EVIL-Detect for NLPCC 2026 Shared Task 6: LLM-Generated Text Detection

# EVIL-Detect for NLPCC 2026 Shared Task 6: LLM-Generated Text Detection
Source: [https://arxiv.org/html/2608.10698](https://arxiv.org/html/2608.10698)
11institutetext:Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China
11email:\{wangzhuoshang,renyubing,caoyanan\}@iie\.ac\.cn22institutetext:School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China
22email:\{baohongrui26,ronghangyu23\}@mails\.ucas\.ac\.cn###### Abstract

The rapid development of large language models \(LLMs\) has increased the need for reliable detection of LLM\-generated text, especially in realistic Chinese scenarios involving human\-written text \(HWT\), LLM\-generated text \(LGT\), and LLM\-refined text \(HLT\)\. This paper presents EVIL\-Detect, a multi\-signal ensemble framework with conflict\-aware fusion for Natural Language Processing and Chinese Computing \(NLPCC\) 2026 Shared Task 6\. The system integrates edit\-extent regression, zero\-shot likelihood\-contrast signals, lexical statistics, and conservative text rules\. With calibrated decision boundaries and conflict\-aware integration, our system improves robustness under strong out\-of\-distribution shifts, achieving a macro\-F1 score of 0\.8888 and ranking first in the official evaluation\. Our code is available at[https://github\.com/bbbbhrrrr/evildetect](https://github.com/bbbbhrrrr/evildetect)\.

## 1Introduction

Large language models \(LLMs\) such as GPT\-4\[[1](https://arxiv.org/html/2608.10698#bib.bib1)\], Qwen2\.5\[[2](https://arxiv.org/html/2608.10698#bib.bib2)\], and Qwen3\[[19](https://arxiv.org/html/2608.10698#bib.bib19)\]can produce fluent, coherent, and instruction\-following text\. Their wide use also increases risks such as disinformation, academic misconduct, and manipulation of online content, making reliable LLM\-generated text detection important for responsible natural language processing \(NLP\)\[[3](https://arxiv.org/html/2608.10698#bib.bib3)\]\.

Most existing work focuses on English binary detection\. Supervised detectors, including early GPT\-style detectors\[[4](https://arxiv.org/html/2608.10698#bib.bib4)\], RADAR\[[5](https://arxiv.org/html/2608.10698#bib.bib5)\], and DeTeCtive\[[6](https://arxiv.org/html/2608.10698#bib.bib6)\], fine\-tune classifiers on labeled data and often perform well in matched settings, but their robustness drops under cross\-domain or cross\-generator shifts\. Training\-free methods, including DetectGPT\[[7](https://arxiv.org/html/2608.10698#bib.bib7)\], Fast\-DetectGPT\[[8](https://arxiv.org/html/2608.10698#bib.bib8)\], DNA\-GPT\[[9](https://arxiv.org/html/2608.10698#bib.bib9)\], and Binoculars\[[10](https://arxiv.org/html/2608.10698#bib.bib10)\], use likelihood\-, perturbation\-, n\-gram\-, or perplexity\-based signals, but remain sensitive to model choice and thresholds\.

Chinese detection is less explored and cannot be handled by direct transfer from English because of differences in tokenization, lexical granularity, and writing conventions\. NLPCC 2025 Shared Task 1\[[11](https://arxiv.org/html/2608.10698#bib.bib11)\]promoted Chinese binary detection, while NLPCC 2026 Shared Task 6\[[14](https://arxiv.org/html/2608.10698#bib.bib14)\]extends the task to three classes: human\-written text \(HWT\), LLM\-generated text \(LGT\), and LLM\-refined text \(HLT\)\. This setting reflects real artificial intelligence \(AI\)\-assisted writing, where users often use LLMs to rewrite or polish human\-written text, and is closely related to CUDRT\[[12](https://arxiv.org/html/2608.10698#bib.bib12)\], DetectRL\-X\[[13](https://arxiv.org/html/2608.10698#bib.bib13)\], and the official NLPCC 2026 benchmark\[[14](https://arxiv.org/html/2608.10698#bib.bib14)\]\.

Motivated by this strong out\-of\-distribution \(OOD\) setting, we propose EVIL\-Detect, short for Edit\-aware View\-Integrated Learning for Detection\. It combines EditLens\-inspired edit\-extent regression\[[15](https://arxiv.org/html/2608.10698#bib.bib15)\], zero\-shot likelihood\-contrast scoring, lexical statistics, and conservative rule\-based corrections\. Calibrated decision boundaries and conflict\-aware integration are used to fuse complementary signals and resolve boundary cases among HWT, LGT, and HLT\.

Our contributions are threefold:

1. 1\.We analyze the performance of several representative detection methods in the Chinese three\-class setting of HWT, LGT, and HLT\.
2. 2\.We propose EVIL\-Detect, a conflict\-aware ensemble framework that integrates edit\-extent regression, zero\-shot likelihood evidence, lexical statistics, and conservative rule\-based corrections\.
3. 3\.Our system achieved a macro\-F1 score of 0\.8888 and ranked first in NLPCC 2026 Shared Task 6\.

