Once a Response, Always a Response: Detecting LLM-generated Text via Latent Prompt Restoration

# Once a Response, Always a Response: Detecting LLM-generated Text via Latent Prompt Restoration
Source: [https://arxiv.org/html/2608.05741](https://arxiv.org/html/2608.05741)
Hongrui Bao1,2, Yubing Ren1,2, Yanan Cao1,2, Jinhan You3, Fang Fang1,2, Shi Wang4 1Institute of Information Engineering, Chinese Academy of Sciences 2School of Cyber Security, University of Chinese Academy of Sciences 3College of Computer Science and Technology, Zhejiang University 4Institute of Computing Technology, Chinese Academy of Sciences

###### Abstract

Large language models \(LLMs\) can generate fluent and convincing text at scale, creating growing risks for misinformation dissemination, educational misuse, and platform governance\. These concerns make robust detection of machine\-generated text increasingly necessary\. Recent zero\-shot detectors mainly exploit probability\-based statistical discrepancies, but they do not explicitly account for the training process of LLMs, which leaves a distinct generation mechanism insufficiently modeled and limits detection robustness\. To address this issue, we propose EchoPrompt, a training\-free detector based on latent prompt restoration\. Our key intuition is that machine\-generated text is typically produced conditioned on an upstream prompt, and this hidden dependency can be partially reactivated by prepending a unified generic prefix\. Specifically, EchoPrompt restores a generic assistant\-response context, measures the induced likelihood gain with an instruction\-tuned model, calibrates it against the corresponding base model, and aggregates the resulting differences into a score that quantifies latent prompt dependency\. Extensive experiments show that EchoPrompt achieves state\-of\-the\-art performance among zero\-shot detectors while maintaining strong robustness across challenging evaluation settings\.

## 1Introduction

Large language models \(LLMs\) have made it possible to generate high\-quality text at scale, substantially narrowing the observable gap between machine\-generated and human\-written content\. Modern systems can produce fluent and convincing text across diverse domains, making it increasingly difficult to distinguish machine\-generated content from human writing\. While these capabilities enable many useful applications in content creation, question answering, and writing assistance, they also raise growing concerns in high\-stakes scenarios such as misinformation dissemination, spam and fraud generation, educational misuse, authorship ambiguity, and intellectual property protection\[[1](https://arxiv.org/html/2608.05741#bib.bib1),[2](https://arxiv.org/html/2608.05741#bib.bib2)\]\. Prior work\[[8](https://arxiv.org/html/2608.05741#bib.bib3)\]has further shown that humans themselves often struggle to reliably distinguish model\-generated text from human writing\. These developments make robust detection of machine\-generated text increasingly essential for the safe and trustworthy deployment of LLM systems\.

Theoretical analyses\[[7](https://arxiv.org/html/2608.05741#bib.bib6)\]suggest that AI\-generated text detection remains feasible when sufficient textual evidence is available\. Existing detectors are commonly divided into training\-based and training\-free methods\. Training\-based methods require large\-scale labeled data and supervised deep models to learn implicit textual representations, which limits their scalability and cross\-domain generalization\[[31](https://arxiv.org/html/2608.05741#bib.bib4),[20](https://arxiv.org/html/2608.05741#bib.bib5)\], whereas training\-free methods convert token\-level statistical signals extracted from the generation distributions of proxy language models into detection scores\. Among these, recent work on IRM\[[21](https://arxiv.org/html/2608.05741#bib.bib7)\]shows that machine\-generated text can be identified by discrepancies between a base model and its instruction\-tuned counterpart, suggesting that instruction tuning leaves detectable traces in generated text\. This observation, however, raises a natural question: beyond changing token\-level probabilities, does instruction tuning leave behind a more persistent signal that fundamentally distinguishes machine\-generated text from human writing?

We hypothesize that this persistent signal comes from the latent assistant\-response context introduced by instruction tuning\. Unlike human\-written text, machine\-generated text is typically produced as a response under a system prompt, a user request, or an assistant role\. Although this original prompt is removed, its influence is not fully erased: the generated text still implicitly “remembers” that it was written as a response\. Surprisingly, we find that this hidden dependency can be reactivated without knowing the true prompt\. In particular, simply prepending a unified generic assistant\-style prefix makes machine\-generated text align more naturally with the induced conditioning context, whereas human\-written text exhibits a much weaker response to the same prefix\.

Based on this observation, we propose EchoPrompt, a training\-free detector that measures latent prompt dependency through restored assistant\-context scoring\. EchoPrompt first prepends a unified assistant\-style prefix to the input text to restore a generic assistant\-response context\. It then computes token\-level likelihoods using an instruction\-tuned proxy model and calibrates the context\-induced gain with the corresponding base model, thereby reducing the effect of ordinary linguistic regularities\. Finally, these calibrated likelihood differences are aggregated into a sequence\-level detection score, where a larger score indicates stronger compatibility with the restored assistant context and thus a higher likelihood of machine generation\.

To evaluate the effectiveness of EchoPrompt, we compare it against representative training\-based and training\-free baselines across three benchmark datasets\. Experimental results demonstrate that EchoPrompt consistently achieves stronger overall performance and exhibits favorable robustness across diverse evaluation settings\.

##### Contributions\.

This study makes three main contributions:

- •Inspired by the finding of IRM\[[21](https://arxiv.org/html/2608.05741#bib.bib7)\]that post\-training leaves detectable traces in large language models, we further observe that machine\-generated text exhibits stronger latent dependency on restored assistant\-style context than human\-written text\.
- •We propose EchoPrompt, a training\-free detector that restores a generic assistant\-response context and measures context\-conditioned likelihood gain through calibrated comparison between a base model and an instruction\-tuned proxy model\.
- •Extensive experiments show that EchoPrompt provides a robust, efficient, and broadly generalizable solution for AI\-generated text detection, achieving consistent performance gains across three public benchmarks, various adversarial attacks, different input lengths, and proxy model choices, while maintaining an inference latency of less than 0\.26 seconds per sample\.

## 2Related Work

##### Training\-based detectors\.

Training\-based methods require large\-scale labeled examples and supervised models to learn discriminative representations for separating human\-written and AI\-generated text\. Early systems such as OpenAI’s GPT\-2 output detector\[[28](https://arxiv.org/html/2608.05741#bib.bib8)\]fine\-tune pretrained encoders such as RoBERTa to distinguish generated and human text in representation space\. Subsequent work improves this paradigm through stronger learning objectives and more structured representation learning\. RADAR\[[18](https://arxiv.org/html/2608.05741#bib.bib9)\]adopts adversarial learning to improve robustness against paraphrased inputs; BiScope\[[13](https://arxiv.org/html/2608.05741#bib.bib10)\]introduces bidirectional cross\-entropy statistics to capture both forward token prediction and preceding\-token memorization; DeTeCtive\[[14](https://arxiv.org/html/2608.05741#bib.bib11)\]uses multi\-level contrastive learning to separate writing styles from different sources; and DETree\[[17](https://arxiv.org/html/2608.05741#bib.bib36)\]models human–AI collaborative writing processes with tree\-structured hierarchical representation learning\. Beyond classifier\-based designs, R\-Detect\[[29](https://arxiv.org/html/2608.05741#bib.bib12)\]introduces a deep kernel relative test to reduce false positives under distributional mismatch\. However, supervised or reference\-set\-based detectors can still be sensitive to domain, style, generator, and attack shifts, as shown in prior studies on neural text attribution and robustness\-oriented detection benchmarks\[[31](https://arxiv.org/html/2608.05741#bib.bib4),[6](https://arxiv.org/html/2608.05741#bib.bib37)\]\. These limitations motivate more scalable and generalizable training\-free alternatives\.

##### Training\-free \(zero\-shot\) detectors\.

Training\-free methods avoid fitting a task\-specific classifier and instead convert token\-level statistical signals extracted from the generation distributions of proxy language models into detection scores\. Early zero\-shot approaches, including LogRank\[[10](https://arxiv.org/html/2608.05741#bib.bib13)\], Likelihood\[[16](https://arxiv.org/html/2608.05741#bib.bib14)\], and Entropy\[[19](https://arxiv.org/html/2608.05741#bib.bib15)\], use uncertainty\- or rank\-based statistics to capture regularities of generated text\. DetectLLM\[[30](https://arxiv.org/html/2608.05741#bib.bib16)\]further leverages log\-rank information to improve zero\-shot detection of machine\-generated text\. Another line studies the likelihood landscape: DetectGPT\[[25](https://arxiv.org/html/2608.05741#bib.bib17)\]estimates probability curvature through random perturbations, while Fast\-DetectGPT\[[4](https://arxiv.org/html/2608.05741#bib.bib18)\]replaces expensive perturbation with conditional probability curvature approximation for substantially improved efficiency\. More recent methods exploit cross\-model, alignment\-aware, or sequence\-level signals\. Binoculars\[[15](https://arxiv.org/html/2608.05741#bib.bib19)\]compares paired observer and performer models through perplexity\-based ratios; IRM\[[21](https://arxiv.org/html/2608.05741#bib.bib7)\]derives an implicit reward signal from base and instruction\-tuned model pairs without preference collection or additional training; LastDE and LastDE\+\+\[[34](https://arxiv.org/html/2608.05741#bib.bib20)\]mine token probability sequences for local and global diversity\-entropy statistics; and DNA\-DetectLLM\[[37](https://arxiv.org/html/2608.05741#bib.bib21)\]models the repair effort required to transform a text toward an ideal machine\-generated sequence\.

