Research map / Large language models / Language, safety and interpretability
IPAD: Inverse Prompt for AI Detection - A Robust and Interpretable LLM-Generated Text Detector
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes IPAD, which inverts an input text into a predicted prompt with a fine-tuned Phi-3 model, then fuses two fine-tuned Phi-3 distinguishers (prompt-text consistency and regeneration comparison via gpt-3.5-turbo) to detect LLM-generated text robustly and interpretably.
Problem
AI-generated text detectors are brittle on out-of-distribution and attacked text and give little interpretable evidence for their decisions.
Approach
Reconstruct the prompt that could have generated the input text (prompt inversion), then check prompt-text consistency and compare the input with an LLM regeneration from that predicted prompt; fuse both scores and expose the predicted prompt and regenerated text as decision evidence.
Key results
- IPAD reaches 99.38 average AUROC on four OOD datasets versus 86.45 for the strongest baseline (Binoculars).
- IPAD reaches 97.13 average AUROC on three attacked OOD datasets versus 91.65 for Rob-Base.
- In-distribution AvgRec of 99.25 with gpt-3.5-turbo as generator, versus 78.20 for the Sentence-BERT distinguisher.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use IPAD Merge instead of the strongest baseline detector | AI text detection · OOD datasets average | AUROC: 12.93% | Helped |
| Use IPAD instead of the strongest baseline detector | AI text detection · Attacked OOD datasets | AUROC: 5.48% | Helped |
| Use IPAD instead of the strongest baseline detector | AI text detection · In-distribution data | AvgRec: 9.05% | Helped |
| Use IPAD instead of the strongest baseline detector | AI text detection · Structured OOD datasets | MachineRec: 9.87% | Helped |
| Add both PTCV and RC to the Prompt Inverter-based detector rather than using either distinguisher alone (ablation) | IPAD · In-distribution, standard OOD, and attacked OOD datasets | AUROC | Helped |
| Add PTCV to the Prompt Inverter rather than fine-tuning only on input texts or only on predicted prompts (ablation) | IPAD · In-distribution, standard OOD, and attacked OOD datasets | AUROC | Helped |
| Add RC to the Prompt Inverter rather than fine-tuning only on input texts or only on predicted prompts (ablation) | IPAD · In-distribution, standard OOD, and attacked OOD datasets | AUROC | Helped |
| Replace the full IPAD pipeline with fine-tuning only on input texts (ablation) | IPAD · In-distribution, standard OOD, and attacked OOD datasets | AUROC | Hurt |
| Replace the full IPAD pipeline with fine-tuning only on predicted prompts (ablation) | IPAD · In-distribution, standard OOD, and attacked OOD datasets | AUROC | Hurt |
| Use RC rather than PTCV alone (ablation) | IPAD distinguishers · Adversarial attacks | AUROC | Hurt |
Surprising findings
- Fast-DetectGPT and DetectLLM (LRR) score near or below chance AUROC (about 43-53 average) on the attacked OOD benchmark.
Limitations
- Prompt Inverter may not faithfully reconstruct prompts containing explicit in-context learning examples.
- Relies on LLM calls, making it more computationally expensive than lightweight detectors like RoBERTa or HC3.
- Interpretability assessed with only ten participants on one HWT and one LGT article.
Experimental setup
Datasets: Instructions-2M ShareGPT Unnatural Instructions OUTFOX DetectRL LongWriter Code-Feedback Math XSum WritingPrompts PubMedQA
Benchmarks: OUTFOX in-distribution (AvgRec) DetectRL OOD (arXiv, XSum, Writing, Yelp Review) DetectRL attacks (prompt, paraphrase, perturbation) LongWriter Code-Feedback Math
Metrics: AvgRec HumanRec MachineRec AUROC BartScore Sentence-BERT cosine similarity BLEU ROUGE-1
Baselines: RoBERTa HC3 detector OUTFOX detector DetectLLM (LRR) DetectLLM (NPR) Binoculars Fast-DetectGPT DPIC PE Sentence-BERT BART-large-cnn
Builds on: DPIC Fast-DetectGPT DetectRL LLaMA-Factory
Closest papers by meaning
- Position: On the Possibilities of AI-Generated Text Detection (ICML 2024 · similarity 0.87)
- DALD: Improving Logits-based Detector without Logits from Black-box LLMs (NeurIPS 2024 · similarity 0.86)
- Inverse Constitutional AI: Compressing Preferences into Principles (ICLR 2025 · similarity 0.86)
- DetectRL: Benchmarking LLM-Generated Text Detection in Real-World Scenarios (NeurIPS 2024 · similarity 0.86)
- Human Texts Are Outliers: Detecting LLM-generated Texts via Out-of-distribution Detection (NeurIPS 2025 · similarity 0.86)
- Adversarial Paraphrasing: A Universal Attack for Humanizing AI-Generated Text (NeurIPS 2025 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.