Research map / Large language models / Language, safety and interpretability
DetectRL: Benchmarking LLM-Generated Text Detection in Real-World Scenarios
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Introduces DetectRL, a benchmark of real-world-style LLM-generated text detection scenarios (multi-domain, multi-LLM, prompt/paraphrase/perturbation attacks, data mixing, length variation, human writing revisions) showing SOTA zero-shot detectors degrade sharply while supervised classifiers stay robust.
Problem
Existing LLM-generated text detectors are evaluated on idealized benchmarks that ignore real-world factors such as prompt usage, human revisions, writing noise, distribution shifts, and text length, so their reliability in practice is unclear.
Approach
Build a benchmark from abuse-prone human domains (arXiv abstracts, XSum, Writing Prompts, Yelp) with text from GPT-3.5-turbo, PaLM-2-bison, Claude-instant and Llama-2-70b, applying prompt attacks, paraphrase attacks, adversarial perturbations, and data mixing, plus sentence-level length augmentation, and evaluate four task settings (in-domain robustness, generalization, length, human writing).
Key results
- Binoculars is the best zero-shot detector with 79.61% average AUROC/F1-based leaderboard score, while supervised Rob-Base reaches 93.02% average; zero-shot AUROC drops to 38.43% under perturbation attacks.
- Zero-shot detectors average 58.61% AUROC in the multi-LLM setting, while supervised detectors average 98.09%.
- Under human-written perturbation (spelling noise) zero-shot detectors' AUROC rises by an average 10.22%.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use supervised classifiers rather than zero-shot detectors | LLM-generated text detection on DetectRL · DetectRL overall | average score | Helped |
| Apply adversarial perturbation attacks to LLM-generated text | Zero-shot detectors · DetectRL perturbation attacks | AUROC: 39.28% | Hurt |
| Apply prompt attacks to LLM-generated text | Zero-shot detectors · DetectRL prompt attacks | AUROC: 1.97% | Hurt |
| Apply paraphrase attacks to LLM-generated text | Zero-shot detectors · DetectRL paraphrase attacks | AUROC: 15.67% | Hurt |
| Mix human-written content into LLM-generated text | Zero-shot detectors · DetectRL data mixing | AUROC: 18.17% | Hurt |
| Use shorter training texts | Zero-shot detectors · DetectRL text-length assessment | detection performance | Helped |
| Use longer test texts | Zero-shot detectors · DetectRL text-length assessment | detection performance | Helped |
| Paraphrase human-written text | Zero-shot detectors · DetectRL human writing assessment | AUROC: 7.95% | Hurt |
| Perturb human-written text | Zero-shot detectors · DetectRL human writing assessment | AUROC: 10.22% | Helped |
| Train on informal-style domains instead of formal-style domains | LLM-generated text detectors · DetectRL domain generalization | AUROC: around 10% | Helped |
Surprising findings
- DetectGPT, NPR and Fast-DetectGPT underperform simpler traditional zero-shot baselines such as Log-Likelihood and Rank on DetectRL.
- Perturbation attacks on human-written text improve zero-shot detection (average +10.22% AUROC), rather than harming it.
Limitations
- Benchmark only covers currently popular LLMs and may become outdated as new models appear.
- Covers a limited set of attack methods and application scenarios, not the full spectrum of future challenges.
- Some human-written data may contain personally identifiable or offensive content despite manual review.
Experimental setup
Datasets: arXiv abstracts XSum Writing Prompts Yelp Reviews
Benchmarks: DetectRL
Metrics: AUROC F1 score precision recall
Baselines: Log-Likelihood Entropy Rank Log-Rank LRR NPR DetectGPT Fast-DetectGPT Binoculars Revise-Detect. DNA-GPT RoBERTa classifier
Builds on: DetectGPT Fast-DetectGPT Binoculars TextAttack DIPPER
Closest papers by meaning
- Training-free LLM-generated Text Detection by Mining Token Probability Sequences (ICLR 2025 · similarity 0.90)
- DPIC: Decoupling Prompt and Intrinsic Characteristics for LLM Generated Text Detection (NeurIPS 2024 · similarity 0.90)
- DALD: Improving Logits-based Detector without Logits from Black-box LLMs (NeurIPS 2024 · similarity 0.89)
- OUTFOX: LLM-Generated Essay Detection Through In-Context Learning with Adversarially Generated Examples (AAAI 2024 · similarity 0.89)
- Humanizing the Machine: Proxy Attacks to Mislead LLM Detectors (ICLR 2025 · similarity 0.89)
- Glimpse: Enabling White-Box Methods to Use Proprietary Models for Zero-Shot LLM-Generated Text Detection (ICLR 2025 · similarity 0.89)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.