Zero-Shot Statistical Tests for LLM-Generated Text Detection using Finite Sample Concentration Inequalities
Tara Radvand, Mojtaba Abdolmaleki, Mohamed Mostagir, Ambuj Tewari
TL;DR
The paper tackles the problem of determining whether a text was generated by a known LLM using zero-shot statistical tests. By modeling LLM output as a history-dependent sequence and leveraging log-perplexity and cross-entropy, it derives concentration inequalities that yield exponential decay of Type I and II errors with text length $N$. The authors establish two main results: (i) when evaluator and generator are the same, log-perplexity converges to the entropy; (ii) when they differ, it converges to the average cross-entropy, with exponentially small tails. They operationalize these insights into tests for attribution among multiple LLMs and for confirming whether text was produced by a specific model, under white-box and limited black-box conditions, and validate them with extensive experiments showing superior performance over non-commercial baselines and robustness to adversarial attacks. The work provides a theoretically principled, scalable approach to LLM-text detection with practical implications for provenance, accountability, and content moderation.
Abstract
Verifying the provenance of content is crucial to the function of many organizations, e.g., educational institutions, social media platforms, firms, etc. This problem is becoming increasingly challenging as text generated by Large Language Models (LLMs) becomes almost indistinguishable from human-generated content. In addition, many institutions utilize in-house LLMs and want to ensure that external, non-sanctioned LLMs do not produce content within the institution. In this paper, we answer the following question: Given a piece of text, can we identify whether it was produced by a particular LLM or not? We model LLM-generated text as a sequential stochastic process with complete dependence on history. We then design zero-shot statistical tests to (i) distinguish between text generated by two different known sets of LLMs $A$ (non-sanctioned) and $B$ (in-house), and (ii) identify whether text was generated by a known LLM or generated by any unknown model, e.g., a human or some other language generation process. We prove that the type I and type II errors of our test decrease exponentially with the length of the text. For that, we show that if $B$ generates the text, then except with an exponentially small probability in string length, the log-perplexity of the string under $A$ converges to the average cross-entropy of $B$ and $A$. We then present experiments using LLMs with white-box access to support our theoretical results and empirically examine the robustness of our results to black-box settings and adversarial attacks. In the black-box setting, our method achieves an average TPR of 82.5\% at a fixed FPR of 5\%. Under adversarial perturbations, our minimum TPR is 48.6\% at the same FPR threshold. Both results outperform all non-commercial baselines. See https://github.com/TaraRadvand74/llm-text-detection for code, data, and an online demo of the project.