Research map / Image generation / Text-to-image diffusion
ALISON: Fast and Effective Stylometric Authorship Obfuscation
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes ALISON, a fast blind authorship obfuscation method that replaces POS n-gram sequences ranked by Integrated Gradients from a lightweight internal NN classifier, filling replacements with a masked BERT, achieving 10x+ speedups over prior AO methods.
Problem
Authorship obfuscation against transformer-based authorship attribution classifiers is impractical: existing methods need black-box queries to the target and take hours to run, and lack interpretability.
Approach
Train one lightweight neural network on character and POS n-gram frequency features as an internal stylometric AA classifier, rank POS n-grams with Integrated Gradients (scaled by c^length), and replace matched multi-token spans in a single masked-PLM forward pass, without querying the target classifier.
Key results
- On TuringBench, ALISON lowers BERT-target accuracy to 0.6962 vs 0.7089 for the best competitor, and reduces DistilBERT accuracy to 0.5823 (21.90% better than the next best).
- ALISON runs in 12 min one-time training and 0.8 s per sample on TuringBench versus 2-6 hrs training and 3 min-8 s inference for baselines.
- ALISON achieves the lowest LLaMA2-7B perplexity (20.82 on TuringBench, 12.11 on Blog) and reduces accuracy on ChatGPT-text detectors to at most 0.617.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use ALISON instead of the strongest listed baseline | Authorship obfuscation against BERT · TuringBench | accuracy: 0.7089 -> 0.6962 | Helped |
| Use ALISON instead of the strongest listed baseline | Authorship obfuscation against DistilBERT · TuringBench | accuracy: 0.7722 -> 0.5823 | Helped |
| Use ALISON instead of the strongest listed baseline | Authorship obfuscation against RoBERTa · TuringBench | accuracy: 0.6901 -> 0.6620 | Helped |
| Use ALISON instead of the strongest listed baseline | Authorship obfuscation against BERT · Blog Authorship Corpus | accuracy: 0.9022 -> 0.8804 | Helped |
| Use ALISON instead of the strongest listed baseline | Authorship obfuscation against DistilBERT · Blog Authorship Corpus | accuracy: 0.8810 -> 0.7738 | Helped |
| Use ALISON instead of the strongest listed baseline | Authorship obfuscation against RoBERTa · Blog Authorship Corpus | accuracy: 0.3369 -> 0.3053 | Helped |
| Increase the number of POS sequences changed (L) (ablation) | ALISON · TuringBench | obfuscation success | Helped |
| Increase the number of POS sequences changed (L) (ablation) | ALISON · TuringBench | semantic preservation | Hurt |
| Vary the feature-length importance scaling constant c from 1.0 to 1.6 (ablation) | ALISON · TuringBench | semantic preservation | No clear effect |
| Vary the feature-length importance scaling constant c from 1.0 to 1.6 (ablation) | ALISON · TuringBench | obfuscation success | Mixed |
Surprising findings
- ALISON scores lowest on METEOR across both datasets, which the authors attribute to spacing artifacts from PLM reconstruction rather than semantic loss.
- Without any substitutions, the spacing changes from the PLM reconstruction reduce METEOR to 0.93 (TuringBench) and 0.90 (Blog).
Limitations
- METEOR scores are lowest for ALISON because of spacing artifacts introduced by the reconstruction process.
- Some substitutions change meaning (e.g., white to black) or delete words, reducing semantic fidelity.
- Evaluation limited to closed-world setting with a small pool of 10 or 20 authors and three target classifiers.
Experimental setup
Datasets: TuringBench Blog Authorship Corpus
Benchmarks: TuringBench Blog Authorship Corpus
Metrics: accuracy F1-score METEOR USE cosine similarity BERTScore perplexity running time label entropy
Baselines: Mutant-X Avengers TextFooler-wordCNN TextFooler-wordLSTM TextFooler-POS BERT-Attack ChatGPT paraphrasing
Builds on: Mutant-X Avengers Ensemble TextFooler BERT-Attack Integrated Gradients
Closest papers by meaning
- A Synthetic Dataset for Personal Attribute Inference (NeurIPS 2024 · similarity 0.83)
- Beyond Memorization: Violating Privacy via Inference with Large Language Models (ICLR 2024 · similarity 0.82)
- Language Models are Advanced Anonymizers (ICLR 2025 · similarity 0.81)
- CROSSNEWS: A Cross-Genre Authorship Verification and Attribution Benchmark (AAAI 2025 · similarity 0.81)
- Self-Refining Language Model Anonymizers via Adversarial Distillation (NeurIPS 2025 · similarity 0.80)
- The Canary’s Echo: Auditing Privacy Risks of LLM-Generated Synthetic Text (ICML 2025 · similarity 0.80)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.