswami, V\., Gupta, V\., Ramanathan, V\., Kerkez, V\., Gonguet, V\., Do, V\., Vogeti, V\., Albiero, V\., Petrovic, V\., Chu, W\., Xiong, W\., Fu, W\., Meers, W\., Martinet, X\., Wang, X\., Wang, X\., Tan, X\.E\., Xia, X\., Xie, X\., Jia, X\., Wang, X\., Goldschlag, Y\., Gaur, Y\., Babaei, Y\., Wen, Y\., Song, Y\., Zhang, Y\., Li, Y\., Mao, Y\., Coudert, Z\.D\., Yan, Z\., Chen, Z\., Papakipos, Z\., Singh, A\., Srivastava, A\., Jain, A\., Kelsey, A\., Shajnfeld, A\., Gangidi, A\., Victoria, A\., Goldstand, A\., Menon, A\., Sharma, A\., Boesenberg, A\., Baevski, A\., Feinstein, A\., Kallet, A\., Sangani, A\., Teo, A\., Yunus, A\., Lupu, A\., Alvarado, A\., Caples, A\., Gu, A\., Ho, A\., Poulton, A\., Ryan, A\., Ramchandani, A\., Dong, A\., Franco, A\., Goyal, A\., Saraf, A\., Chowdhury, A\., Gabriel, A\., Bharambe, A\., Eisenman, A\., Yazdan, A\., James, B\., Maurer, B\., Leonhardi, B\., Huang, B\., Loyd, B\., Paola, B\.D\., Paranjape, B\., Liu, B\., Wu, B\., Ni, B\., Hancock, B\., Wasti, B\., Spence, B\., Stojkovic, B\., Gamido, B\., Montalvo, B\., Parker, C\., Burton, C\., Mejia, C\., Liu, C\., Wang, C\., Kim, C\., Zhou, C\., Hu, C\., Chu, C\.H\., Cai, C\., Tindal, C\., Feichtenhofer, C\., Gao, C\., Civin, D\., Beaty, D\., Kreymer, D\., Li, D\., Adkins, D\., Xu, D\., Testuggine, D\., David, D\., Parikh, D\., Liskovich, D\., Foss, D\., Wang, D\., Le, D\., Holland, D\., Dowling, E\., Jamil, E\., Montgomery, E\., Presani, E\., Hahn, E\., Wood, E\., Le, E\.T\., Brinkman, E\., Arcaute, E\., Dunbar, E\., Smothers, E\., Sun, F\., Kreuk, F\., Tian, F\., Kokkinos, F\., Ozgenel, F\., Caggioni, F\., Kanayet, F\., Seide, F\., Florez, G\.M\., Schwarz, G\., Badeer, G\., Swee, G\., Halpern, G\., Herman, G\., Sizov, G\., Guangyi, Zhang, Lakshminarayanan, G\., Inan, H\., Shojanazeri, H\., Zou, H\., Wang, H\., Zha, H\., Habeeb, H\., Rudolph, H\., Suk, H\., Aspegren, H\., Goldman, H\., Zhan, H\., Damlaj, I\., Molybog, I\., Tufanov, I\., Leontiadis, I\., Veliche, I\.E\., Gat, I\., Weissman, J\., Geboski, J\., Kohli, J\., Lam, J\., Asher, J\., Gaya, J\.B\., Marcus, J\., Tang, J\., Chan, J\., Zhen, J\., Reizenstein, J\., Teboul, J\., Zhong, J\., Jin, J\., Yang, J\., Cummings, J\., Carvill, J\., Shepard, J\., McPhie, J\., Torres, J\., Ginsburg, J\., Wang, J\., Wu, K\., U, K\.H\., Saxena, K\., Khandelwal, K\., Zand, K\., Matosich, K\., Veeraraghavan, K\., Michelena, K\., Li, K\., Jagadeesh, K\., Huang, K\., Chawla, K\., Huang, K\., Chen, L\., Garg, L\., A, L\., Silva, L\., Bell, L\., Zhang, L\., Guo, L\., Yu, L\., Moshkovich, L\., Wehrstedt, L\., Khabsa, M\., Avalani, M\., Bhatt, M\., Mankus, M\., Hasson, M\., Lennie, M\., Reso, M\., Groshev, M\., Naumov, M\., Lathi, M\., Keneally, M\., Liu, M\., Seltzer, M\.L\., Valko, M\., Restrepo, M\., Patel, M\., Vyatskov, M\., Samvelyan, M\., Clark, M\., Macey, M\., Wang, M\., Hermoso, M\.J\., Metanat, M\., Rastegari, M\., Bansal, M\., Santhanam, N\., Parks, N\., White, N\., Bawa, N\., Singhal, N\., Egebo, N\., Usunier, N\., Mehta, N\., Laptev, N\.P\., Dong, N\., Cheng, N\., Chernoguz, O\., Hart, O\., Salpekar, O\., Kalinli, O\., Kent, P\., Parekh, P\., Saab, P\., Balaji, P\., Rittner, P\., Bontrager, P\., Roux, P\., Dollar, P\., Zvyagina, P\., Ratanchandani, P\., Yuvraj, P\., Liang, Q\., Alao, R\., Rodriguez, R\., Ayub, R\., Murthy, R\., Nayani, R\., Mitra, R\., Parthasarathy, R\., Li, R\., Hogan, R\., Battey, R\., Wang, R\., Howes, R\., Rinott, R\., Mehta, S\., Siby, S\., Bondu, S\.J\., Datta, S\., Chugh, S\., Hunt, S\., Dhillon, S\., Sidorov, S\., Pan, S\., Mahajan, S\., Verma, S\., Yamamoto, S\., Ramaswamy, S\., Lindsay, S\., Lindsay, S\., Feng, S\., Lin, S\., Zha, S\.C\., Patil, S\., Shankar, S\., Zhang, S\., Zhang, S\., Wang, S\., Agarwal, S\., Sajuyigbe, S\., Chintala, S\., Max, S\., Chen, S\., Kehoe, S\., Satterfield, S\., Govindaprasad, S\., Gupta, S\., Deng, S\., Cho, S\., Virk, S\., Subramanian, S\., Choudhury, S\., Goldman, S\., Remez, T\., Glaser, T\., Best, T\., Koehler, T\., Robinson, T\., Li, T\., Zhang, T\., Matthews, T\., Chou, T\., Shaked, T\., Vontimitta, V\., Ajayi, V\., Montanez, V\., Mohan, V\., Kumar, V\.S\., Mangla, V\., Ionescu, V\., Poenaru, V\., Mihailescu, V\.T\., Ivanov, V\., Li, W\., Wang, W\., Jiang, W\., Bouaziz, W\., Constable, W\., Tang, X\., Wu, X\., Wang, X\., Wu, X\., Gao, X\., Kleinman, Y\., Chen, Y\., Hu, Y\., Jia, Y\., Qi, Y\., Li, Y\., Zhang, Y\., Zhang, Y\., Adi, Y\., Nam, Y\., Yu, Wang, Zhao, Y\., Hao, Y\., Qian, Y\., Li, Y\., He, Y\., Rait, Z\., DeVito, Z\., Rosnbrick, Z\., Wen, Z\., Yang, Z\., Zhao, Z\., Ma, Z\. \(2024\)\.The Llama 3 Herd of Models\.\[Preprint\]\. arXiv\.[https://doi\.org/10\.48550/arXiv\.2407\.21783](https://doi.org/10.48550/arXiv.2407.21783)\.
- Hans et al\. \(2024\)Hans, A\., Schwarzschild, A\., Cherepanova, V\., Kazemi, H\., Saha, A\., Goldblum, M\., Geiping, J\., Goldstein, T\. \(2024\)\.Spotting LLMs with Binoculars: Zero\-Shot Detection of Machine\-Generated Text, in: Proceedings of the 41st International Conference on Machine Learning, PMLR\. pp\. 17519–17537\.[https://proceedings\.mlr\.press/v235/hans24a\.html](https://proceedings.mlr.press/v235/hans24a.html)\.
- Hao et al\. \(2025\)Hao, W\., Li, R\., Zhao, W\., Yang, J\., Mao, C\. \(2025\)\.Learning to Rewrite: Generalized LLM\-Generated Text Detection, in: Che, W\., Nabende, J\., Shutova, E\., Pilehvar, M\.T\. \(Eds\.\), Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\), Association for Computational Linguistics, Vienna, Austria\. pp\. 6421–6434\.[https://doi\.org/10\.18653/v1/2025\.acl\-long\.322](https://doi.org/10.18653/v1/2025.acl-long.322)\.