## 3Method

### 3\.1Preliminary

##### Pre\-training workflow of LLM\.

Modern LLMs typically undergo a multi\-stage optimization pipeline\. LLMs are first pre\-trained as autoregressive language models over open\-domain corpora\. Given a token sequenceX=\(x1,…,xn\)X=\(x\_\{1\},\\dots,x\_\{n\}\), a base model factorizes its likelihood as

Pbase​\(X\)=∏t=1nPbase​\(xt∣x<t\)\.P\_\{\\mathrm\{base\}\}\(X\)=\\prod\_\{t=1\}^\{n\}P\_\{\\mathrm\{base\}\}\(x\_\{t\}\\mid x\_\{<t\}\)\.\(1\)The corresponding pre\-training objective minimizes the negative log\-likelihood:

θbase∗=arg⁡minθ⁡\[−𝔼X∼𝒟pre​∑t=1nlog⁡Pθ​\(xt∣x<t\)\]\.\\theta\_\{\\mathrm\{base\}\}^\{\*\}=\\arg\\min\_\{\\theta\}\\left\[\-\\mathbb\{E\}\_\{X\\sim\\mathcal\{D\}\_\{\\mathrm\{pre\}\}\}\\sum\_\{t=1\}^\{n\}\\log P\_\{\\theta\}\(x\_\{t\}\\mid x\_\{<t\}\)\\right\]\.\(2\)This stage mainly captures general linguistic regularities, without explicitly optimizing the model to generate responses under user instructions\[[5](https://arxiv.org/html/2608.05741#bib.bib22)\]\.

##### Post\-training workflow of LLM\.

Subsequently, the model undergoes post\-training, typically including supervised fine\-tuning \(SFT\) and preference\-based optimization such as RLHF\[[26](https://arxiv.org/html/2608.05741#bib.bib23)\]or DPO\[[27](https://arxiv.org/html/2608.05741#bib.bib24)\]\. Here, the optimization objective shifts from unsupervised continuation to conditional generation under a global instructioncgc\_\{g\}:

Pinst​\(X∣cg\)=∏t=1nPinst​\(xt∣cg,x<t\)\.P\_\{\\text\{inst\}\}\(X\\mid c\_\{g\}\)=\\prod\_\{t=1\}^\{n\}P\_\{\\text\{inst\}\}\(x\_\{t\}\\mid c\_\{g\},x\_\{<t\}\)\.\(3\)The shared effect of SFT and preference\-based post\-training can be schematically summarized by the following unified objective:

θinst∗=argminθ\[\\displaystyle\\theta\_\{\\text\{inst\}\}^\{\*\}=\\arg\\min\_\{\\theta\}\\Big\[ℒSFT\(θ\)\+αℒpref\(θ\)\+λKL\(πθ∥πbase\)\],\\displaystyle\\mathcal\{L\}\_\{\\text\{SFT\}\}\(\\theta\)\+\\alpha\\,\\mathcal\{L\}\_\{\\text\{pref\}\}\(\\theta\)\+\\lambda\\,\\mathrm\{KL\}\\\!\\left\(\\pi\_\{\\theta\}\\,\\\|\\,\\pi\_\{\\text\{base\}\}\\right\)\\Big\],\(4\)where

ℒSFT​\(θ\)=−𝔼\(cg,X\)∼𝒟SFT​\[∑t=1nlog⁡Pθ​\(xt∣cg,x<t\)\],\\mathcal\{L\}\_\{\\text\{SFT\}\}\(\\theta\)=\-\\mathbb\{E\}\_\{\(c\_\{g\},X\)\\sim\\mathcal\{D\}\_\{\\text\{SFT\}\}\}\\left\[\\sum\_\{t=1\}^\{n\}\\log P\_\{\\theta\}\(x\_\{t\}\\mid c\_\{g\},x\_\{<t\}\)\\right\],\(5\)andℒpref\\mathcal\{L\}\_\{\\text\{pref\}\}denotes a preference\-based objective, and the above formulation provides a schematic abstraction of common post\-training procedures\. From the perspective of the Transformer architecture\[[32](https://arxiv.org/html/2608.05741#bib.bib25)\], once the instruction prefixcgc\_\{g\}is prepended to the sequence, it becomes part of the causal context\. Its token representations can be attended to by subsequent tokens and propagated through the network, thereby influencing downstream hidden states and decoding decisions\.

##### IRM\.

Implicit Reward Models \(IRM\)\[[21](https://arxiv.org/html/2608.05741#bib.bib7)\]provide a zero\-shot framework for LLM\-generated text detection\. The key idea is that, under the formulation of preference optimization, the discrepancy between a policy model and its reference model can be interpreted as an implicit reward\. In IRM, the instruction\-tuned model serves as the policy model, while the corresponding base model serves as the reference model\. Accordingly, IRM constructs a detection score without requiring additional detector training\. For a text sequenceX=\(x1,…,xn\)X=\(x\_\{1\},\\dots,x\_\{n\}\), the score is defined as:

r​\(X\)=∑t=1nlog⁡Pinst​\(xt∣x<t\)Pbase​\(xt∣x<t\)\.r\(X\)=\\sum\_\{t=1\}^\{n\}\\log\\frac\{P\_\{\\text\{inst\}\}\(x\_\{t\}\\mid x\_\{<t\}\)\}\{P\_\{\\text\{base\}\}\(x\_\{t\}\\mid x\_\{<t\}\)\}\.\(6\)

### 3\.2EchoPrompt

EchoPrompt is a training\-free detector that probes whether a target passage exhibits an unusually strong dependency on a restored assistant\-style context\. Figure[1](https://arxiv.org/html/2608.05741#S3.F1)provides an overview of EchoPrompt\. The detection process consists of three steps:

Step 1: Assistant\-context restoration\.Given an input textXX, EchoPrompt prepends a unified task\-agnostic assistant\-style prefixcgc\_\{g\}to construct a restored sequence\[cg;X\]\[c\_\{g\};X\], which approximates the generic response condition under which AI\-generated text is commonly produced\.

Step 2: Context\-calibrated comparative scoring\.EchoPrompt computes token\-level log\-likelihoods under two asymmetric conditions: the instruction\-tuned proxy model evaluates the restored sequence\[cg;X\]\[c\_\{g\};X\], while the corresponding base model evaluates the original textXXto calibrate ordinary linguistic predictability\. Their difference defines a context\-calibrated token\-level gap, and the average gap forms the sequence\-level EchoPrompt score\.

Step 3: Threshold\-based detection\.The final prediction is made by comparing the EchoPrompt score with a thresholdτ\\tau: passages with scores above the threshold are classified as AI\-generated, while the remaining passages are classified as human\-written\.

![Refer to caption](https://arxiv.org/html/2608.05741v1/x1.png)Figure 1:Overview of EchoPrompt\.#### 3\.2\.1Assistant\-Context Restoration

EchoPrompt is motivated by a simple hypothesis: machine\-generated text is typically produced under an implicit assistant\-style directive, even when the original prompt is unavailable at detection time\. Therefore, if we restore a generic assistant\-response context before evaluating the text, machine\-generated passages should align with that condition more naturally than human\-written passages\.

To operationalize this idea, we prepend a global prefixcgc\_\{g\}to each evaluated passage to restore a generic assistant\-response context\. The choice ofcgc\_\{g\}is determined by preliminary empirical evaluation, with detailed settings and results reported in Appendix[C](https://arxiv.org/html/2608.05741#A3)\. Based on these results, we instantiatecgc\_\{g\}as:

> “You are a helpful, versatile, and intelligent AI assistant\. Below is the content you generated in response to a user’s request, which acts as either a coherent continuation, a topic\-specific article, or a detailed answer to a question:\\n\\n”

This prefix is intentionally task\-agnostic\. Rather than introducing specific entities or task instructions, it restores only the coarse global condition that the following sequence should be interpreted as an assistant\-style response\. In this way, the detector does not rely on access to the original prompt, but instead probes whether the target text is inherently compatible with a generic assistant\-response context\.

#### 3\.2\.2Context\-Calibrated Comparative Scoring

After restoring the assistant\-style context, a natural option is to directly measure the conditional likelihood under the instruction\-tuned model, i\.e\.,log⁡Pinst​\(xt∣cg,x<t\)\\log P\_\{\\text\{inst\}\}\(x\_\{t\}\\mid c\_\{g\},x\_\{<t\}\)\. However, this quantity alone is not sufficiently discriminative: high\-frequency tokens, common phrases, and the intrinsic fluency of the text can all increase token probabilities, making it difficult to separate true context dependency from ordinary local smoothness\.

