Can We Trust LLM Detectors?

Technical Summary: Can We Trust LLM Detectors?

Problem Statement
The rapid adoption of Large Language Models (LLMs) has created an urgent need for reliable AI text detection, particularly in academic contexts where integrity is paramount. However, a critical gap exists between the near-perfect accuracy reported in controlled benchmarks and the reliability of these detectors in real-world, out-of-distribution (OOD) scenarios. Existing detectors often fail when confronted with unseen generators, distribution shifts, or simple stylistic perturbations. This work systematically evaluates the reliability of two dominant detection paradigms—training-free methods and supervised fine-tuning—to determine if they can be trusted outside of specific in-domain settings.

Methodology
The authors propose a Supervised Contrastive Learning (SCL) framework designed to learn discriminative style embeddings that separate human and machine-generated text. The methodology consists of the following components:

• Base Architecture: The system utilizes a pre-trained DeBERTa-v3 backbone.
• Dual-Objective Training:
  1. Binary Classification: A standard supervised classifier is fine-tuned using a binary cross-entropy loss ($L_{BCE}$) to distinguish between human and AI text.
  2. Contrastive Learning: An SCL module is integrated to structure the embedding space. Using an InfoNCE loss function ($L_{InfoNCE}$), the model learns to cluster embeddings such that samples of the same class (human or AI) form distinct, coherent clusters, while separating different classes.
• Few-Shot Adaptation: The framework is designed to adapt to new, unseen LLMs with minimal data. Instead of retraining the base model, the system updates the class centroid for the new AI model using a small number of samples (e.g., 25 examples) to adjust the decision boundary.

Experimental Setup
The evaluation utilizes three distinct datasets to test in-domain performance, cross-domain generalization, and multi-generator robustness:

• RAID: A large-scale benchmark with over 6 million texts from 11 LLMs across 8 domains.
• CHEAT: A dataset of 35,304 academic abstracts used for high-performance supervised evaluation.
• M4: A multi-generator, multi-domain, and multi-lingual corpus designed for black-box detection, encompassing diverse linguistic settings (e.g., Reddit, Wikipedia).

The proposed method is compared against two training-free baselines (Binoculars, FastDetectGPT) and two supervised baselines (BERT, GAN-BERT).

Key Results

• In-Domain Performance: Supervised methods significantly outperform training-free approaches on the in-domain RAID dataset. The proposed SCL method achieved the highest accuracy (95.98%), perfect precision (100%), and the lowest false positive rate (0.90%) among all baselines.
• Out-of-Distribution (OOD) Generalization:
  • CHEAT: The SCL framework generalized effectively to this academic dataset, achieving 97.83% accuracy. This success is attributed to the stylistic alignment between the training data (RAID) and the test data (CHEAT), both containing formal academic text.
  • M4: Performance degraded sharply on the M4 dataset (dropping to 50.83% accuracy). The authors attribute this to a severe distributional shift; M4 includes informal, noisy domains (like Reddit) with higher character diversity and digit density, which the learned style representations failed to capture.
• Few-Shot Adaptation: The framework demonstrated the ability to adapt to unseen LLMs (GPT-4o, Claude-3.5) using only 25 examples, yielding substantial gains over zero-shot performance.
• Adversarial Robustness: The detectors proved highly brittle.
  • White-box attacks: Greedy Coordinate Gradient (GCG) attacks could flip predictions for 99.3% of samples, though the resulting text often lacked semantic naturalness.
  • Black-box perturbations: Simple stylistic changes, such as adding quotation marks or attribution cues, significantly reduced accuracy (from 3.3% to 8.5% in specific metrics), indicating a reliance on fragile surface cues rather than deep semantic understanding.

Significance and Claims
The paper concludes that while supervised detectors dominate in-domain settings, building a universal, domain-agnostic LLM detector is currently infeasible. The study exposes fundamental challenges in the field:

1. Brittleness: Both training-free and supervised detectors suffer severe degradation under distribution shifts, unseen generators, and simple stylistic perturbations.
2. Limitations of Current Paradigms: While the proposed SCL framework improves robustness and enables efficient few-shot adaptation, it does not fully resolve the issue of generalization across diverse domains (as evidenced by the failure on M4).
3. Trustworthiness: The results suggest that current automated detection systems cannot be fully trusted for real-world deployment without acknowledging their susceptibility to domain mismatch and adversarial manipulation.

The authors emphasize that their work does not propose a perfect solution but rather provides comprehensive evidence of the limitations of existing detection paradigms, highlighting the need for more robust, style-aware methods while tempering expectations for a "universal" detector.