- Hu et al\. \(2023\)Hu, X\., Chen, P\.Y\., Ho, T\.Y\. \(2023\)\.RADAR: Robust AI\-text Detection via Adversarial Learning, in: Proceedings of the 37th International Conference on Neural Information Processing Systems, Curran Associates Inc\., Red Hook, NY, USA\. pp\. 15077–15095\.
- Huang et al\. \(2025a\)Huang, J\., Zhang, R\., Su, J\., Chen, Y\. \(2025a\)\.TempParaphraser: “Heating Up” Text to Evade AI\-Text Detection through Paraphrasing, in: Christodoulopoulos, C\., Chakraborty, T\., Rose, C\., Peng, V\. \(Eds\.\), Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing, Association for Computational Linguistics, Suzhou, China\. pp\. 31554–31573\.[https://doi\.org/10\.18653/v1/2025\.emnlp\-main\.1607](https://doi.org/10.18653/v1/2025.emnlp-main.1607)\.
- Huang et al\. \(2025b\)Huang, Y\., Cao, J\., Luo, H\., Guan, X\., Liu, B\. \(2025b\)\.MAGRET: Machine\-generated Text Detection with Rewritten Texts, in: Rambow, O\., Wanner, L\., Apidianaki, M\., Al\-Khalifa, H\., Eugenio, B\.D\., Schockaert, S\. \(Eds\.\), Proceedings of the 31st International Conference on Computational Linguistics, Association for Computational Linguistics, Abu Dhabi, UAE\. pp\. 8336–8346\.[https://aclanthology\.org/2025\.coling\-main\.557/](https://aclanthology.org/2025.coling-main.557/)\.
- Ippolito et al\. \(2020\)Ippolito, D\., Duckworth, D\., Callison\-Burch, C\., Eck, D\. \(2020\)\.Automatic Detection of Generated Text is Easiest when Humans are Fooled, in: Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, Association for Computational Linguistics, Online\. pp\. 1808–1822\.[https://doi\.org/10\.18653/v1/2020\.acl\-main\.164](https://doi.org/10.18653/v1/2020.acl-main.164)\.
- Jiang et al\. \(2023\)Jiang, A\.Q\., Sablayrolles, A\., Mensch, A\., Bamford, C\., Chaplot, D\.S\., de las Casas, D\., Bressand, F\., Lengyel, G\., Lample, G\., Saulnier, L\., Lavaud, L\.R\., Lachaux, M\.A\., Stock, P\., Le Scao, T\., Lavril, T\., Wang, T\., Lacroix, T\., El Sayed, W\. \(2023\)\.Mistral 7B\.\[Preprint\]\. arXiv\.[https://doi\.org/10\.48550/arXiv\.2310\.06825](https://doi.org/10.48550/arXiv.2310.06825)\.
- Kirchner et al\. \(2023\)Kirchner, J\.H\., Ahmad, L\., Aaronson, S\., Leike, J\. \(2023\)\.New AI classifier for indicating AI\-written text\.[https://openai\.com/index/new\-ai\-classifier\-for\-indicating\-ai\-written\-text/](https://openai.com/index/new-ai-classifier-for-indicating-ai-written-text/)\.Accessed: 16\-Apr\-2025\.
- Krishna et al\. \(2023\)Krishna, K\., Song, Y\., Karpinska, M\., Wieting, J\., Iyyer, M\. \(2023\)\.Paraphrasing evades detectors of AI\-generated text, but retrieval is an effective defense, in: Proceedings of the 37th International Conference on Neural Information Processing Systems, Curran Associates Inc\., Red Hook, NY, USA\. pp\. 27469–27500\.
- Lau and Zubiaga \(2025\)Lau, H\.T\., Zubiaga, A\. \(2025\)\.Understanding the effects of human\-written paraphrases in LLM\-generated text detection\.Natural Language Processing Journal 11, 100151\.[https://doi\.org/https://doi\.org/10\.1016/j\.nlp\.2025\.100151](https://doi.org/https://doi.org/10.1016/j.nlp.2025.100151)\.
- Li et al\. \(2024\)Li, Y\., Li, Q\., Cui, L\., Bi, W\., Wang, Z\., Wang, L\., Yang, L\., Shi, S\., Zhang, Y\. \(2024\)\.MAGE: Machine\-generated Text Detection in the Wild, in: Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\), Association for Computational Linguistics, Bangkok, Thailand\. pp\. 36–53\.[https://doi\.org/10\.18653/v1/2024\.acl\-long\.3](https://doi.org/10.18653/v1/2024.acl-long.3)\.
