Authorship Impersonation via LLM Prompting does not Evade Authorship Verification Methods

1. Problem Statement

The paper addresses the emerging threat of Authorship Impersonation in forensic linguistics, specifically focusing on whether Large Language Models (LLMs) can be prompted to mimic a specific individual's writing style (idiolect) well enough to evade Authorship Verification (AV) systems.

• Context: While manual impersonation has long been a forensic challenge, the accessibility of powerful LLMs (like GPT-4o) raises concerns that malicious actors could generate "textual deepfakes" to fabricate evidence or mislead investigations.
• Core Question: Can an adversary, using only public resources and prompting techniques (without fine-tuning), generate text that convinces state-of-the-art AV systems that the text was written by a target author?
• Gap: Previous studies often focused on stylistic similarity metrics or high-profile figures (whose styles may be in training data). This study evaluates impersonation against established forensic AV frameworks using private individuals in realistic communication genres.

2. Methodology

A. Experimental Setup

• Adversary Model: GPT-4o (OpenAI), chosen for its state-of-the-art performance and public accessibility.
• Datasets: Three distinct corpora representing forensic-relevant genres:
  1. CEnron: Corporate emails (76 authors, 345 texts).
  2. CBOLT: SMS/Chat messages (46 authors, 3,716 texts).
  3. CTwitter: Social media posts (60 authors, 10,933 texts).
• Task Formulation: The task is framed as a rewriting exercise.
  • Source Text ($S$): A text written by a different author (not the target).
  • Target Author ($A_i$): A specific individual whose style is to be mimicked.
  • Process: The LLM is given examples of $A_i$'s writing and asked to rewrite $S$ to mimic $A_i$. The output ($Q^P_i$) is the impersonation text.

B. Prompting Strategies

Four prompting conditions were tested to simulate varying levels of adversary sophistication:

1. Naive Prompting: A simple one-sentence instruction to rewrite the text to resemble the target.
2. Self-prompting: A two-step process where the LLM first generates a detailed instruction (checklist of features) for itself, then executes it.
3. Role-Playing Prompting: A system prompt assigns a "mimicry expert" role, followed by a user prompt with specific linguistic constraints (punctuation, phrasal verbs, etc.).
4. Tree-of-Thoughts (ToT) Prompting: A multi-step planning and voting process where the model generates multiple plans and drafts, selecting the best one through internal voting.

C. Evaluation Framework

The generated texts were evaluated against six AV methods using a Likelihood Ratio (LR) framework (calibrated via logistic regression):

• Non-Neural Methods:
  • N-gram Tracing: Character 9-gram similarity (Simpson coefficient).
  • Ranking-Based Impostors (RBI): Compares the query against known samples and a set of impostors.
  • LambdaG: A forensic method using Grammar Models based on function tokens (requires content masking via POSNoise).
• Neural Methods:
  • AdHominem: Attention-based Siamese neural network.
  • LUAR: Learning Universal Authorship Representations (contrastive learning).
  • STAR: Style Transformer for Authorship Representations.
• Preprocessing: Non-neural methods used POSNoise (replacing content words with POS tags) to prevent topic bias. Neural methods were evaluated on raw text.

3. Key Results

A. Impersonation Failure

• Overall Resilience: Across all three corpora and all prompting strategies, GPT-4o failed to generate texts that successfully bypassed AV systems.
• Likelihood Ratios (LLR): The vast majority of LLR scores were negative, indicating the systems correctly rejected the impersonations as "different-author" cases.
• Prompting Ineffectiveness: More sophisticated prompting techniques (ToT, Role-Playing) did not yield significantly higher success rates compared to naive prompting. The LLMs struggled to capture the deep, stable idiolectal markers required for forensic verification.

B. Method-Specific Performance

• Neural Models:
  • STAR and LUAR were the most robust, consistently producing strongly negative LLRs.
  • AdHominem was the most vulnerable, often yielding scores near zero (inconclusive), though it still generally rejected the impersonations.
• Non-Neural Models: All three (LambdaG, N-gram, RBI) remained robust, though N-gram and RBI showed slight fluctuations in confidence depending on the corpus.

C. The "Counter-Intuitive" Resilience

A critical finding was that some methods (specifically STAR, LUAR, and N-gram tracing on Enron) performed better at rejecting LLM impersonations than they did at rejecting genuine negative samples (texts by different humans).

• Metric: The True Negative Rate (TNR) was higher for LLM texts than for genuine human "different-author" pairs.
• Explanation: LLM-generated texts exhibited higher lexical diversity, higher entropy, and higher Type-Token Ratios (TTR) compared to human writing.
  • Human writing is characterized by specific, repetitive idiolectal habits.
  • LLMs, even when prompted to mimic, tend to produce text that is statistically "too diverse" and less redundant than natural human writing.
  • This "machine-like" statistical signature made the impersonations easier to detect than genuine human variations.

4. Key Contributions

1. Forensic Framework Evaluation: Unlike previous NLP studies that rely on similarity metrics, this study evaluates LLM impersonation within a rigorous forensic likelihood-ratio framework, assessing actual admissibility and evidential strength.
2. Comprehensive Prompting Analysis: It systematically tests a spectrum of prompting strategies (from naive to ToT) to determine if prompt engineering alone can overcome the limitations of in-context learning for authorship mimicry.
3. Discovery of LLM "Over-Diversity": The paper identifies that LLMs fail to replicate human idiolects not just by missing specific markers, but by introducing excessive lexical diversity and entropy, which acts as a detectable fingerprint against established AV systems.
4. Genre-Specific Insights: It highlights that while all genres were resistant, Twitter texts were the easiest to detect (most negative LLRs), while Emails were the hardest (lowest absolute LLR magnitude), suggesting corpus characteristics influence detection confidence.

5. Significance and Implications

• Current Robustness: Current AV systems remain robust against entry-level adversarial attacks using publicly available LLMs and prompting. Forensic linguists can currently rely on these tools to detect LLM-generated impersonations.
• Limitations of Prompting: The study suggests that "prompting" alone is insufficient for high-stakes authorship impersonation; the model's inherent statistical properties (high entropy) prevent it from perfectly mimicking the low-entropy, repetitive nature of human idiolects.
• Future Threats: The authors caution that while prompting fails, more sophisticated attacks involving fine-tuning, adversarial feedback loops, or parameter-efficient adaptation could potentially overcome these defenses.
• Human vs. Machine: While algorithms successfully detected the impersonations, the paper notes that LLM texts might still appear convincing to human readers (e.g., family members or non-expert investigators), posing a real-world deception risk even if forensic tools catch them.

Conclusion

The paper concludes that despite the rapid advancement of LLMs, prompted authorship impersonation does not currently evade forensic authorship verification methods. The inherent statistical differences between human idiolects and LLM outputs (specifically regarding lexical diversity and entropy) make LLM-generated impersonations detectable, and in some cases, easier to reject than genuine human writing. However, the study calls for continued vigilance as adversarial techniques evolve beyond simple prompting.