## 2Related Work

### 2\.1Training\-based Supervised Detection

Training\-based detectors formulate LLM\-generated text detection as supervised classification\. Early supervised detectors were developed for GPT\-style outputs\[[4](https://arxiv.org/html/2608.10698#bib.bib4)\], and later methods such as RADAR\[[5](https://arxiv.org/html/2608.10698#bib.bib5)\]and DeTeCtive\[[6](https://arxiv.org/html/2608.10698#bib.bib6)\]improved robustness through adversarial learning and contrastive learning\. These methods can be strong when training and test data are similar, but they are vulnerable to shifts in domain, generator, prompt style, and text length\[[3](https://arxiv.org/html/2608.10698#bib.bib3)\]\.

### 2\.2Training\-free, Statistical, and Representation\-based Detection

Training\-free methods avoid task\-specific training and instead rely on language\-model statistics\. DetectGPT\[[7](https://arxiv.org/html/2608.10698#bib.bib7)\], Fast\-DetectGPT\[[8](https://arxiv.org/html/2608.10698#bib.bib8)\], DNA\-GPT\[[9](https://arxiv.org/html/2608.10698#bib.bib9)\], Binoculars\[[10](https://arxiv.org/html/2608.10698#bib.bib10)\], and EchoPrompt\[[25](https://arxiv.org/html/2608.10698#bib.bib25)\]exploit probability curvature, divergent n\-grams, cross\-model perplexity, or latent prompt restoration for zero\-shot detection\. For related fine\-grained and robust detection settings, AI\-editing\-extent regression and representation\-level features are also useful: EditLens\[[15](https://arxiv.org/html/2608.10698#bib.bib15)\]models the degree of AI editing, while RepreGuard\[[16](https://arxiv.org/html/2608.10698#bib.bib16)\]detects generated text from hidden representation patterns\.

### 2\.3Hybrid Ensemble Detection and Chinese Shared Tasks

Hybrid and ensemble methods are important because different detectors fail on different samples\. EnsemJudge\[[17](https://arxiv.org/html/2608.10698#bib.bib17)\], the winning system of NLPCC 2025 Shared Task 1, combines multiple models and voting strategies for Chinese LLM\-generated text detection\. CUDRT\[[12](https://arxiv.org/html/2608.10698#bib.bib12)\], DetectRL\[[18](https://arxiv.org/html/2608.10698#bib.bib18)\], DetectRL\-X\[[13](https://arxiv.org/html/2608.10698#bib.bib13)\], and NLPCC 2026 Shared Task 6\[[14](https://arxiv.org/html/2608.10698#bib.bib14)\]further emphasize realistic, OOD, and AI\-edited scenarios\. These studies motivate our use of heterogeneous signals and conflict resolution for robust three\-class detection\.

## 3Method

In this section, we present EVIL\-Detect, our detection system for NLPCC 2026 Shared Task 6\. We first describe the observations that motivate the design, then detail the individual modules, and finally present the fusion strategy that combines them into a final prediction\.

### 3\.1Observation and Motivation

Most existing methods for LLM\-generated text detection are designed for binary classification, distinguishing human\-written text from LLM\-generated text\. However, NLPCC 2026 Shared Task 6 requires a more fine\-grained three\-way classification among HWT, LGT, and HLT\. A direct adaptation to three\-way classification is not sufficiently robust under the distribution shift between training and evaluation data, as later shown by the representative alternative designs in Sec\.[4\.3](https://arxiv.org/html/2608.10698#S4.SS3)\. For example, a direct generative quantized low\-rank adaptation \(QLoRA\)\[[23](https://arxiv.org/html/2608.10698#bib.bib23)\]classifier achieves only 0\.1690 macro\-F1 on testp1\.

This motivates us to reconsider the label structure of the task\. HWT and LGT can be viewed as two endpoints, whereas HLT is an intermediate state because LLM refinement preserves human content while introducing machine\-related traces\. We therefore do not require every component to solve the full three\-way task independently: LGT\-oriented signals can be reused by grouping HWT and HLT as non\-LGT, while HWT/HLT discrimination relies more on editing strength\. Since different methods show different class preferences, as quantified in Sec\.[4\.3](https://arxiv.org/html/2608.10698#S4.SS3), EVIL\-Detect combines a supervised edit\-strength module, zero\-shot LGT evidence, lexical statistics, and conflict\-aware fusion rather than uniform averaging\.