- Liang et al\. \(2023\)Liang, W\., Yuksekgonul, M\., Mao, Y\., Wu, E\., Zou, J\. \(2023\)\.GPT detectors are biased against non\-native English writers\.Patterns 4, 100779\.[https://doi\.org/https://doi\.org/10\.1016/j\.patter\.2023\.100779](https://doi.org/https://doi.org/10.1016/j.patter.2023.100779)\.
- Mady et al\. \(2026\)Mady, M\., Reschke, J\., Schuller, B\. \(2026\)\.Feature\-Augmented Transformers for Robust AI\-Text Detection Across Domains and Generators\.\[Preprint\]\. arXiv\.[https://doi\.org/10\.48550/arXiv\.2605\.03969](https://doi.org/10.48550/arXiv.2605.03969)\.
- Mao et al\. \(2024\)Mao, C\., Vondrick, C\., Wang, H\., Yang, J\. \(2024\)\.RAIDAR: generative AI detection via rewriting\.\[Preprint\]\. arXiv\.[https://doi\.org/10\.48550/arXiv\.2401\.12970](https://doi.org/10.48550/arXiv.2401.12970)\.
- Masrour et al\. \(2025\)Masrour, E\., Emi, B\.N\., Spero, M\. \(2025\)\.DAMAGE: Detecting Adversarially Modified AI Generated Text, in: Alam, F\., Nakov, P\., Habash, N\., Gurevych, I\., Chowdhury, S\., Shelmanov, A\., Wang, Y\., Artemova, E\., Kutlu, M\., Mikros, G\. \(Eds\.\), Proceedings of the 1st Workshop on GenAI Content Detection \(GenAIDetect\), International Conference on Computational Linguistics, Abu Dhabi, UAE\. pp\. 120–133\.[https://aclanthology\.org/2025\.genaidetect\-1\.9/](https://aclanthology.org/2025.genaidetect-1.9/)\.
- Meng et al\. \(2025\)Meng, W\., Fan, S\., Wei, C\., Chen, M\., Li, Y\., Zhang, Y\., Zhang, Z\., Chen, W\. \(2025\)\.GradEscape: A Gradient\-Based Evader Against AI\-Generated Text Detectors, in: 34th USENIX Security Symposium \(USENIX Security 25\), USENIX Association, Seattle, WA\. pp\. 181–200\.[https://www\.usenix\.org/conference/usenixsecurity25/presentation/meng](https://www.usenix.org/conference/usenixsecurity25/presentation/meng)\.
- Mesnard et al\. \(2024\)Mesnard, T\., Hardin, C\., Dadashi, R\., Bhupatiraju, S\., Pathak, S\., Sifre, L\., Rivière, M\., Kale, M\.S\., Love, J\., Tafti, P\., Hussenot, L\., Sessa, P\.G\., Chowdhery, A\., Roberts, A\., Barua, A\., Botev, A\., Castro\-Ros, A\., Slone, A\., Héliou, A\., Tacchetti, A\., Bulanova, A\., Paterson, A\., Tsai, B\., Shahriari, B\., Lan, C\.L\., Choquette\-Choo, C\.A\., Crepy, C\., Cer, D\., Ippolito, D\., Reid, D\., Buchatskaya, E\., Ni, E\., Noland, E\., Yan, G\., Tucker, G\., Muraru, G\.C\., Rozhdestvenskiy, G\., Michalewski, H\., Tenney, I\., Grishchenko, I\., Austin, J\., Keeling, J\., Labanowski, J\., Lespiau, J\.B\., Stanway, J\., Brennan, J\., Chen, J\., Ferret, J\., Chiu, J\., Mao\-Jones, J\., Lee, K\., Yu, K\., Millican, K\., Sjoesund, L\.L\., Lee, L\., Dixon, L\., Reid, M\., Mikuła, M\., Wirth, M\., Sharman, M\., Chinaev, N\., Thain, N\., Bachem, O\., Chang, O\., Wahltinez, O\., Bailey, P\., Michel, P\., Yotov, P\., Chaabouni, R\., Comanescu, R\., Jana, R\., Anil, R\., McIlroy, R\., Liu, R\., Mullins, R\., Smith, S\.L\., Borgeaud, S\., Girgin, S\., Douglas, S\., Pandya, S\., Shakeri, S\., De, S\., Klimenko, T\., Hennigan, T\., Feinberg, V\., Stokowiec, W\., hui Chen, Y\., Ahmed, Z\., Gong, Z\., Warkentin, T\., Peran, L\., Giang, M\., Farabet, C\., Vinyals, O\., Dean, J\., Kavukcuoglu, K\., Hassabis, D\., Ghahramani, Z\., Eck, D\., Barral, J\., Pereira, F\., Collins, E\., Joulin, A\., Fiedel, N\., Senter, E\., Andreev, A\., Kenealy, K\. \(2024\)\.Gemma: Open Models Based on Gemini Research and Technology\.\[Preprint\]\. arXiv\.[https://doi\.org/10\.48550/arXiv\.2403\.08295](https://doi.org/10.48550/arXiv.2403.08295)\.