To reduce this confounding effect, EchoPrompt introduces a calibrated comparison against a base model\. The base model primarily captures the marginal regularities of open\-domain text, and thus serves as a reference for local linguistic predictability without the restored assistant\-style conditioning\. Based on this contrast, we define the EchoPrompt score as:

S​c​o​r​eEchoPrompt​\(X;cg\)=1n−1​∑t=2n\[log⁡Pinst​\(xt∣cg,x<t\)−log⁡Pbase​\(xt∣x<t\)\],\\displaystyle Score\_\{\\text\{EchoPrompt\}\}\(X;c\_\{g\}\)=\\frac\{1\}\{n\-1\}\\sum\_\{t=2\}^\{n\}\\Big\[\\log P\_\{\\text\{inst\}\}\(x\_\{t\}\\mid c\_\{g\},x\_\{<t\}\)\-\\log P\_\{\\text\{base\}\}\(x\_\{t\}\\mid x\_\{<t\}\)\\Big\],\(7\)whereXXdenotes the evaluated sequence andcgc\_\{g\}denotes the restored assistant\-style prefix\. The first term measures how naturally the passage is supported under assistant\-style contextual conditioning, while the second term provides a calibration baseline for its local linguistic predictability\. Their difference suppresses fluency effects shared by both human and machine text, and highlights the additional advantage that machine\-generated passages receive when evaluated under the restored assistant\-style condition\. Averaging across token positions yields a stable sequence\-level statistic for zero\-shot detection\.

![Refer to caption](https://arxiv.org/html/2608.05741v1/x2.png)Figure 2:Prompt\-induced contextual gain under a restored assistant\-style prefix for the base models of four small proxy families\.
#### 3\.2\.3Threshold\-based Detection

EchoPrompt classifies the evaluated sequence by comparing its score with a thresholdτ\\tau:

𝒟​\(X\)=\{AI\-generated Text,S​c​o​r​eEchoPrompt​\(X;cg\)\>τ,Human\-written Text,S​c​o​r​eEchoPrompt​\(X;cg\)≤τ\.\\mathcal\{D\}\(X\)=\\begin\{cases\}\\text\{AI\-generated Text\},&Score\_\{\\text\{EchoPrompt\}\}\(X;c\_\{g\}\)\>\\tau,\\\\ \\text\{Human\-written Text\},&Score\_\{\\text\{EchoPrompt\}\}\(X;c\_\{g\}\)\\leq\\tau\.\\end\{cases\}\(8\)A higher EchoPrompt score indicates stronger latent dependency on the restored assistant\-style context, and therefore a higher likelihood of machine generation\.

### 3\.3Empirical Evidence of Latent Prompt Dependency

To empirically validate the role of the restored prefix itself, we directly examine the likelihood gain induced by prompt injection within the same model\. For a fixed modelPP, we define

g​\(X;cg\)=1n−1​∑t=2n\[log⁡P​\(xt∣cg,x<t\)−log⁡P​\(xt∣x<t\)\],\\displaystyle g\(X;c\_\{g\}\)=\\frac\{1\}\{n\-1\}\\sum\_\{t=2\}^\{n\}\\Big\[\\log P\(x\_\{t\}\\mid c\_\{g\},x\_\{<t\}\)\-\\log P\(x\_\{t\}\\mid x\_\{<t\}\)\\Big\],\(9\)which measures how much the target sequence benefits from the restored assistant\-style context\.

Figure[2](https://arxiv.org/html/2608.05741#S3.F2)reports the average gain for human and machine text under the base models of four small proxy families, and Appendix[D](https://arxiv.org/html/2608.05741#A4)provides the detailed settings and values\. A consistent pattern emerges: after the same generic prefix is injected, machine\-generated text receives a larger likelihood gain than human\-written text\. This result indicates that machine text is more naturally compatible with the restored assistant\-style condition\. Therefore, the useful signal captured by EchoPrompt is not merely raw fluency, but the extra advantage a passage obtains when evaluated under an assistant\-style contextual prompt\.

## 4Experiments

### 4\.1Experimental Setup

##### Datasets\.

We evaluate EchoPrompt on three public detection benchmarks: DetectRL\[[33](https://arxiv.org/html/2608.05741#bib.bib26)\], RealDet\[[36](https://arxiv.org/html/2608.05741#bib.bib27)\], and RAID\[[9](https://arxiv.org/html/2608.05741#bib.bib28)\]\. For DetectRL, we follow the standard test setting and use three deduplicated splits: Multi\-Domain with 3,975 human/machine pairs, Multi\-LLM with 3,991 pairs, and Multi\-Attack with 4,967 pairs aggregated from all attack categories\. To ensure fair and accurate auxiliary evaluation beyond DetectRL, we further use balanced subsets of 1,000 human and 1,000 machine samples from RealDet and RAID\.

Table 1:Performance comparison \(%\) across different benchmarks\. Bold and underlines mark the best and second\-best results within each training\-free proxy\-model block\.
##### Baselines\.

We compare EchoPrompt with representative recent training\-based and training\-free baselines\. The training\-based baselines include OpenAI\-D\[[28](https://arxiv.org/html/2608.05741#bib.bib8)\], BiScope\[[13](https://arxiv.org/html/2608.05741#bib.bib10)\], and R\-Detect\[[29](https://arxiv.org/html/2608.05741#bib.bib12)\], while the training\-free baselines include Likelihood\[[16](https://arxiv.org/html/2608.05741#bib.bib14)\], LogRank\[[10](https://arxiv.org/html/2608.05741#bib.bib13)\], Entropy\[[19](https://arxiv.org/html/2608.05741#bib.bib15)\], Fast\-DetectGPT\[[4](https://arxiv.org/html/2608.05741#bib.bib18)\], Binoculars\[[15](https://arxiv.org/html/2608.05741#bib.bib19)\], LastDE\+\+\[[34](https://arxiv.org/html/2608.05741#bib.bib20)\], DNA\-DetectLLM\[[37](https://arxiv.org/html/2608.05741#bib.bib21)\], and IRM\[[21](https://arxiv.org/html/2608.05741#bib.bib7)\]\. These methods cover supervised detectors and major zero\-shot detection strategies based on confidence, curvature, cross\-model discrepancy, and alignment\-aware signals\.

##### Models\.

To examine the effects of proxy family and model scale, we evaluate paired base/instruct models from Qwen2\.5\[[35](https://arxiv.org/html/2608.05741#bib.bib29)\], Llama\-3\.2\[[24](https://arxiv.org/html/2608.05741#bib.bib30)\], Llama\-3\.1\[[23](https://arxiv.org/html/2608.05741#bib.bib31)\], Llama\-3\[[22](https://arxiv.org/html/2608.05741#bib.bib32),[11](https://arxiv.org/html/2608.05741#bib.bib33)\], and Falcon\[[3](https://arxiv.org/html/2608.05741#bib.bib34)\], including Qwen2\.5\-1\.5B/3B, Llama\-3\.2\-1B/3B, Llama\-3\.1\-8B, Meta\-Llama\-3\-8B, and Falcon\-7B\. For dual\-model detectors, the base and instruct models are used as the observer/performer pair; for single\-model detectors, the instruct model is used as the observer model\.

##### Metrics\.

We useAUROCandF1 scoreas the primary evaluation metrics\. AUROC measures the overall separability between human\-written and machine\-generated text, while F1 score summarizes the balance between precision and recall in binary detection\.

##### Implementation details\.

For a fair comparison, all training\-based detectors are trained on HC3\[[12](https://arxiv.org/html/2608.05741#bib.bib35)\], which is disjoint from the evaluation benchmarks\. Experiments are conducted on Tesla V100\-PCIE\-32GB GPUs with a maximum input length of 1024 tokens\. The prompt setting follows Section[3\.2\.1](https://arxiv.org/html/2608.05741#S3.SS2.SSS1), and all other parameters use default values unless otherwise specified\.

### 4\.2Main Results

Table[1](https://arxiv.org/html/2608.05741#S4.T1)shows that EchoPrompt achieves the strongest overall performance under the Llama\-3\-8B proxy family\. The full results are provided in Appendix[E](https://arxiv.org/html/2608.05741#A5)\. Across three benchmarks, EchoPrompt ranks first on both AUROC and F1, improving over the strongest training\-free baseline, IRM, by0\.69%AUROC and2\.64%F1 on average\. Compared with the best training\-based detector, OpenAI\-D, the gains are much larger, reaching13\.12%AUROC and17\.18%F1 on average\. The advantage is also clear on the more distributionally different RealDet and RAID benchmarks: EchoPrompt improves over the second\-best method by4\.33%F1 on RealDet and by1\.64%AUROC /1\.38%F1 on RAID\. These results indicate that EchoPrompt provides a more effective and transferable detection signal than the strongest existing training\-free competitors\.

This advantage stems from the motivation of EchoPrompt\. Machine\-generated text is usually written as an assistant\-style response, but conventional zero\-shot detectors evaluate it without this missing context, so their signals are easily mixed with generic fluency and token\-level regularities\. By restoring a task\-agnostic assistant\-response context, EchoPrompt exposes this latent generation dependency\. The base\-model comparison further filters out ordinary linguistic predictability, leaving a cleaner signal of assistant\-style contextual compatibility\. This explains why EchoPrompt generalizes better than strong training\-free baselines: it detects not only whether a passage is statistically fluent, but whether it behaves like text generated under an implicit assistant\-response condition\.