### 3\.2Overview of EVIL\-Detect

We proposeEVIL\-Detect, a multi\-signal system for Chinese LLM\-generated and LLM\-refined text detection\. As shown in Fig\.[1](https://arxiv.org/html/2608.10698#S3.F1), EVIL\-Detect combines four types of evidence: supervised edit\-extent signals from EditLens\[[15](https://arxiv.org/html/2608.10698#bib.bib15)\]and Soft\-EditLens, zero\-shot LGT\-tendency signals from EchoPrompt, lexical frequency statistics, and conservative text rules\. The fusion module integrates these heterogeneous signals with conflict\-aware decision logic and outputs the final HWT, LGT, or HLT prediction\.

![Refer to caption](https://arxiv.org/html/2608.10698v1/x1.png)Figure 1:Overall architecture of EVIL\-Detect\.
### 3\.3Supervised Training Module

The supervised training module is inspired by EditLens\[[15](https://arxiv.org/html/2608.10698#bib.bib15)\], which formulates AI\-edited text detection as continuous edit\-extent estimation rather than pure discrete classification\. In the original formulation, a similarity metric between a human\-written source and its AI\-edited version is used as intermediate supervision, and a regression model is trained to predict the amount of AI editing from the text alone\.

In our setting, each training group contains a triplet\(h,g,t\)\(h,g,t\), wherehh,gg, andttdenote the HWT, LGT, and HLT versions respectively\. We define a continuous editing\-extent target on the HWT–HLT–LGT axis by using HWT and LGT as two anchors:

r​\(h\)=0,r​\(g\)=1,r​\(t\)=d​\(h,t\)\.r\(h\)=0,\\quad r\(g\)=1,\\quad r\(t\)=d\(h,t\)\.\(1\)Hered​\(h,t\)∈\[0,1\]d\(h,t\)\\in\[0,1\]measures how far the LLM\-refined textttmoves away from the corresponding human\-written sourcehh\. This formulation treats HLT as an instance\-dependent soft editing state rather than an independent hard class\. At inference time, the paired HWT text is not required; the trained model predictsr​\(x\)r\(x\)from the input textxxalone\. Based on this common formulation, we instantiate the supervised module with two variants\.

#### 3\.3\.1EditLens

The EditLens variant uses a surface\-level soft characternn\-gram distance to constructd​\(h,t\)d\(h,t\)\. LetCn​\(x\)C\_\{n\}\(x\)be the characternn\-gram count vector of textxx\. For a set ofnn\-gram orders𝒩\\mathcal\{N\}and non\-negative weightswnw\_\{n\}, we compute

dng​\(h,t\)=1−∑n∈𝒩wn​cos⁡\(Cn​\(h\),Cn​\(t\)\)∑n∈𝒩wn\.d\_\{\\mathrm\{ng\}\}\(h,t\)=1\-\\frac\{\\sum\_\{n\\in\\mathcal\{N\}\}w\_\{n\}\\,\\cos\(C\_\{n\}\(h\),C\_\{n\}\(t\)\)\}\{\\sum\_\{n\\in\\mathcal\{N\}\}w\_\{n\}\}\.\(2\)Differentnn\-gram orders and weights produce different HLT target distributions\. We therefore perform a validation\-set sweep over candidatenn\-gram ranges and weighting schemes, ranking each configuration by how well the resulting HLT scores are separated from the two anchors0\(HWT\) and11\(LGT\)\. The best\-ranked configuration has internal sweep id 044, uses orders 1–7 with linearly increasing weights, and is denoted as*rank044*in the rest of the paper\. The resulting id/text/score instances are used to train a low\-rank adaptation \(LoRA\)\[[22](https://arxiv.org/html/2608.10698#bib.bib22)\]\-adapted decoder\-only LLM with a regression objective\. The trained model outputs a continuous editing\-extent score, which is later discretized and used as a base signal by the fusion module\.

#### 3\.3\.2Soft\-EditLens

Soft\-EditLens replaces surfacenn\-gram overlap with semantic phrase\-level soft matching\. We first segment HWT and HLT texts into short token phrases\. For each phraseqqin the HLT text, we encode it and find the most similar phraseppin the corresponding HWT text\. With phrase countct​\(q\)c\_\{t\}\(q\)and embedding functione​\(⋅\)e\(\\cdot\), the phrase\-level distance is

dph​\(h,t\)=1−∑q∈P​\(t\)ct​\(q\)​maxp∈P​\(h\)⁡cos⁡\(e​\(q\),e​\(p\)\)∑q∈P​\(t\)ct​\(q\)\.d\_\{\\mathrm\{ph\}\}\(h,t\)=1\-\\frac\{\\sum\_\{q\\in P\(t\)\}c\_\{t\}\(q\)\\max\_\{p\\in P\(h\)\}\\cos\(e\(q\),e\(p\)\)\}\{\\sum\_\{q\\in P\(t\)\}c\_\{t\}\(q\)\}\.\(3\)Compared with characternn\-gram overlap, this target is less sensitive to lexical replacement and better captures semantically preserved expressions\. Soft\-EditLens also changes the learning objective: besides direct regression on the continuous score, we train an ordinal bucket predictor that discretizes the editing\-extent axis into ordered intervals\. At inference time, the regression model provides a smooth score, while the bucket model provides an interval\-level estimate\. These two outputs are used as complementary signals in the fusion module, especially for resolving HWT/HLT boundary cases\.