- Mitchell et al\. \(2023\)Mitchell, E\., Lee, Y\., Khazatsky, A\., Manning, C\.D\., Finn, C\. \(2023\)\.DetectGPT: Zero\-Shot Machine\-Generated Text Detection Using Probability Curvature, in: Proceedings of the 40th International Conference on Machine Learning, PMLR\. pp\. 24950–24962\.[https://proceedings\.mlr\.press/v202/mitchell23a\.html](https://proceedings.mlr.press/v202/mitchell23a.html)\.
- Narayan et al\. \(2018\)Narayan, S\., Cohen, S\.B\., Lapata, M\. \(2018\)\.Don’t Give Me the Details, Just the Summary\! Topic\-Aware Convolutional Neural Networks for Extreme Summarization, in: Riloff, E\., Chiang, D\., Hockenmaier, J\., Tsujii, J\. \(Eds\.\), Proceedings of the 2018 Conference on Empirical Methods in Natural Language Processing, Association for Computational Linguistics, Brussels, Belgium\. pp\. 1797–1807\.[https://doi\.org/10\.18653/v1/D18\-1206](https://doi.org/10.18653/v1/D18-1206)\.
- Pröhl et al\. \(2024\)Pröhl, T\., Putzier, E\., Zarnekow, R\. \(2024\)\.Benchmarking of LLM Detection: Comparing Two Competing Approaches\.\[Preprint\]\. arXiv\.[https://doi\.org/10\.48550/arXiv\.2406\.11670](https://doi.org/10.48550/arXiv.2406.11670)\.
- Pu et al\. \(2023\)Pu, J\., Sarwar, Z\., Abdullah, S\.M\., Rehman, A\., Kim, Y\., Bhattacharya, P\., Javed, M\., Viswanath, B\. \(2023\)\.Deepfake Text Detection: Limitations and Opportunities, in: 2023 IEEE Symposium on Security and Privacy \(SP\), IEEE Computer Society, Los Alamitos, CA, USA\. pp\. 1613–1630\.[https://doi\.org/10\.1109/SP46215\.2023\.10179387](https://doi.org/10.1109/SP46215.2023.10179387)\.
- Qwen Team et al\. \(2024\)Qwen Team, Yang, A\., Yang, B\., Zhang, B\., Hui, B\., Zheng, B\., Yu, B\., Liu, D\., Huang, F\., Wei, H\., Lin, H\., Zhou, J\. \(2024\)\.Qwen2\.5 Technical Report\.\[Preprint\]\. arXiv\.[https://doi\.org/10\.48550/arXiv\.2412\.15115](https://doi.org/10.48550/arXiv.2412.15115)\.
- Ranganath and Ramesh \(2026\)Ranganath, S\., Ramesh, A\. \(2026\)\.StealthRL: Reinforcement Learning Paraphrase Attacks for Multi\-Detector Evasion of AI\-Text Detectors\.\[Preprint\]\. arXiv\.[https://doi\.org/10\.48550/arXiv\.2602\.08934](https://doi.org/10.48550/arXiv.2602.08934)\.
- Sadasivan et al\. \(2025\)Sadasivan, V\.S\., Kumar, A\., Balasubramanian, S\., Wang, W\., Feizi, S\. \(2025\)\.Can AI\-Generated Text be Reliably Detected? Stress Testing AI Text Detectors Under Various Attacks\.\[Preprint\]\. arXiv\.[https://doi\.org/10\.48550/arXiv\.2303\.11156](https://doi.org/10.48550/arXiv.2303.11156)\.