### 4\.3Robustness Against Various Attacks

Table 2:Per\-attack results \(%\) including EchoPrompt and other baselines using the Llama\-3\-8B family as proxy models across different attack types\. Bold and underlines mark the best and second\-best results within each training\-free proxy\-model block\.Table[2](https://arxiv.org/html/2608.05741#S4.T2)further shows that EchoPrompt remains robust across different attack settings\. The complete attack results are provided in Appendix[F](https://arxiv.org/html/2608.05741#A6)\. It obtains the best AUROC and F1 in four out of five attack groups and achieves the strongest average attack performance, improving over IRM by0\.24%AUROC and1\.37%F1 on average\. The gains are particularly clear under direct prompting and perturbation, where EchoPrompt improves F1 over the second\-best method by2\.74%and2\.20%, respectively\. It also remains strongest under prompt attacks and data mixing, with F1 gains of2\.05%and0\.94%\. Under paraphrasing, EchoPrompt ranks second but remains very close to IRM, trailing by only0\.87%AUROC and1\.10%F1 while still achieving a high F1 score of94\.53%\. This robustness pattern is consistent with the design of EchoPrompt\. Prompt attacks can alter superficial prompting cues, data mixing can dilute local token statistics, and perturbation can directly corrupt lexical\-level regularities\. Methods that rely mainly on unconditional likelihood, entropy, rank, or local model discrepancy are therefore more easily affected by these transformations\. In contrast, EchoPrompt focuses on whether the text retains generation\-style dependency rather than on isolated token statistics\. This makes the context\-calibrated signal both discriminative and stable under diverse adversarial transformations\.

### 4\.4Ablation Study

##### Impact of Prompt Choice\.

We conduct a prompt\-component ablation to study the effect of the generic prefix on detection performance\. Detailed settings are provided in Appendix[G](https://arxiv.org/html/2608.05741#A7)\. As shown in Figure[3](https://arxiv.org/html/2608.05741#S4.F3), the full prefix consistently outperforms the empty\-prompt setting, improving AUROC by14\.73%and12\.57%on Qwen2\.5\-3B, and by5\.63%and5\.33%on Llama\-3\.1\-8B\. These gains verify the key motivation of EchoPrompt: even without access to the original user prompt, machine\-generated text is more naturally compatible with a restored assistant\-response condition than human\-written text\.

The component\-level results further show that the gain does not simply come from assigning an assistant identity to the proxy model\. The role sentence alone brings only limited gains, especially on Llama\-3\.1\-8B, where the improvements are about1\.60%and1\.44%\. In contrast, context clause A, which frames the passage as content generated in response to a user’s request, provides the strongest individual contribution, improving AUROC by12\.63%,9\.28%,3\.84%, and3\.41%across the four settings\. The leave\-one\-out results lead to the same conclusion: removing context clause A causes the largest drops on Qwen2\.5\-3B, with AUROC decreasing by11\.59%and11\.88%\. This indicates that the core signal of EchoPrompt comes from restoring the missing prompt–response relation, while the role sentence and context clause B mainly help stabilize and broaden this generic assistant\-style condition\.

![Refer to caption](https://arxiv.org/html/2608.05741v1/x3.png)Figure 3:Prompt\-component ablation results\.![Refer to caption](https://arxiv.org/html/2608.05741v1/x4.png)Figure 4:Length\-binned AUROC variation of different zero\-shot detectors on DetectRL Length\.
![Refer to caption](https://arxiv.org/html/2608.05741v1/x5.png)Figure 5:Proxy\-model analysis with representative detector families\.

##### Impact of Proxy Models\.

Figure[5](https://arxiv.org/html/2608.05741#S4.F5)shows that EchoPrompt remains strong across different proxy model families and scales\. Averaged over all proxy settings, EchoPrompt achieves87\.06%AUROC and83\.03%F1, outperforming the strongest competing average baseline, DNA\-DetectLLM, by2\.70%AUROC and3\.23%F1\. The advantage is more evident on Llama\-family proxies, where EchoPrompt reaches93\.50%AUROC and88\.25%F1 on average, exceeding IRM by1\.80%AUROC and2\.63%F1\. These results indicate that EchoPrompt achieves strong cross\-proxy robustness, while its performance is still influenced by the specific proxy family selected\.

##### Impact of Text Lengths\.

Figure[5](https://arxiv.org/html/2608.05741#S4.F5)analyzes AUROC across different length bins on DetectRL Length\. Short texts are challenging for all detectors because they provide fewer tokens for estimating reliable detection signals\. Even in the shortest 1–40 word bin, EchoPrompt remains competitive, with an average AUROC of75\.8%across the three Llama\-family proxies\. As length increases, its performance rises rapidly to93\.1%in the 81–120 bin and98\.9%in the 321–360 bin\. These results highlight that EchoPrompt is able to capture stable discriminative signals across texts of different lengths, thereby achieving strong detection robustness under varying length conditions\.

### 4\.5Hyperparameter Analysis

##### Threshold Stability\.

In practical deployment, a stable decision threshold is important across different proxy models and text lengths\. We therefore analyze the normalized thresholdτ^=τ∗/σpool\\hat\{\\tau\}=\\tau^\{\*\}/\\sigma\_\{\\mathrm\{pool\}\}, whereτ∗\\tau^\{\*\}is the F1\-optimal threshold andσpool\\sigma\_\{\\mathrm\{pool\}\}is the pooled within\-class score standard deviation\. The sign ofτ^\\hat\{\\tau\}is method\-dependent, so we focus on whether the trajectories remain smooth and compact after normalization\. As shown in Figure[7](https://arxiv.org/html/2608.05741#S4.F7), EchoPrompt exhibits one of the most stable profiles across both proxy and length regimes, indicating better threshold stability and easier deployment under changing evaluation conditions\.

### 4\.6Efficiency Analysis

Figure[7](https://arxiv.org/html/2608.05741#S4.F7)reports the average runtime per sample for each detector\. Likelihood, Entropy, and LogRank are the fastest methods, while LastDE\+\+ and DNA\-DetectLLM are substantially more expensive\. EchoPrompt falls in the middle range: although it requires additional computation for context\-conditioned scoring, it remains efficient relative to heavier baselines and provides a favorable efficiency–accuracy trade\-off\.

![Refer to caption](https://arxiv.org/html/2608.05741v1/x6.png)Figure 6:Normalized threshold trajectories across proxy models and text\-length bins\.
![Refer to caption](https://arxiv.org/html/2608.05741v1/x7.png)Figure 7:Average runtime per sample\.

## 5Conclusion

In this paper, we proposed EchoPrompt, a training\-free detector that identifies machine\-generated text by measuring its dependency on restored assistant\-style context\. By combining generic prefix restoration with calibrated likelihood comparison between base and instruction\-tuned models, EchoPrompt captures contextual traces left by the generation process\. Experiments on three benchmarks show that EchoPrompt achieves strong overall performance and robustness across domains, proxy models, text lengths, and adversarial attacks\. These results highlight latent prompt dependency as an effective signal for zero\-shot machine\-generated text detection\.