### 3\.4Zero\-Shot Detection Module

#### 3\.4\.1EchoPrompt

EchoPrompt\[[25](https://arxiv.org/html/2608.10698#bib.bib25)\]is a training\-free prompting module that provides auxiliary evidence for LGT detection\. The module is based on the intuition that fully LLM\-generated text is more compatible with an assistant\-style generation distribution, whereas human\-written text is less likely to follow such a distribution\. For each input text, EchoPrompt computes a normalized likelihood\-contrast score using a prompted instruction\-tuned model and its corresponding base model; a higher score indicates stronger LGT tendency\. To reduce the dependence on a single prompt or model, we use multiple fixed prompt/model branches, whose outputs are passed to the fusion module as additional discriminative signals rather than standalone predictions\.

### 3\.5Lexical Frequency Statistics Module

The lexical frequency statistics module provides a lightweight surface\-level view complementary to neural and prompting\-based signals\. It is based on the observation that some class preferences are reflected in recurring lexical or characternn\-gram patterns\. We build label\-wise frequency lexicons from the training set and retain discriminativenn\-grams after removing patterns that appear similarly across classes\.

For an input textxx, letG​\(x\)G\(x\)denote its extractednn\-grams\. We estimate smoothed label\-conditional probabilitiesp​\(g∣y\)p\(g\\mid y\)for each lexical unitggand labelyy, and aggregate their preferences through averaged log\-odds scores:

sa/b​\(x\)=1\|G​\(x\)\|​∑g∈G​\(x\)log⁡p​\(g∣a\)p​\(g∣b\)\.s\_\{a/b\}\(x\)=\\frac\{1\}\{\|G\(x\)\|\}\\sum\_\{g\\in G\(x\)\}\\log\\frac\{p\(g\\mid a\)\}\{p\(g\\mid b\)\}\.\(4\)In practice, we use several derived statistics, including LGT\-vs\-HWT tendency, AI\-vs\-HWT tendency where LGT and HLT are merged as AI\-assisted text, the fraction of machine\-oriented lexical units, and the fraction of HWT\-oriented lexical units\. These statistics are passed to the fusion module as auxiliary lexical evidence rather than used as standalone predictions\.

### 3\.6Fusion and Decision Module

The fusion module integrates the outputs of the preceding components into the final HWT/LGT/HLT prediction\. The starting point is the EditLens editing\-extent score\. We use two calibrated boundary settings\(τ1\(k\),τ2\(k\)\)\(\\tau\_\{1\}^\{\(k\)\},\\tau\_\{2\}^\{\(k\)\}\),k∈\{1,2\}k\\in\\\{1,2\\\}, and convert the score into a base label for each setting:

y\(k\)​\(x\)=\{HWT,sE​\(x\)≤τ1\(k\),HLT,τ1\(k\)<sE​\(x\)<τ2\(k\),LGT,sE​\(x\)≥τ2\(k\),k∈\{1,2\}\.y^\{\(k\)\}\(x\)=\\begin\{cases\}\\mathrm\{HWT\},&s\_\{E\}\(x\)\\leq\\tau\_\{1\}^\{\(k\)\},\\\\ \\mathrm\{HLT\},&\\tau\_\{1\}^\{\(k\)\}<s\_\{E\}\(x\)<\\tau\_\{2\}^\{\(k\)\},\\\\ \\mathrm\{LGT\},&s\_\{E\}\(x\)\\geq\\tau\_\{2\}^\{\(k\)\},\\end\{cases\}\\quad k\\in\\\{1,2\\\}\.\(5\)HeresE​\(x\)s\_\{E\}\(x\)denotes the EditLens score, andy\(1\)y^\{\(1\)\}andy\(2\)y^\{\(2\)\}are the two resulting base labels\. These base labels are combined with Soft\-EditLens regression/bucket signals and a panel of nine binary LGT\-support votes from zero\-shot, edit\-based, and lexical views \(Table[3](https://arxiv.org/html/2608.10698#S4.T3)\)\.

#### 3\.6\.1Conflict\-aware integration

Ify\(1\)y^\{\(1\)\}andy\(2\)y^\{\(2\)\}agree, EVIL\-Detect directly keeps the agreed label\. If they disagree, the fusion module resolves the conflict according to the label pair involved:

ybase=\{y\(1\),y\(1\)=y\(2\),R​\(y\(1\),y\(2\),zsoft,VLGT\),y\(1\)≠y\(2\),y\_\{\\mathrm\{base\}\}=\\begin\{cases\}y^\{\(1\)\},&y^\{\(1\)\}=y^\{\(2\)\},\\\\ R\(y^\{\(1\)\},y^\{\(2\)\},z\_\{\\mathrm\{soft\}\},V\_\{\\mathrm\{LGT\}\}\),&y^\{\(1\)\}\\neq y^\{\(2\)\},\\end\{cases\}\(6\)wherezsoftz\_\{\\mathrm\{soft\}\}represents the Soft\-EditLens regression and bucket evidence,VLGTV\_\{\\mathrm\{LGT\}\}denotes the aggregated LGT\-support votes, andR​\(⋅\)R\(\\cdot\)is the conflict\-aware resolver\.

