Are AI-Generated Text Detectors Robust to Adversarial Perturbations?

TL;DR

This work tackles the vulnerability of AI-generated text detectors to adversarial perturbations. It introduces SCRN, a reconstruction-based detector with an encoder, a reconstruction/denoising network, and a classifier, trained with a siamese calibration objective to achieve consistent predictions under noise. By disentangling semantic content from perturbations and forcing stable outputs via a symmetric KL constraint, SCRN attains strong robustness across in-domain, cross-domain, cross-genre, and mixed-source settings, outperforming a wide range of baselines. The results demonstrate SCRN’s practical potential for reliable AIGT detection in real-world, diverse data scenarios, with publicly available code for reproducibility.

Abstract

The widespread use of large language models (LLMs) has sparked concerns about the potential misuse of AI-generated text, as these models can produce content that closely resembles human-generated text. Current detectors for AI-generated text (AIGT) lack robustness against adversarial perturbations, with even minor changes in characters or words causing a reversal in distinguishing between human-created and AI-generated text. This paper investigates the robustness of existing AIGT detection methods and introduces a novel detector, the Siamese Calibrated Reconstruction Network (SCRN). The SCRN employs a reconstruction network to add and remove noise from text, extracting a semantic representation that is robust to local perturbations. We also propose a siamese calibration technique to train the model to make equally confidence predictions under different noise, which improves the model's robustness against adversarial perturbations. Experiments on four publicly available datasets show that the SCRN outperforms all baseline methods, achieving 6.5\%-18.25\% absolute accuracy improvement over the best baseline method under adversarial attacks. Moreover, it exhibits superior generalizability in cross-domain, cross-genre, and mixed-source scenarios. The code is available at \url{https://github.com/CarlanLark/Robust-AIGC-Detector}.

Figures (5)

• Figure 1: An example of adversarial perturbation to a RoBERTa-based AIGT detector.
• Figure 2: The architecture of SCRN. The input is first encoded by a pre-trained RoBERTa encoder. Then the representation is mapped to a lower-dimensional space by the Re-Encoder to construct the semantic term and the perturbation term, based on which the representation is reconstructed by the Re-Decoder. The denoised representation is used to predict class distributions. Finally, a discrepancy loss is minimized to calibrate the class distributions of two parameter-shared branches.
• Figure 3: Inference time comparison of RoBERTa, RanMASK, RMLM, and SCRN on HC3 test set. The experiments are conducted on a single 32GB NVIDIA-V100 GPU.
• Figure 4: Inference fluctuation between two sub branches of SCRN on HC3 test set.
• Figure 5: Cases from the Ghostbuster dataset are depicted in the figure. Case #1 and #2 represent AI-generated samples, whereas Case #3 and #4 are human-created samples. In cross-genre scenarios, RMLM fails to defend against adversarial text perturbations, whereas our SCRN demonstrates superior robustness. These cases highlight successful attacks on RMLM, while all adversarial attacks on these texts are unsuccessful against SCRN. Perturbed words or characters are [[highlighted]], while unchanged text is omitted for clarity.