## References

- \[1\]\(2020\)Generating sentiment\-preserving fake online reviews using neural language models and their human\-and machine\-based detection\.InInternational Conference on Advanced Information Networking and Applications,pp\. 1341–1354\.Cited by:[§1](https://arxiv.org/html/2608.05741#S1.p1.1)\.
- \[2\]A\. A\. A\. Ahmed, A\. Aljabouh, P\. K\. Donepudi, and M\. S\. Choi\(2021\)Detecting fake news using machine learning: a systematic literature review\.arXiv preprint arXiv:2102\.04458\.Cited by:[§1](https://arxiv.org/html/2608.05741#S1.p1.1)\.
- \[3\]E\. Almazrouei, H\. Alobeidli, A\. Alshamsi, A\. Cappelli, R\. Cojocaru, M\. Debbah, É\. Goffinet, D\. Hesslow, J\. Launay, Q\. Malartic,et al\.\(2023\)The falcon series of open language models\.arXiv preprint arXiv:2311\.16867\.Cited by:[§4\.1](https://arxiv.org/html/2608.05741#S4.SS1.SSS0.Px3.p1.1)\.
- \[4\]G\. Bao, Y\. Zhao, Z\. Teng, L\. Yang, and Y\. Zhang\(2023\)Fast\-detectgpt: efficient zero\-shot detection of machine\-generated text via conditional probability curvature\.arXiv preprint arXiv:2310\.05130\.Cited by:[§2](https://arxiv.org/html/2608.05741#S2.SS0.SSS0.Px2.p1.1),[§4\.1](https://arxiv.org/html/2608.05741#S4.SS1.SSS0.Px2.p1.1)\.
- \[5\]T\. Brown, B\. Mann, N\. Ryder, M\. Subbiah, J\. D\. Kaplan, P\. Dhariwal, A\. Neelakantan, P\. Shyam, G\. Sastry, A\. Askell,et al\.\(2020\)Language models are few\-shot learners\.Advances in neural information processing systems33,pp\. 1877–1901\.Cited by:[§3\.1](https://arxiv.org/html/2608.05741#S3.SS1.SSS0.Px1.p1.3)\.
- \[6\]M\. Chakraborty, S\. M\. T\. I\. Tonmoy, S\. M\. M\. Zaman, K\. Sharma, N\. R\. Barman, C\. Gupta, S\. Gautam, T\. Kumar, V\. Jain, A\. Chadha, A\. P\. Sheth, and A\. Das\(2023\)Counter Turing test CT2: AI\-generated text detection is not as easy as you may think—introducing AI detectability index\.arXiv preprint arXiv:2310\.05030\.Cited by:[§2](https://arxiv.org/html/2608.05741#S2.SS0.SSS0.Px1.p1.1)\.
- \[7\]S\. Chakraborty, A\. S\. Bedi, S\. Zhu, B\. An, D\. Manocha, and F\. Huang\(2023\)On the possibilities of ai\-generated text detection\.arXiv preprint arXiv:2304\.04736\.Cited by:[§1](https://arxiv.org/html/2608.05741#S1.p2.1)\.
- \[8\]E\. Clark, T\. August, S\. Serrano, N\. Haduong, S\. Gururangan, and N\. A\. Smith\(2021\)All that’s ‘human’is not gold: evaluating human evaluation of generated text\.InProceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing \(Volume 1: Long Papers\),pp\. 7282–7296\.Cited by:[§1](https://arxiv.org/html/2608.05741#S1.p1.1)\.
- \[9\]L\. Dugan, A\. Hwang, F\. Trhlík, A\. Zhu, J\. M\. Ludan, H\. Xu, D\. Ippolito, and C\. Callison\-Burch\(2024\)Raid: a shared benchmark for robust evaluation of machine\-generated text detectors\.pp\. 12463–12492\.Cited by:[§4\.1](https://arxiv.org/html/2608.05741#S4.SS1.SSS0.Px1.p1.1)\.
- \[10\]S\. Gehrmann, H\. Strobelt, and A\. M\. Rush\(2019\)Gltr: statistical detection and visualization of generated text\.InProceedings of the 57th annual meeting of the association for computational linguistics: system demonstrations,pp\. 111–116\.Cited by:[§2](https://arxiv.org/html/2608.05741#S2.SS0.SSS0.Px2.p1.1),[§4\.1](https://arxiv.org/html/2608.05741#S4.SS1.SSS0.Px2.p1.1)\.
- \[11\]A\. Grattafiori, A\. Dubey, A\. Jauhri, A\. Pandey, A\. Kadian, A\. Al\-Dahle, A\. Letman, A\. Mathur, A\. Schelten, A\. Vaughan,et al\.\(2024\)The llama 3 herd of models\.arXiv preprint arXiv:2407\.21783\.Cited by:[§4\.1](https://arxiv.org/html/2608.05741#S4.SS1.SSS0.Px3.p1.1)\.
- \[12\]B\. Guo, X\. Zhang, Z\. Wang, M\. Jiang, J\. Nie, Y\. Ding, J\. Yue, and Y\. Wu\(2023\)How close is chatgpt to human experts? comparison corpus, evaluation, and detection\.arXiv preprint arXiv:2301\.07597\.Cited by:[§4\.1](https://arxiv.org/html/2608.05741#S4.SS1.SSS0.Px5.p1.1)\.
- \[13\]H\. Guo, S\. Cheng, X\. Jin, Z\. Zhang, K\. Zhang, G\. Tao, G\. Shen, and X\. Zhang\(2024\)Biscope: ai\-generated text detection by checking memorization of preceding tokens\.Advances in Neural Information Processing Systems37,pp\. 104065–104090\.Cited by:[§2](https://arxiv.org/html/2608.05741#S2.SS0.SSS0.Px1.p1.1),[§4\.1](https://arxiv.org/html/2608.05741#S4.SS1.SSS0.Px2.p1.1)\.
- \[14\]X\. Guo, S\. Zhang, Y\. He, T\. Zhang, W\. Feng, H\. Huang, and C\. Ma\(2024\)Detective: detecting ai\-generated text via multi\-level contrastive learning\.Advances in Neural Information Processing Systems37,pp\. 88320–88347\.Cited by:[§2](https://arxiv.org/html/2608.05741#S2.SS0.SSS0.Px1.p1.1)\.
- \[15\]A\. Hans, A\. Schwarzschild, V\. Cherepanova, H\. Kazemi, A\. Saha, M\. Goldblum, J\. Geiping, and T\. Goldstein\(2024\-21–27 Jul\)Spotting LLMs with binoculars: zero\-shot detection of machine\-generated text\.InProceedings of the 41st International Conference on Machine LearningProceedings of the 63rd Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\)Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\)Advances in Neural Information Processing Systems,R\. Salakhutdinov, Z\. Kolter, K\. Heller, A\. Weller, N\. Oliver, J\. Scarlett, and F\. Berkenkamp \(Eds\.\),Proceedings of Machine Learning Research, Vol\.23538,pp\. 17519–17537\.External Links:[Link](https://proceedings.mlr.press/v235/hans24a.html)Cited by:[§2](https://arxiv.org/html/2608.05741#S2.SS0.SSS0.Px2.p1.1),[§4\.1](https://arxiv.org/html/2608.05741#S4.SS1.SSS0.Px2.p1.1)\.
- \[16\]T\. B\. Hashimoto, H\. Zhang, and P\. Liang\(2019\)Unifying human and statistical evaluation for natural language generation\.InProceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 \(Long and Short Papers\),pp\. 1689–1701\.Cited by:[§2](https://arxiv.org/html/2608.05741#S2.SS0.SSS0.Px2.p1.1),[§4\.1](https://arxiv.org/html/2608.05741#S4.SS1.SSS0.Px2.p1.1)\.
- \[17\]Y\. He, S\. Zhang, Y\. Cao, L\. Ma, and P\. Luo\(2025\)DETree: detecting human–ai collaborative texts via tree\-structured hierarchical representation learning\.Cited by:[§2](https://arxiv.org/html/2608.05741#S2.SS0.SSS0.Px1.p1.1)\.
- \[18\]X\. Hu, P\. Chen, and T\. Ho\(2023\)Radar: robust ai\-text detection via adversarial learning\.Advances in neural information processing systems36,pp\. 15077–15095\.Cited by:[§2](https://arxiv.org/html/2608.05741#S2.SS0.SSS0.Px1.p1.1)\.
- \[19\]D\. Ippolito, D\. Duckworth, C\. Callison\-Burch, and D\. Eck\(2020\)Automatic detection of generated text is easiest when humans are fooled\.InProceedings of the 58th annual meeting of the association for computational linguistics,pp\. 1808–1822\.Cited by:[§2](https://arxiv.org/html/2608.05741#S2.SS0.SSS0.Px2.p1.1),[§4\.1](https://arxiv.org/html/2608.05741#S4.SS1.SSS0.Px2.p1.1)\.
- \[20\]Y\. Li, Q\. Li, L\. Cui, W\. Bi, Z\. Wang, L\. Wang, L\. Yang, S\. Shi, and Y\. Zhang\(2024\)MAGE: machine\-generated text detection in the wild\.InProceedings of the 62nd Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\),pp\. 36–53\.Cited by:[§1](https://arxiv.org/html/2608.05741#S1.p2.1)\.
- \[21\]R\. Liu, H\. Huang, X\. Xiao, and Z\. Wu\(2026\)Zero\-shot detection of llm\-generated text via implicit reward model\.arXiv preprint arXiv:2604\.21223\.Cited by:[1st item](https://arxiv.org/html/2608.05741#S1.I1.i1.p1.1),[§1](https://arxiv.org/html/2608.05741#S1.p2.1),[§2](https://arxiv.org/html/2608.05741#S2.SS0.SSS0.Px2.p1.1),[§3\.1](https://arxiv.org/html/2608.05741#S3.SS1.SSS0.Px3.p1.1),[§4\.1](https://arxiv.org/html/2608.05741#S4.SS1.SSS0.Px2.p1.1)\.
- \[22\]Meta\(2024\)Meta Llama 3 model card\.Note:[https://github\.com/meta\-llama/llama\-models/blob/main/models/llama3/MODEL\_CARD\.md](https://github.com/meta-llama/llama-models/blob/main/models/llama3/MODEL_CARD.md)Official model cardCited by:[§4\.1](https://arxiv.org/html/2608.05741#S4.SS1.SSS0.Px3.p1.1)\.
- \[23\]Meta\(2024\)Meta Llama 3\.1 model card\.Note:[https://huggingface\.co/meta\-llama/Llama\-3\.1\-8B\-Instruct](https://huggingface.co/meta-llama/Llama-3.1-8B-Instruct)Official model cardCited by:[§4\.1](https://arxiv.org/html/2608.05741#S4.SS1.SSS0.Px3.p1.1)\.
- \[24\]Meta\(2024\)Meta Llama 3\.2 model card\.Note:[https://github\.com/meta\-llama/llama\-models/blob/main/models/llama3\_2/MODEL\_CARD\.md](https://github.com/meta-llama/llama-models/blob/main/models/llama3_2/MODEL_CARD.md)Official model cardCited by:[§4\.1](https://arxiv.org/html/2608.05741#S4.SS1.SSS0.Px3.p1.1)\.
- \[25\]E\. Mitchell, Y\. Lee, A\. Khazatsky, C\. D\. Manning, and C\. Finn\(2023\)Detectgpt: zero\-shot machine\-generated text detection using probability curvature\.InInternational conference on machine learning,pp\. 24950–24962\.Cited by:[§2](https://arxiv.org/html/2608.05741#S2.SS0.SSS0.Px2.p1.1)\.
- \[26\]L\. Ouyang, J\. Wu, X\. Jiang, D\. Almeida, C\. Wainwright, P\. Mishkin, C\. Zhang, S\. Agarwal, K\. Slama, A\. Ray,et al\.\(2022\)Training language models to follow instructions with human feedback\.Advances in neural information processing systems35,pp\. 27730–27744\.Cited by:[§3\.1](https://arxiv.org/html/2608.05741#S3.SS1.SSS0.Px2.p1.1)\.
- \[27\]R\. Rafailov, A\. Sharma, E\. Mitchell, C\. D\. Manning, S\. Ermon, and C\. Finn\(2023\)Direct preference optimization: your language model is secretly a reward model\.Advances in neural information processing systems36,pp\. 53728–53741\.Cited by:[§3\.1](https://arxiv.org/html/2608.05741#S3.SS1.SSS0.Px2.p1.1)\.
- \[28\]I\. Solaiman, M\. Brundage, J\. Clark, A\. Askell, A\. Herbert\-Voss, J\. Wu, A\. Radford, G\. Krueger, J\. W\. Kim, S\. Kreps,et al\.\(2019\)Release strategies and the social impacts of language models\.arXiv preprint arXiv:1908\.09203\.Cited by:[§2](https://arxiv.org/html/2608.05741#S2.SS0.SSS0.Px1.p1.1),[§4\.1](https://arxiv.org/html/2608.05741#S4.SS1.SSS0.Px2.p1.1)\.
- \[29\]Y\. Song, Z\. Yuan, S\. Zhang, Z\. Fang, J\. Yu, and F\. Liu\(2025\)Deep kernel relative test for machine\-generated text detection\.InThe Thirteenth International Conference on Learning Representations,Cited by:[§2](https://arxiv.org/html/2608.05741#S2.SS0.SSS0.Px1.p1.1),[§4\.1](https://arxiv.org/html/2608.05741#S4.SS1.SSS0.Px2.p1.1)\.
- \[30\]J\. Su, T\. Zhuo, D\. Wang, and P\. Nakov\(2023\)Detectllm: leveraging log rank information for zero\-shot detection of machine\-generated text\.InFindings of the Association for Computational Linguistics: EMNLP 2023,pp\. 12395–12412\.Cited by:[§2](https://arxiv.org/html/2608.05741#S2.SS0.SSS0.Px2.p1.1)\.
- \[31\]A\. Uchendu, T\. Le, K\. Shu, and D\. Lee\(2020\)Authorship attribution for neural text generation\.InProceedings of the 2020 conference on empirical methods in natural language processing \(EMNLP\),pp\. 8384–8395\.Cited by:[§1](https://arxiv.org/html/2608.05741#S1.p2.1),[§2](https://arxiv.org/html/2608.05741#S2.SS0.SSS0.Px1.p1.1)\.
- \[32\]A\. Vaswani, N\. Shazeer, N\. Parmar, J\. Uszkoreit, L\. Jones, A\. N\. Gomez, Ł\. Kaiser, and I\. Polosukhin\(2017\)Attention is all you need\.Advances in neural information processing systems30\.Cited by:[§3\.1](https://arxiv.org/html/2608.05741#S3.SS1.SSS0.Px2.p1.3)\.
- \[33\]J\. Wu, R\. Zhan, D\. F\. Wong, S\. Yang, X\. Yang, Y\. Yuan, and L\. S\. Chao\(2024\)Detectrl: benchmarking llm\-generated text detection in real\-world scenarios\.Advances in Neural Information Processing Systems37,pp\. 100369–100401\.Cited by:[§4\.1](https://arxiv.org/html/2608.05741#S4.SS1.SSS0.Px1.p1.1)\.
- \[34\]Y\. Xu, Y\. Wang, Y\. Bi, H\. Cao, Z\. Lin, Y\. Zhao, and F\. Wu\(2024\)Training\-free llm\-generated text detection by mining token probability sequences\.arXiv preprint arXiv:2410\.06072\.Cited by:[§2](https://arxiv.org/html/2608.05741#S2.SS0.SSS0.Px2.p1.1),[§4\.1](https://arxiv.org/html/2608.05741#S4.SS1.SSS0.Px2.p1.1)\.
- \[35\]A\. Yang, B\. Yang, B\. Zhang, B\. Hui, B\. Zheng, B\. Yu, C\. Li, D\. Liu, F\. Huang, H\. Wei, H\. Lin, J\. Yang, J\. Tu, J\. Zhang, J\. Yang, J\. Yang, J\. Zhou, J\. Lin, K\. Dang, K\. Lu, K\. Bao, K\. Yang, L\. Yu, M\. Li, M\. Xue, P\. Zhang, Q\. Zhu, R\. Men, R\. Lin, T\. Li, T\. Xia, X\. Ren, X\. Ren, Y\. Fan, Y\. Su, Y\. Zhang, Y\. Wan, Y\. Liu, Z\. Cui, Z\. Zhang, and Z\. Qiu\(2024\)Qwen2\.5 technical report\.arXiv preprint arXiv:2412\.15115\.Cited by:[§4\.1](https://arxiv.org/html/2608.05741#S4.SS1.SSS0.Px3.p1.1)\.
- \[36\]X\. Zhu, Y\. Ren, Y\. Cao, X\. Lin, F\. Fang, and Y\. Li\(2025\)Reliably bounding false positives: a zero\-shot machine\-generated text detection framework via multiscaled conformal prediction\.pp\. 12298–12319\.Cited by:[§4\.1](https://arxiv.org/html/2608.05741#S4.SS1.SSS0.Px1.p1.1)\.
- \[37\]X\. Zhu, Y\. Ren, F\. Fang, Q\. Tan, S\. Wang, and Y\. Cao\(2025\)DNA\-detectllm: unveiling ai\-generated text via a dna\-inspired mutation\-repair paradigm\.arXiv preprint arXiv:2509\.15550\.Cited by:[§2](https://arxiv.org/html/2608.05741#S2.SS0.SSS0.Px2.p1.1),[§4\.1](https://arxiv.org/html/2608.05741#S4.SS1.SSS0.Px2.p1.1)\.