We instantiateR​\(⋅\)R\(\\cdot\)with validation\-calibrated thresholds\. Letzr​\(x\)z\_\{r\}\(x\)be the Soft\-EditLens regression score,zb​\(x\)z\_\{b\}\(x\)be its ordinal bucket index, andv​\(x\)=∑i=19vi​\(x\)v\(x\)=\\sum\_\{i=1\}^\{9\}v\_\{i\}\(x\)be the number of active LGT\-support votes\. For HWT/LGT conflicts,RRoutputs HWT whenzr​\(x\)≤γHz\_\{r\}\(x\)\\leq\\gamma\_\{H\}, otherwise outputs LGT whenv​\(x\)≥γH​Lv\(x\)\\geq\\gamma\_\{HL\}, and otherwise falls back to HLT\. For HWT/HLT conflicts,RRoutputs HLT iffzb​\(x\)≥βTz\_\{b\}\(x\)\\geq\\beta\_\{T\}; otherwise it outputs HWT\. For HLT/LGT conflicts,RRoutputs LGT iffv​\(x\)≥γT​Lv\(x\)\\geq\\gamma\_\{TL\}; otherwise it keeps HLT\. HereγH\\gamma\_\{H\}is the HWT\-side Soft\-EditLens boundary,βT\\beta\_\{T\}is the rewriting\-strength bucket boundary, andγH​L,γT​L\\gamma\_\{HL\},\\gamma\_\{TL\}are pair\-specific LGT\-vote thresholds\. This rule design matches the role of each module: EditLens gives the initial continuum label, Soft\-EditLens refines HWT/HLT boundaries, and the vote panel provides evidence for fully generated text\.

#### 3\.6\.2High\-precision text rules

After conflict\-aware integration, we apply a small set of conservative text rules as final corrections\. The complete rule set is as follows\. First, raw HyperText Markup Language \(HTML\)\-like or Extensible Markup Language \(XML\)\-like structural markup, such as<\!DOCTYPE html\>,<html\>,<div\>,<p\>, and<a href=\.\.\.\>, is treated as strong evidence for LGT; representative training examples are shown in Appendix[0\.A](https://arxiv.org/html/2608.10698#Pt0.A1)\. Second, script or rendering residues, such asdocument\.write\("<br/\>"\)or unfinished tag sequences, also trigger an LGT correction\. Third, explicit rewriting or polishing traces, such as answer wrappers indicating that a rewritten or polished version follows, support HLT when the fused label is not already LGT\. These rules are applied only after fusion and serve as high\-precision safeguards\.

## 4Experiments

In this section, we evaluate EVIL\-Detect on NLPCC 2026 Shared Task 6\.

### 4\.1Experimental Setup

#### 4\.1\.1Dataset

We use the official data released for NLPCC 2026 Shared Task 6, which requires three\-way classification among human\-written text \(HWT\), LLM\-generated text \(LGT\), and LLM\-refined text \(HLT\)\. According to the official task description\[[14](https://arxiv.org/html/2608.10698#bib.bib14)\], the training set is sampled and adapted from the CUDRT dataset\[[12](https://arxiv.org/html/2608.10698#bib.bib12)\]and covers four generators, including GPT\-4\[[1](https://arxiv.org/html/2608.10698#bib.bib1)\], Qwen\-family generators, ChatGLM\[[20](https://arxiv.org/html/2608.10698#bib.bib20)\], and Baichuan\[[21](https://arxiv.org/html/2608.10698#bib.bib21)\], across two domains, namely news and academic writing\. In contrast, the two hidden test phases, testp1 and testp2, are drawn from the Chinese split of DetectRL\-X\[[13](https://arxiv.org/html/2608.10698#bib.bib13)\]and are constructed as out\-of\-distribution data that may involve unseen domains, unseen generators, and different generation schemes, so as to stress\-test detector robustness\. We remove empty or malformed training samples and clean task\-irrelevant artifacts such as role markers, abnormal control characters, redundant whitespace, and obvious generation residues\. Formatting cues such as Markdown or HTML fragments are handled conservatively to avoid removing genuine stylistic signals\. This preprocessing is applied only to the training data\. Detailed data statistics are shown in Table[1](https://arxiv.org/html/2608.10698#S4.T1)\.

Table 1:Dataset statistics\.
#### 4\.1\.2Metric\.