- Sahoo et al\. \(2024\)Sahoo, P\., Singh, A\.K\., Saha, S\., Jain, V\., Mondal, S\., Chadha, A\. \(2024\)\.A Systematic Survey of Prompt Engineering in Large Language Models: Techniques and Applications\.\[Preprint\]\. arXiv\.[https://doi\.org/10\.48550/arXiv\.2402\.07927](https://doi.org/10.48550/arXiv.2402.07927)\.
- Schaaff et al\. \(2024\)Schaaff, K\., Schlippe, T\., Mindner, L\. \(2024\)\.Classification of human\- and AI\-generated texts for different languages and domains\.International Journal of Speech Technology 27, 935–956\.[https://doi\.org/10\.1007/s10772\-024\-10143\-3](https://doi.org/10.1007/s10772-024-10143-3)\.
- Schulhoff et al\. \(2024\)Schulhoff, S\., Ilie, M\., Balepur, N\., Kahadze, K\., Liu, A\., Si, C\., Li, Y\., Gupta, A\., Han, H\., Schulhoff, S\., Dulepet, P\.S\., Vidyadhara, S\., Ki, D\., Agrawal, S\., Pham, C\., Kroiz, G\., Li, F\., Tao, H\., Srivastava, A\., Da Costa, H\., Gupta, S\., Rogers, M\.L\., Goncearenco, I\., Sarli, G\., Galynker, I\., Peskoff, D\., Carpuat, M\., White, J\., Anadkat, S\., Hoyle, A\., Resnik, P\. \(2024\)\.The Prompt Report: A Systematic Survey of Prompting Techniques\.\[Preprint\]\. arXiv\.[https://doi\.org/10\.48550/arXiv\.2406\.06608](https://doi.org/10.48550/arXiv.2406.06608)\.
- Shi et al\. \(2024\)Shi, Z\., Wang, Y\., Yin, F\., Chen, X\., Chang, K\.W\., Hsieh, C\.J\. \(2024\)\.Red Teaming Language Model Detectors with Language Models\.Transactions of the Association for Computational Linguistics 12, 174–189\.[https://doi\.org/10\.1162/tacl\_a\_00639](https://doi.org/10.1162/tacl_a_00639)\.
- Stowe and Patil \(2026\)Stowe, K\., Patil, K\. \(2026\)\.Spotlights and Blindspots: Evaluating Machine\-Generated Text Detection\.\[Preprint\]\. arXiv\.[https://doi\.org/10\.48550/arXiv\.2604\.16607](https://doi.org/10.48550/arXiv.2604.16607)\.
- Tao et al\. \(2026\)Tao, Z\., Chen, Y\., Xi, D\., Li, Z\., Xu, W\. \(2026\)\.Toward Reliable Detection of LLM\-Generated Texts: A Comprehensive Evaluation Framework with CUDRT\.ACM Trans\. Intell\. Syst\. Technol\. 17\.[https://doi\.org/10\.1145/3779427](https://doi.org/10.1145/3779427)\.
- Wang et al\. \(2025\)Wang, T\., Chen, Y\., Liu, Z\., Chen, Z\., Chen, H\., Zhang, X\., Cheng, W\. \(2025\)\.Humanizing the Machine: Proxy Attacks to Mislead LLM Detectors\.\[Preprint\]\. arXiv\.[https://doi\.org/10\.48550/arXiv\.2410\.19230](https://doi.org/10.48550/arXiv.2410.19230)\.
- Wang et al\. \(2024a\)Wang, Y\., Mansurov, J\., Ivanov, P\., Su, J\., Shelmanov, A\., Tsvigun, A\., Mohammed Afzal, O\., Mahmoud, T\., Puccetti, G\., Arnold, T\., Aji, A\., Habash, N\., Gurevych, I\., Nakov, P\. \(2024a\)\.M4GT\-Bench: Evaluation Benchmark for Black\-Box Machine\-Generated Text Detection, in: Ku, L\.W\., Martins, A\., Srikumar, V\. \(Eds\.\), Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\), Association for Computational Linguistics, Bangkok, Thailand\. pp\. 3964–3992\.[https://doi\.org/10\.18653/v1/2024\.acl\-long\.218](https://doi.org/10.18653/v1/2024.acl-long.218)\.