## Appendix ALimitations

Like other zero\-shot detectors, EchoPrompt still depends on the choice of proxy family\. In addition, the present prompt study shows that adding semantic context is useful, but it does not establish that the current prompt is globally optimal\.

## Appendix BBroader Impacts

EchoPrompt may help with misinformation mitigation, educational integrity, authorship transparency, and platform governance by providing a training\-free signal for detecting LLM\-generated text\. However, automated detection can also cause harm\. False positives may wrongly label human\-written text as machine\-generated, and false negatives may miss generated content\. These risks are more serious in high\-stakes settings such as education, employment, publishing, and content moderation\. Therefore, EchoPrompt should be used as an auxiliary signal, not as definitive evidence of authorship\.

## Appendix CEmpirical Study of Global Prefix Design

We determine the global prefixcgc\_\{g\}through preliminary empirical studies under a fixed EchoPrompt setting\. Specifically, we compare different prompt types and semantically related prompt families using Qwen2\.5\-3B / Qwen2\.5\-3B\-Instruct on 500 human and 500 machine samples from DetectRL Multi\-Domain\. This subset is used only for lightweight preliminary prompt selection rather than for reporting main detection performance\. Although it is sampled from the same benchmark pool, it contains only a small random subset of examples, the selected prefix is fixed before all subsequent evaluations, and the proxy pair used in this prompt study is different from the proxy models emphasized in the main results\. All samples are truncated to at most 1024 tokens, and the remaining scoring configuration follows the main experimental setup\. Table[4](https://arxiv.org/html/2608.05741#A3.T4)and Table[5](https://arxiv.org/html/2608.05741#A3.T5)list the candidate prefixes considered in the prompt\-type study and the semantic\-family study, respectively\. Table[6](https://arxiv.org/html/2608.05741#A3.T6)and Table[7](https://arxiv.org/html/2608.05741#A3.T7)then summarize the corresponding comparison results used to select the final global prefix\.

Table 4:Candidate prefixes in the prompt\-type study\.Table 5:Candidate prefixes in the semantic\-family study\.Table 6:Prompt\-type comparison among candidate global prefixes\.Table 7:Semantic\-family comparison among candidate global prefixes\.
## Appendix DContext\-Conditioned Gain Under Assistant\-Style Context

Table[8](https://arxiv.org/html/2608.05741#A4.T8)reports the base\-model context\-conditioned gains for the four proxy families used in the contextual restoration validation\.

Table 8:Context\-conditioned gain under an assistant\-style prefix for the base models of four proxy families on 1,000 randomly sampled pairs from DetectRL Multi\-Domain and DetectRL Multi\-LLM\. For each dataset and proxy family, the table reports the human\-side and machine\-side mean gaing​\(X;cg\)g\(X;c\_\{g\}\)\.
## Appendix EFull Main Results Across Proxy Pairs

TableLABEL:tab:appendix\-main\-results\-fullreports the complete main\-results table, with the proxy\-independent training\-based block followed by all evaluated training\-free proxy pairs\.

## Appendix FFull Per\-Attack Results

TableLABEL:tab:appendix\-attack\-detailsreports the complete per\-attack AUROC and F1 score results, with the proxy\-independent training\-based block followed by all training\-free proxy pairs\.