The official metric is macro\-F1 over the three classes\. We additionally report accuracy and per\-class F1\.

#### 4\.1\.3Implementation\.

Table[2](https://arxiv.org/html/2608.10698#S4.T2)summarises the modules, and Table[3](https://arxiv.org/html/2608.10698#S4.T3)details the vote panel\. EditLens uses Qwen3\.5\-4B\-Base\[[24](https://arxiv.org/html/2608.10698#bib.bib24)\]as the backbone with LoRA\[[22](https://arxiv.org/html/2608.10698#bib.bib22)\]\(rank 16,α\\alpha32, dropout 0\.05\) on all attention and MLP projections, together with a linear regression head for editing\-extent prediction\. Its target adopts the rank044 softnn\-gram configuration selected by the separability sweep\. Soft\-EditLens uses Qwen3\.5\-9B\-Base\[[24](https://arxiv.org/html/2608.10698#bib.bib24)\]with the same LoRA\[[22](https://arxiv.org/html/2608.10698#bib.bib22)\]configuration and a dual regression/bucket objective\. The zero\-shot module is training\-free and uses Qwen3\.5\-4B\[[24](https://arxiv.org/html/2608.10698#bib.bib24)\]and Qwen2\.5\-1\.5B\[[2](https://arxiv.org/html/2608.10698#bib.bib2)\]instruct/base model pairs\. The lexical\-frequency module builds label\-wise word and characternn\-gram log\-odds lexicons\. For fusion, EditLens scores are discretized with two calibrated class\-boundary settings and combined with Soft\-EditLens auxiliary signals and nine binary LGT\-support votes through conflict\-aware integration, followed by high\-precision text rules\. All supervised models are trained on NVIDIA V100 graphics processing units \(GPUs\)\.

Table 2:Module configuration of EVIL\-Detect\.Table 3:Composition of the binary LGT\-support vote panel used by the fusion module\.

### 4\.2Main Results

Table[4](https://arxiv.org/html/2608.10698#S4.T4)reports the performance of EVIL\-Detect on the two official test phases\. The system achieves macro\-F1 scores of 0\.8913 on testp1 and 0\.8888 on testp2\. The small gap between the two phases indicates that the multi\-signal design remains stable across the two evaluation splits\.

Among the three classes, LGT obtains the highest F1 scores, reaching 0\.9267 on testp1 and 0\.9219 on testp2\. HLT is consistently the most challenging class, with F1 scores of 0\.8391 and 0\.8407, which is consistent with its intermediate nature between HWT and LGT\. This pattern supports the need for conflict\-aware fusion, where HWT/HLT and HLT/LGT disagreements are handled with different auxiliary signals\.

Table 4:Main results of EVIL\-Detect on the two official test phases of NLPCC 2026 Task 6\.
### 4\.3Component and Variant Analysis

We evaluate each module in isolation on testp1, together with the main variants explored during development \(Table[5](https://arxiv.org/html/2608.10698#S4.T5)\)\. EditLens\[[15](https://arxiv.org/html/2608.10698#bib.bib15)\]is the strongest standalone component: the sweep\-selected rank044 configuration reaches 0\.8494 macro\-F1, outperforming the initial soft\-nn\-gram configuration \(0\.8289\)\. This confirms that the validation\-based target sweep improves the separability of the HWT–HLT–LGT continuum\.

The other modules are weaker as standalone three\-class predictors, but they provide useful auxiliary evidence for fusion\. The best zero\-shot strategy reaches 0\.6325 macro\-F1, while the binary HWT/AI strategy reaches 0\.4484, indicating that EchoPrompt is better suited for producing LGT\-support votes\. Lexical statistics show a similar pattern: the best lexical classifier reaches 0\.5535 macro\-F1, so lexical features are also used as calibrated votes rather than final labels\. Soft\-EditLens is not listed because its regression and bucket outputs are consumed by the fusion module\. With conflict\-aware fusion, EVIL\-Detect reaches 0\.8913 macro\-F1, improving over EditLens by 4\.19 points and raising HLT and LGT F1 to 0\.8391 and 0\.9267, respectively\.

Table 5:Component analysis on testp1\. Standalone scores are diagnostic because some methods are used as auxiliary evidence sources in the final fusion\.#### 4\.3\.1Representative alternative designs\.

Table[6](https://arxiv.org/html/2608.10698#S4.T6)reports representative alternatives explored during development but not included in the final EVIL\-Detect system\. Direct generative supervised fine\-tuning \(SFT\) classifiers are not robust under the evaluation distribution: the GLM\-4\-9B\[[20](https://arxiv.org/html/2608.10698#bib.bib20)\]and Qwen3\.5\-9B\[[24](https://arxiv.org/html/2608.10698#bib.bib24)\]variants reach only 0\.1896 and 0\.1690 macro\-F1, showing strong class bias\. Binoculars\[[10](https://arxiv.org/html/2608.10698#bib.bib10)\]also performs poorly as a standalone three\-way predictor, with 0\.3928 macro\-F1\. These results support our design choice of using editing\-extent modeling as the base signal and treating likelihood\-based detectors as auxiliary evidence\.