- Wang et al\. \(2024b\)Wang, Y\., Mansurov, J\., Ivanov, P\., Su, J\., Shelmanov, A\., Tsvigun, A\., Whitehouse, C\., Afzal, O\.M\., Mahmoud, T\., Sasaki, T\., Arnold, T\., Aji, A\.F\., Habash, N\., Gurevych, I\., Nakov, P\. \(2024b\)\.M4: Multi\-generator, Multi\-domain, and Multi\-lingual Black\-Box Machine\-Generated Text Detection, in: Proceedings of the 18th Conference of the European Chapter of the Association for Computational Linguistics \(Volume 1: Long Papers\), Association for Computational Linguistics, St\. Julian’s, Malta\. pp\. 1369–1407\.[https://doi\.org/10\.18653/v1/2024\.eacl\-long\.83](https://doi.org/10.18653/v1/2024.eacl-long.83)\.
- Weber\-Wulff et al\. \(2023\)Weber\-Wulff, D\., Anohina\-Naumeca, A\., Bjelobaba, S\., Foltýnek, T\., Guerrero\-Dib, J\., Popoola, O\., Šigut, P\., Waddington, L\. \(2023\)\.Testing of Detection Tools for AI\-Generated Text\.International Journal for Educational Integrity 19\.[https://doi\.org/10\.1007/s40979\-023\-00146\-z](https://doi.org/10.1007/s40979-023-00146-z)\.
- Weichert and Dimobi \(2024\)Weichert, J\., Dimobi, C\. \(2024\)\.DUPE: Detection Undermining via Prompt Engineering for Deepfake Text\.\[Preprint\]\. arXiv\.[https://doi\.org/10\.48550/arXiv\.2404\.11408](https://doi.org/10.48550/arXiv.2404.11408)\.
- Wu et al\. \(2024\)Wu, J\., Zhan, R\., Wong, D\., Yang, S\., Yang, X\., Yuan, Y\., Chao, L\.S\. \(2024\)\.DetectRL: Benchmarking LLM\-Generated Text Detection in Real\-World Scenarios, in: Globerson, A\., Mackey, L\., Belgrave, D\., Fan, A\., Paquet, U\., Tomczak, J\., Zhang, C\. \(Eds\.\), Advances in Neural Information Processing Systems, Curran Associates, Inc\.\. pp\. 100369–100401\.[https://doi\.org/10\.52202/079017\-3186](https://doi.org/10.52202/079017-3186)\.
- Wu et al\. \(2025\)Wu, J\., Zhan, R\., Wong, D\.F\., Yang, S\., Liu, X\., Chao, L\.S\., Zhang, M\. \(2025\)\.Who Wrote This? The Key to Zero\-Shot LLM\-Generated Text Detection Is GECScore, in: Rambow, O\., Wanner, L\., Apidianaki, M\., Al\-Khalifa, H\., Eugenio, B\.D\., Schockaert, S\. \(Eds\.\), Proceedings of the 31st International Conference on Computational Linguistics, Association for Computational Linguistics, Abu Dhabi, UAE\. pp\. 10275–10292\.[https://aclanthology\.org/2025\.coling\-main\.684/](https://aclanthology.org/2025.coling-main.684/)\.
- Xiang et al\. \(2026\)Xiang, L\., Li, N\., Liu, Y\., Hu, J\. \(2026\)\.AI\-Generated Text Detection: A Comprehensive Review of Active and Passive Approaches\.Computers, Materials and Continua 86\.[https://doi\.org/https://doi\.org/10\.32604/cmc\.2025\.073347](https://doi.org/https://doi.org/10.32604/cmc.2025.073347)\.
- Yadan \(2019\)Yadan, O\. \(2019\)\.Hydra \- A framework for elegantly configuring complex applications\.Github\.[https://github\.com/facebookresearch/hydra](https://github.com/facebookresearch/hydra)\.
- Yang et al\. \(2024\)Yang, J\., Jin, H\., Tang, R\., Han, X\., Feng, Q\., Jiang, H\., Zhong, S\., Yin, B\., Hu, X\. \(2024\)\.Harnessing the Power of LLMs in Practice: A Survey on ChatGPT and Beyond\.ACM Trans\. Knowl\. Discov\. Data 18\.[https://doi\.org/10\.1145/3649506](https://doi.org/10.1145/3649506)\.
- Zha et al\. \(2025\)Zha, Y\., Min, R\., Sushmita, S\. \(2025\)\.PADBen: A Comprehensive Benchmark for Evaluating AI Text Detectors Against Paraphrase Attacks\.\[Preprint\]\. arXiv\.[https://doi\.org/10\.48550/arXiv\.2511\.00416](https://doi.org/10.48550/arXiv.2511.00416)\.