## Appendix GPrompt\-Component Ablation

To analyze the contribution of each part of the generic prefix, we decompose it into three interpretable components\. The*role sentence*is “You are a helpful, versatile, and intelligent AI assistant\.” The*context clause A*is “Below is the content you generated in response to a user’s request,” and*context clause B*specifies that the continuation may take the form of “a coherent continuation, topic\-specific article, or detailed answer to a question\.” We conduct the ablation using two proxy families, Qwen2\.5\-3B and Llama\-3\.1\-8B\. For both DetectRL Multi\-Domain and DetectRL Multi\-LLM, we randomly sample 1,000 paired examples from each dataset\.

Table 9:Full main results \(%\) across all proxy pairs and benchmarks\. Bold and underlines mark the best and second\-best results within each training\-free proxy block\.DetectorsDetectRLMulti\-DomainDetectRLMulti\-LLMDetectRLMulti\-AttackRealDetRAIDAvgAUROCF1AUROCF1AUROCF1AUROCF1AUROCF1AUROCF1Training\-based MethodsOpenAI\-D82\.6476\.0082\.5875\.6183\.9178\.0290\.0677\.1573\.0367\.1982\.4474\.80BiScope76\.8170\.7576\.9170\.3779\.1074\.0788\.9072\.0879\.4273\.9380\.2372\.24R\-Detect77\.8373\.2978\.2273\.5278\.5474\.1887\.8472\.7370\.7568\.3978\.6472\.42Training\-free MethodsQwen2\.5\-1\.5B familyEntropy73\.3367\.8073\.3367\.9976\.6774\.2086\.3480\.2372\.7968\.3476\.4971\.71Likelihood70\.6566\.6770\.3466\.6774\.1073\.6086\.0381\.7575\.7972\.2975\.3872\.20LogRank72\.0866\.6771\.7566\.6875\.3373\.8087\.5382\.2377\.2372\.8976\.7872\.45Fast\-DetectGPT65\.9566\.7765\.0066\.7467\.2667\.2378\.2373\.2677\.5275\.3470\.7969\.87Binoculars64\.9566\.7063\.9066\.6866\.2167\.2477\.0273\.9277\.3176\.7769\.8870\.26LastDE\+\+53\.4366\.6852\.1666\.6868\.7968\.2274\.2369\.3978\.6574\.5765\.4569\.11DNA\-DetectLLM69\.2566\.7168\.2266\.6869\.4967\.1276\.4273\.3076\.2975\.0871\.9369\.78IRM75\.2371\.7874\.5671\.2774\.4771\.1067\.0467\.9265\.6966\.6771\.4069\.75EchoPrompt82\.4478\.8781\.7478\.5283\.7180\.2067\.7769\.4368\.2367\.5276\.7874\.91Qwen2\.5\-3B familyEntropy74\.4269\.1774\.0668\.5577\.8074\.5684\.7979\.6271\.5667\.0176\.5371\.78Likelihood70\.3866\.6869\.9366\.6773\.5273\.3683\.8679\.5675\.2771\.7974\.5971\.61LogRank72\.2566\.8671\.7766\.6875\.1273\.8186\.0180\.6076\.6972\.2676\.3772\.04Fast\-DetectGPT67\.8467\.3867\.4767\.3869\.6769\.1974\.6769\.9476\.3074\.0771\.1969\.59Binoculars66\.2966\.9466\.0466\.9869\.2268\.8372\.9669\.7676\.1174\.7670\.1269\.45LastDE\+\+56\.6466\.8356\.5566\.7871\.7969\.8970\.0167\.2677\.7273\.3366\.5468\.82DNA\-DetectLLM73\.1067\.4072\.6567\.1374\.0769\.8173\.1869\.4775\.1574\.0973\.6369\.58IRM62\.2566\.6761\.3966\.6861\.5666\.7555\.1366\.8259\.2266\.6759\.9166\.72EchoPrompt76\.0274\.2275\.1173\.6977\.3874\.9563\.2467\.5566\.9467\.5071\.7471\.58Llama\-3\.2\-1B familyEntropy75\.3469\.8874\.8769\.0678\.4876\.7486\.8880\.7776\.1572\.1578\.3473\.72Likelihood79\.7173\.9179\.3673\.5182\.6178\.1987\.7483\.8577\.8974\.2181\.4676\.73LogRank79\.8973\.8379\.4573\.5582\.5078\.1288\.4084\.0178\.6974\.4981\.7976\.80Fast\-DetectGPT90\.7683\.2590\.4382\.8591\.6684\.6489\.4385\.1483\.6983\.8289\.1983\.94Binoculars91\.9185\.3191\.6484\.9592\.7786\.7790\.7087\.1183\.9783\.9490\.2085\.61LastDE\+\+79\.9972\.4879\.3371\.6282\.2777\.0783\.8177\.0784\.9281\.1082\.0675\.87DNA\-DetectLLM93\.0787\.0192\.7686\.1593\.7388\.0191\.0586\.7683\.5182\.4590\.8286\.08IRM97\.3991\.7497\.2391\.4297\.2391\.9991\.3282\.7184\.6579\.5393\.5687\.48EchoPrompt96\.0789\.7195\.4388\.7495\.7890\.5492\.4886\.6286\.9881\.7393\.3587\.47Llama\-3\.2\-3B familyEntropy74\.9369\.3174\.3667\.8177\.2575\.4483\.9779\.0974\.6170\.8177\.0372\.49Likelihood79\.5573\.8879\.2073\.2282\.1877\.2986\.8482\.5176\.7873\.3080\.9176\.04LogRank79\.8473\.7679\.4173\.0682\.2477\.3887\.6582\.6077\.8273\.9281\.3976\.15Fast\-DetectGPT90\.0382\.1789\.7581\.8890\.7183\.5189\.4783\.3184\.0283\.0988\.8082\.79Binoculars91\.1984\.4290\.8883\.9191\.7385\.4390\.6685\.7784\.3683\.2089\.7684\.55LastDE\+\+79\.8972\.6179\.5271\.9581\.9176\.5883\.3975\.8785\.9480\.9482\.1375\.59DNA\-DetectLLM92\.5585\.8692\.1585\.5592\.8286\.9390\.5085\.3483\.2781\.0490\.2684\.94IRM97\.2791\.8097\.2391\.4997\.2591\.7488\.9481\.1182\.7576\.9692\.6986\.62EchoPrompt97\.0191\.2496\.5590\.9396\.8791\.9190\.8485\.3384\.4178\.3693\.1487\.55Falcon\-7B familyEntropy66\.2966\.6866\.1066\.6972\.4572\.8987\.0881\.2372\.2868\.0672\.8471\.11Likelihood68\.0966\.6867\.8866\.6972\.3972\.4486\.2581\.4775\.1672\.1173\.9571\.88LogRank68\.6366\.6868\.2966\.6972\.2072\.6687\.3581\.7776\.2872\.5974\.5572\.08Fast\-DetectGPT82\.8076\.1582\.3375\.9284\.0477\.3090\.8186\.9884\.8486\.5384\.9680\.58Binoculars83\.8778\.2883\.2978\.2585\.1379\.4291\.4088\.3184\.9586\.4085\.7382\.13LastDE\+\+75\.8169\.7175\.3869\.0678\.6774\.9790\.3384\.1289\.0586\.2881\.8576\.83DNA\-DetectLLM89\.2783\.0188\.8782\.4590\.0283\.8192\.4588\.6486\.4886\.9889\.4284\.98IRM82\.8376\.2782\.6275\.8584\.5478\.0281\.5974\.3278\.3172\.5181\.9875\.39EchoPrompt87\.8281\.6287\.3680\.9688\.6482\.6886\.8983\.5283\.8479\.8086\.9181\.72Llama\-3\.1\-8B familyEntropy68\.4566\.6868\.0166\.6871\.3272\.6080\.1674\.5369\.7466\.6971\.5469\.44Likelihood74\.8869\.1774\.5968\.1977\.5174\.1183\.5179\.1973\.9170\.3376\.8872\.20LogRank74\.9469\.0574\.5868\.2177\.4074\.0284\.2679\.3774\.8970\.9677\.2272\.32Fast\-DetectGPT85\.1977\.1484\.9976\.9786\.7179\.8286\.5979\.3282\.6981\.7185\.2478\.99Binoculars85\.9378\.3985\.8178\.1087\.3880\.8887\.3381\.8182\.9181\.3585\.8780\.11LastDE\+\+77\.2270\.1576\.7769\.9580\.0276\.2483\.1675\.9586\.5081\.4480\.7374\.75DNA\-DetectLLM87\.1679\.9286\.9479\.5688\.5681\.4687\.4181\.6481\.0179\.1286\.2280\.34IRM88\.8382\.5388\.9682\.3588\.8382\.8782\.2375\.9079\.3772\.1085\.6579\.15EchoPrompt95\.1089\.1395\.3789\.5095\.6189\.9088\.8882\.6785\.2178\.1092\.0385\.86Llama\-3\-8B