Table 6:Representative alternative designs evaluated on testp1\.

### 4\.4Ablation Study

We conduct an ablation of the fusion module on the released testp2 labels, as shown in Table[7](https://arxiv.org/html/2608.10698#S4.T7)\. The EditLens\-only baseline\[[15](https://arxiv.org/html/2608.10698#bib.bib15)\]obtains 0\.8411 macro\-F1\. Adding conflict\-aware integration and high\-precision text rules improves the score to 0\.8816, and the full system reaches 0\.8888 after combining two calibrated EditLens decisions\. The improvement mainly comes from boundary cases: compared with EditLens only, the full system reduces LGT→\\rightarrowHLT errors from 59 to 30 and HLT→\\rightarrowLGT errors from 58 to 28, showing that the fusion module helps correct confusion around HLT\.

Table 7:Ablation results of the fusion module on testp2\.

## 5Conclusion

This paper presents EVIL\-Detect for Chinese LLM\-generated and LLM\-refined text detection in NLPCC 2026 Shared Task 6\. It integrates edit\-extent regression, zero\-shot LGT evidence, lexical statistics, and conservative text rules through conflict\-aware fusion\. With calibrated decision boundaries, our system achieved a macro\-F1 score of 0\.8888 and ranked first in the official evaluation\. The results suggest that robust three\-class detection cannot rely on a single signal; instead, edit\-strength modeling, likelihood\-based evidence, lexical cues, and high\-precision corrections provide complementary information for distinguishing HWT, LGT, and HLT\.

#### Acknowledgments\.

This work is supported by the Postdoctoral Fellowship Program of China Postdoctoral Science Foundation \(CPSF\) under Grant Number GZC20251076\.

