Research map / Large language models / Language, safety and interpretability

OUTFOX: LLM-Generated Essay Detection Through In-Context Learning with Adversarially Generated Examples

AAAI 2024 · Large language models › Language, safety and interpretability · approach: Zero-shot machine-text detection · 40 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes OUTFOX, a training-free in-context learning framework where a ChatGPT-based detector and a ChatGPT-based attacker iteratively use each other's outputs as examples, improving robustness of LLM-generated essay detection against adversarial essays.

Problem

Existing LLM-generated text detectors are fragile: paraphrasing degrades their accuracy, and malicious users who adapt generations to evade detection have not been considered.

Approach

Detector and attacker both learn via in-context examples without parameter updates: the attacker sees detector labels on retrieved essays and generates essays designed to be classified as Human; the detector includes these attacked essays in its prompt to learn to recognize them.

Key results

• Considering attacks in the detector improves F1 on OUTFOX-attacked essays by +41.3 points (39.4 to 80.7).
• OUTFOX detector reaches up to 96.9 F1 on non-attacked essays, outperforming RoBERTa and HC3 detectors (e.g., 96.9 vs 82.6 HC3 on GPT-3.5 essays).
• OUTFOX attacker reduces detector F1 by up to 57.0 points, outperforming DIPPER paraphrasing attack by up to 39.6 points.

Measured effects reported in the paper

Surprising findings

• The DIPPER paraphrasing attack raised RoBERTa-large's F1 from 90.7 to 94.4 rather than degrading it.
• Considering attacks in the detector had almost no cost on non-attacked essays (average -0.1 F1).

Limitations

• Only one round of detector-attacker interaction was run, though the framework allows iteration.
• Evaluated only on student argumentative essays in one domain.
• Relies on closed API models (ChatGPT, text-davinci-003) that may change over time.

Experimental setup

Datasets: ASAP-style native student argumentative essays (6th-12th grade, U.S.)

Benchmarks: OUTFOX essay dataset test split (500 human, 500 non-attacked, 500 attacked per attacker)

Metrics: F1-score HumanRec MachineRec AvgRec

Baselines: DIPPER paraphrasing attack RoBERTa-base detector RoBERTa-large detector HC3 detector DetectGPT log p(x) Rank LogRank Entropy

Builds on: DIPPER paraphraser in-context learning with semantically close examples DetectGPT

Closest papers by meaning

• DetectRL: Benchmarking LLM-Generated Text Detection in Real-World Scenarios (NeurIPS 2024 · similarity 0.89)
• Human Texts Are Outliers: Detecting LLM-generated Texts via Out-of-distribution Detection (NeurIPS 2025 · similarity 0.88)
• Training-free LLM-generated Text Detection by Mining Token Probability Sequences (ICLR 2025 · similarity 0.88)
• DPIC: Decoupling Prompt and Intrinsic Characteristics for LLM Generated Text Detection (NeurIPS 2024 · similarity 0.87)
• Adversarial Paraphrasing: A Universal Attack for Humanizing AI-Generated Text (NeurIPS 2025 · similarity 0.87)
• DALD: Improving Logits-based Detector without Logits from Black-box LLMs (NeurIPS 2024 · similarity 0.86)