familyEntropy64\.3166\.7164\.1466\.6867\.6471\.0677\.0873\.0467\.7366\.6968\.1868\.84Likelihood79\.5473\.5779\.2472\.7581\.7176\.1285\.5381\.1875\.8973\.1180\.3875\.34LogRank76\.8370\.7076\.3969\.6379\.1774\.6385\.3480\.8175\.8072\.4978\.7173\.65Fast\-DetectGPT91\.4084\.0291\.4583\.6192\.6385\.8388\.9082\.9683\.6883\.0189\.6183\.89Binoculars91\.9384\.9892\.0184\.5793\.1086\.6189\.5884\.4683\.7382\.4990\.0784\.62LastDE\+\+84\.2676\.7284\.2676\.7486\.6980\.4389\.1081\.7487\.8183\.9486\.4279\.91DNA\-DetectLLM90\.4183\.2890\.5582\.9991\.8685\.0587\.7582\.4280\.9480\.5588\.3082\.86IRM98\.4794\.0698\.5093\.8998\.3693\.9291\.5183\.4387\.5281\.4294\.8789\.34EchoPrompt98\.8295\.2698\.6295\.2598\.6095\.2892\.3388\.7989\.4585\.3295\.5691\.98Table 10:Per\-attack results \(%\) on DetectRL attack subsets\. Bold and underlines mark the best and second\-best results within each training\-free proxy block\.DetectorsDirect PromptPrompt AttacksParaphrasePerturbationData MixingAUROCF1AUROCF1AUROCF1AUROCF1AUROCF1Training\-based MethodsOpenAI\-D93\.1283\.6588\.0878\.7187\.4879\.1271\.0072\.0179\.8576\.62BiScope93\.6186\.4391\.0283\.0671\.6866\.6767\.9667\.5471\.2466\.67R\-Detect90\.0980\.3485\.3176\.9686\.7678\.1662\.0968\.7668\.4666\.69Training\-free MethodsQwen2\.5\-1\.5B familyEntropy93\.4086\.4391\.0883\.8067\.4466\.6961\.5167\.3069\.9266\.76Likelihood92\.8286\.0388\.5281\.9669\.7966\.6751\.9366\.6767\.4166\.67LogRank93\.5086\.6289\.1682\.3770\.4166\.6754\.2866\.6769\.2766\.67Fast\-DetectGPT75\.3769\.1370\.4366\.7370\.4666\.8454\.1166\.7865\.9466\.67Binoculars74\.3069\.4269\.5466\.6969\.5566\.7352\.3366\.6965\.3566\.67LastDE\+\+74\.2968\.4069\.4166\.7166\.5566\.8478\.5372\.4855\.1966\.67DNA\-DetectLLM73\.6168\.4468\.9466\.6971\.9867\.0563\.4566\.7569\.4666\.67IRM71\.0768\.9469\.6968\.1376\.2072\.4977\.6073\.9077\.8072\.05EchoPrompt81\.1978\.6081\.6078\.7580\.3478\.5584\.9182\.1090\.4983\.00Qwen2\.5\-3B familyEntropy92\.7885\.9490\.1782\.9865\.4266\.6967\.0568\.8773\.6068\.31Likelihood92\.3284\.8688\.7281\.9668\.3066\.6751\.9566\.6766\.3166\.67LogRank93\.4786\.4189\.3882\.6369\.0866\.6755\.1066\.6968\.5566\.67Fast\-DetectGPT81\.2273\.6877\.0370\.6371\.8767\.7150\.4367\.2567\.7966\.67Binoculars80\.5073\.4776\.1470\.0970\.7467\.2552\.2966\.6766\.4166\.67LastDE\+\+80\.2572\.9675\.8369\.7569\.1067\.7576\.3472\.3057\.4366\.67DNA\-DetectLLM81\.6174\.6377\.0670\.2574\.4268\.5562\.6567\.0474\.6068\.60IRM63\.8066\.6761\.7266\.9467\.9966\.8353\.1666\.6761\.1266\.67EchoPrompt79\.2476\.8579\.6877\.4475\.0973\.7170\.3170\.9682\.5575\.79Llama\-3\.2\-1B familyEntropy97\.2092\.3295\.0489\.5071\.8868\.5557\.3766\.6970\.8866\.67Likelihood96\.9991\.6993\.5787\.3476\.1071\.6967\.4966\.6978\.9073\.56LogRank97\.0292\.0393\.2187\.4976\.4371\.8467\.1666\.6978\.6972\.53Fast\-DetectGPT98\.2693\.1294\.9288\.5288\.8681\.0986\.8279\.0689\.4481\.43Binoculars99\.0795\.6796\.1391\.1790\.2183\.3388\.1881\.0690\.2482\.59LastDE\+\+94\.8887\.9290\.5083\.5282\.8875\.1263\.8966\.6979\.1972\.07DNA\-DetectLLM99\.5196\.6397\.3893\.1490\.1483\.6390\.9583\.8690\.6582\.77IRM98\.9495\.4897\.6292\.8398\.0092\.5195\.6588\.6295\.9590\.48EchoPrompt97\.5294\.7096\.4991\.9096\.9691\.8095\.0487\.7896\.4791\.17Llama\-3\.2\-3B familyEntropy97\.2692\.5695\.0589\.5072\.0368\.5756\.8466\.6971\.3266\.67Likelihood97\.1491\.8593\.6587\.8776\.2871\.5067\.5066\.6879\.0472\.69LogRank97\.1691\.8893\.2987\.3976\.5071\.3467\.1166\.6978\.7872\.55Fast\-DetectGPT98\.2793\.4394\.9588\.7588\.5780\.9385\.4177\.8688\.8480\.68Binoculars98\.7794\.6195\.8090\.4089\.4181\.9187\.0679\.1189\.8381\.61LastDE\+\+95\.0988\.1290\.3783\.3482\.5374\.9564\.9066\.6779\.7672\.86DNA\-DetectLLM98\.2293\.6796\.7991\.7291\.6184\.7293\.2485\.7692\.0284\.15IRM99\.2295\.7397\.7693\.0998\.3493\.4198\.2493\.7896\.5790\.81EchoPrompt98\.5894\.7996\.6191\.3096\.0889\.7996\.3890\.4794\.4387\.87Falcon\-7B familyEntropy87\.5880\.6085\.6979\.1569\.8567\.3171\.6768\.0977\.4571\.81Likelihood84\.9978\.3383\.4276\.7271\.7767\.7671\.7867\.6579\.9872\.68LogRank84\.7977\.9183\.3176\.5871\.6767\.7072\.2667\.7880\.2372\.82Fast\-DetectGPT95\.3489\.8892\.9186\.9781\.9574\.3180\.6474\.2689\.3481\.27Binoculars95\.8790\.8993\.3587\.7382\.4075\.0781\.2774\.9889\.7681\.80LastDE\+\+91\.5884\.4388\.2380\.3976\.5769\.2172\.3467\.5183\.3576\.18DNA\-DetectLLM96\.5391\.7394\.4088\.8983\.6675\.9484\.2776\.8491\.2182\.99IRM85\.9478\.8084\.2677\.1372\.7468\.2672\.6668\.0380\.5373\.02EchoPrompt96\.6592\.2894\.5189\.2685\.8779\.6488\.8083\.1992\.5585\.17Llama\-3\.1\-8B familyEntropy91\.2082\.7288\.5680\.0459\.2266\.6755\.8666\.9161\.7466\.67Likelihood94\.1187\.1990\.7083\.1768\.3266\.6763\.8866\.8570\.5366\.67LogRank93\.9787\.0190\.1682\.7768\.2866\.6764\.2466\.9470\.3766\.69Fast\-DetectGPT94\.4587\.9691\.9685\.5084\.3976\.8777\.3771\.3585\.3677\.41Binoculars95\.1489\.6192\.7187\.1484\.9377\.5978\.2472\.4785\.9177\.60LastDE\+\+92\.4885\.4189\.5082\.1582\.1875\.3358\.3166\.6977\.6071\.62DNA\-DetectLLM95\.7689\.7493\.5287\.5982\.4974\.7383\.6776\.4687\.3578\.78IRM85\.8180\.4286\.4680\.4590\.7884\.5490\.4784\.3090\.6284\.65EchoPrompt96\.0190\.5695\.2189\.0694\.8588\.8997\.3292\.5294\.6688\.46Llama\-3\-8B familyEntropy86\.3778\.3784\.3976\.7356\.0066\.6752\.0266\.8759\.4366\.67Likelihood95\.6489\.3992\.3385\.3573\.3168\.6671\.7767\.6075\.4869\.59LogRank94\.8688\.2691\.0983\.9470\.7566\.6766\.7967\.2072\.3667\.08Fast\-DetectGPT97\.4592\.5295\.3289\.4390\.8483\.6888\.2280\.1691\.3183\.36Binoculars97\.8993\.3095\.9190\.8891\.1584\.1188\.8180\.7891\.7283\.96LastDE\+\+96\.7290\.5093\.9187\.9588\.5981\.0370\.3566\.7583\.8775\.92DNA\-DetectLLM97\.4092\.3595\.8490\.4087\.2479\.6088\.3679\.9690\.4882\.93IRM98\.7094\.5997\.7392\.7699\.1595\.6398\.9094\.8497\.3191\.76EchoPrompt99\.6297\.3398\.1394\.8198\.2894\.5399\.2497\.0497\.7492\.70