## References

- \[1\]Achiam, J\., Adler, S\., Agarwal, S\., Ahmad, L\., Akkaya, I\., Aleman, F\.L\., et al\.: GPT\-4 technical report\. arXiv preprint arXiv:2303\.08774 \(2023\)
- \[2\]Yang, A\., Yang, B\., Zhang, B\., Hui, B\., Zheng, B\., Yu, B\., et al\.: Qwen2\.5 technical report\. arXiv preprint arXiv:2412\.15115 \(2024\)
- \[3\]Wu, J\., Yang, S\., Zhan, R\., Yuan, Y\., Chao, L\.S\., Wong, D\.F\.: A survey on LLM\-generated text detection: Necessity, methods, and future directions\. Computational Linguistics51\(1\), 275–338 \(2025\)
- \[4\]Solaiman, I\., Brundage, M\., Clark, J\., Askell, A\., Herbert\-Voss, A\., Wu, J\., et al\.: Release strategies and the social impacts of language models\. arXiv preprint arXiv:1908\.09203 \(2019\)
- \[5\]Hu, X\., Chen, P\.\-Y\., Ho, T\.\-Y\.: RADAR: Robust AI\-text detection via adversarial learning\. Advances in Neural Information Processing Systems36, 15077–15095 \(2023\)
- \[6\]Guo, X\., Zhang, S\., He, Y\., Zhang, T\., Feng, W\., Huang, H\., Ma, C\.: DeTeCtive: Detecting AI\-generated text via multi\-level contrastive learning\. Advances in Neural Information Processing Systems37, 88320–88347 \(2024\)
- \[7\]Mitchell, E\., Lee, Y\., Khazatsky, A\., Manning, C\.D\., Finn, C\.: DetectGPT: Zero\-shot machine\-generated text detection using probability curvature\. In: Proceedings of the 40th International Conference on Machine Learning, pp\. 24950–24962\. PMLR \(2023\)
- \[8\]Bao, G\., Zhao, Y\., Teng, Z\., Yang, L\., Zhang, Y\.: Fast\-DetectGPT: Efficient zero\-shot detection of machine\-generated text via conditional probability curvature\. In: The Twelfth International Conference on Learning Representations \(2024\)
- \[9\]Yang, X\., Cheng, W\., Wu, Y\., Petzold, L\., Wang, W\.Y\., Chen, H\.: DNA\-GPT: Divergent n\-gram analysis for training\-free detection of GPT\-generated text\. In: The Twelfth International Conference on Learning Representations \(2024\)
- \[10\]Hans, A\., Schwarzschild, A\., Cherepanova, V\., Kazemi, H\., Saha, A\., Goldblum, M\., Geiping, J\., Goldstein, T\.: Spotting LLMs with binoculars: Zero\-shot detection of machine\-generated text\. In: Proceedings of the 41st International Conference on Machine Learning, pp\. 17519–17537\. PMLR \(2024\)
- \[11\]Wu, J\., Zhan, R\., Wang, Q\., Yuan, Y\., Chao, L\.S\., Wong, D\.F\.: Overview of the NLPCC 2025 Shared Task 1: LLM\-generated text detection\. In: CCF International Conference on Natural Language Processing and Chinese Computing, pp\. 263–274\. Springer \(2025\)
- \[12\]Tao, Z\., Chen, Y\., Xi, D\., Li, Z\., Xu, W\.: Toward reliable detection of LLM\-generated texts: A comprehensive evaluation framework with CUDRT\. ACM Transactions on Intelligent Systems and Technology17\(2\), 1–35 \(2026\)
- \[13\]Wu, J\., Liu, Y\., Zhu, C\., Zhang, H\., Wu, Z\., Shi, T\., Du, Y\., Wang, L\., Luo, W\., Su, J\., Wong, D\.F\.: DetectRL\-X: Towards reliable multilingual and real\-world LLM\-generated text detection\. In: Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\), pp\. 38247–38294\. Association for Computational Linguistics \(2026\)
- \[14\]NLP2CT Lab: NLPCC 2026 Shared Task 6: The Second Shared Task on LLM\-Generated Text Detection\.[https://github\.com/NLP2CT/NLPCC\-2026\-Task6\-Detection](https://github.com/NLP2CT/NLPCC-2026-Task6-Detection)\(2026\)\. Accessed 2 July 2026
- \[15\]Thai, K\., Emi, B\., Masrour, E\., Iyyer, M\.: EditLens: Quantifying the extent of AI editing in text\. arXiv preprint arXiv:2510\.03154 \(2025\)
- \[16\]Chen, X\., Wu, J\., Yang, S\., Zhan, R\., Wu, Z\., Luo, Z\., Wang, D\., Yang, M\., Chao, L\.S\., Wong, D\.F\.: RepreGuard: Detecting LLM\-generated text by revealing hidden representation patterns\. Transactions of the Association for Computational Linguistics13, 1812–1831 \(2025\)
- \[17\]Wang, Z\., Ren, Y\., Zhao, G\., Zhu, X\., Li, H\., Cao, Y\.: EnsemJudge: Enhancing reliability in Chinese LLM\-generated text detection through diverse model ensembles\. In: CCF International Conference on Natural Language Processing and Chinese Computing, Singapore, pp\. 284–295\. Springer \(2025\)
- \[18\]Wu, J\., Zhan, R\., Wong, D\.F\., Yang, S\., Yang, X\., Yuan, Y\., Chao, L\.S\.: DetectRL: Benchmarking LLM\-generated text detection in real\-world scenarios\. Advances in Neural Information Processing Systems37, 100369–100401 \(2024\)
- \[19\]Yang, A\., Li, A\., Yang, B\., Zhang, B\., Hui, B\., Zheng, B\., Yu, B\., et al\.: Qwen3 technical report\. arXiv preprint arXiv:2505\.09388 \(2025\)
- \[20\]Team GLM, Zeng, A\., Xu, B\., Wang, B\., Zhang, C\., Yin, D\., Zhang, D\., et al\.: ChatGLM: A family of large language models from GLM\-130B to GLM\-4 all tools\. arXiv preprint arXiv:2406\.12793 \(2024\)
- \[21\]Yang, A\., Xiao, B\., Wang, B\., Zhang, B\., Bian, C\., Yin, C\., Lv, C\., et al\.: Baichuan 2: Open large\-scale language models\. arXiv preprint arXiv:2309\.10305 \(2023\)
- \[22\]Hu, E\.J\., Shen, Y\., Wallis, P\., Allen\-Zhu, Z\., Li, Y\., Wang, S\., Wang, L\., Chen, W\.: LoRA: Low\-rank adaptation of large language models\. In: International Conference on Learning Representations \(2022\)
- \[23\]Dettmers, T\., Pagnoni, A\., Holtzman, A\., Zettlemoyer, L\.: QLoRA: Efficient finetuning of quantized LLMs\. Advances in Neural Information Processing Systems36, 10088–10115 \(2023\)
- \[24\]Qwen Team: Qwen3\.5 model cards\.[https://huggingface\.co/Qwen](https://huggingface.co/Qwen)\(2026\)\. Accessed 10 July 2026
- \[25\]Bao, H\., Ren, Y\., Cao, Y\., You, J\., Fang, F\., Wang, S\.: Once a response, always a response: Detecting LLM\-generated text via latent prompt restoration\. arXiv preprint arXiv:2608\.05741 \(2026\)

## Appendix 0\.AHTML\-like LGT Examples

We observed LGT training samples with raw markup or rendering residues\. Representative short snippets include:

- •<\!DOCTYPE html\>
- •<html\>and<div\>
- •<a href=\.\.\.\>
- •document\.write\("<br/\>"\)

These patterns appear in LGT training items generated by Baichuan, ChatGLM, and GPT\-4\. We show only structural snippets because the original samples are long Chinese documents\.