- Zhou et al\. \(2025\)Zhou, Y\., Keuper, M\., Fritz, M\. \(2025\)\.Balancing Diversity and Risk in LLM Sampling: How to Select Your Method and Parameter for Open\-Ended Text Generation, in: Che, W\., Nabende, J\., Shutova, E\., Pilehvar, M\.T\. \(Eds\.\), Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\), Association for Computational Linguistics, Vienna, Austria\. pp\. 26352–26365\.[https://doi\.org/10\.18653/v1/2025\.acl\-long\.1278](https://doi.org/10.18653/v1/2025.acl-long.1278)\.
- Zhou et al\. \(2022\)Zhou, Y\., Muresanu, A\.I\., Han, Z\., Paster, K\., Pitis, S\., Chan, H\., Ba, J\. \(2022\)\.Large Language Models Are Human\-Level Prompt Engineers, in: NeurIPS 2022 Workshop on Foundation Models for Decision Making\.\[Oral presentation\]\.
- Zhuang et al\. \(2021\)Zhuang, L\., Wayne, L\., Ya, S\., Jun, Z\. \(2021\)\.A Robustly Optimized BERT Pre\-training Approach with Post\-training, in: Li, S\., Sun, M\., Liu, Y\., Wu, H\., Liu, K\., Che, W\., He, S\., Rao, G\. \(Eds\.\), Proceedings of the 20th Chinese National Conference on Computational Linguistics, Chinese Information Processing Society of China, Huhhot, China\. pp\. 1218–1227\.[https://aclanthology\.org/2021\.ccl\-1\.108/](https://aclanthology.org/2021.ccl-1.108/)\.

## Appendix APrompt Templates

The following appendix describes the prompt templates used to generate the ARB\-Dataset texts\. Each prompt contains specific parameters:Free\-LLM\{topic\}depends on the source dataset, while\{source\_text\}and\{free\_llm\_text\}are, respectively, the human text of the source dataset and the LLM\-generated text produced using theFree\-LLMprompt \(see Figure[1](https://arxiv.org/html/2607.29539#S4.F1)\)\.

The design details of the prompts are reported in Section[4\.5](https://arxiv.org/html/2607.29539#S4.SS5)\.

### A\.1System prompt

> You are a text rewriting and generation engine for a scientific benchmark\. Return only the requested text\. Do not add explanations, comments, markdown, headings, or prefaces\.

### A\.2Free\-LLMprompt

> Write a fluent, self\-contained English text about the following topic\. Constraints: Use your own wording and structure\. Do not refer to the existence of a source text\. Do not include headings or bullet points\. Keep the length between \{min\_words\} and \{max\_words\} words\. Return only the generated text\. Topic: \{topic\}

### A\.3H2Lprompt

> Rewrite the following text in fluent natural English\. Constraints: Preserve the original meaning\. Preserve factual claims, entities, and relationships\. Do not add new information\. Do not remove important information\. Change wording and sentence structure where possible\. Keep approximately the same length\. Return only the rewritten text\. Text: \{source\_text\}

### A\.4LLM2Lprompt

> Rewrite the following text in fluent natural English\. Constraints: Preserve the original meaning\. Do not add new information\. Do not remove important information\. Change wording and sentence structure where possible\. Keep approximately the same length\. Return only the rewritten text\. Text: \{free\_llm\_text\}

## Appendix BH2Lblock\-level heterogeneity heatmaps

Figures[6](https://arxiv.org/html/2607.29539#A2.F6)and[7](https://arxiv.org/html/2607.29539#A2.F7)report the full block\-level heterogeneity analysis for theH2Lregime\. Each panel corresponds to one detector, and each cell represents a generator×\\timesdataset block\.

![Refer to caption](https://arxiv.org/html/2607.29539v1/x5.png)Figure 6:AUROC heatmaps for theH2Lregime\. Each panel corresponds to one detector; rows are generator models, and columns are datasets\. Values are averaged within each generator×\\timesdataset cell\. All panels share the same 0–1 color scale\.![Refer to caption](https://arxiv.org/html/2607.29539v1/x6.png)Figure 7:TPR@1%FPRheatmaps for theH2Lregime\. Each panel corresponds to one detector; rows are generator models and columns are datasets\. Values are averaged within each generator×\\timesdataset cell\. All panels share the same 0–1 color scale\.