💬 NLP

MD-ProTector: Positioning Multiple Data-Driven Prototypes for LLM-Generated Text Detection

MD-ProTector enhances LLM-generated text detection by employing multiple trainable prototypes per class within an encoder embedding space, guided by a novel Prototype Positioning loss to effectively model diverse writing variations and achieve superior performance across various domains, languages, and generator models.

Original authors: Jinmo Han, Jimin Hong, Chanyeong Moon, Ju Yeon Kang, Seonuk Kim, Nam Soo Kim

Published 2026-08-12

📖 6 min read🧠 Deep dive

CC BY 4.0

Original authors: Jinmo Han, Jimin Hong, Chanyeong Moon, Ju Yeon Kang, Seonuk Kim, Nam Soo Kim

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are walking into a massive, noisy library where millions of books are being written every second. Some are penned by human hands, full of quirks, typos, and personal stories. Others are churned out by super-smart robots called Large Language Models (LLMs), which have learned to mimic human writing so perfectly that they can sound just like us. The problem? It's getting harder and harder to tell the difference. In the world of computer science, this is the battle for "AI detection." For a long time, scientists tried to solve this by building simple "yes-or-no" detectors, like a bouncer at a club who just checks a list and says "Human" or "Robot." But this approach is too blunt. Humans aren't all the same; a poet writes differently than a news reporter, and a robot can write in many different styles too. If you try to squeeze all those different styles into just two buckets, you miss the details that actually matter.

Enter a new team of researchers from Seoul National University who decided to stop using a single bouncer and instead build a whole squad of experts. They created a system called MD-ProTector. Think of it like a detective agency that doesn't just have one "Human Detective" and one "Robot Detective." Instead, they have a whole team of specialists. One human detective is an expert on restaurant reviews, another on academic papers, and a third on casual chat. Similarly, the robot team has specialists who know how to spot AI writing that looks like a science article, a news story, or a fantasy novel. By training these specialists to recognize specific types of writing rather than just "human" or "robot" in general, the system becomes much sharper. The paper shows that this "squad" approach works better than the old "single bouncer" method, especially when the writing styles are weird, the topics are new, or the robots are trying to trick the system.

The Problem with the "One-Size-Fits-All" Bouncer

For a while, the standard way to catch AI text was to use a simple binary classifier. Imagine you have a giant bag of marbles. Some are red (human-written), and some are blue (AI-generated). The old method tried to find a single line in the middle of the bag to separate the reds from the blues. It worked okay when the marbles were all the same shade of red and blue. But in reality, "red" marbles come in neon, pastel, and dark crimson, and "blue" marbles come in sky, navy, and electric. When you force all those different shades into just two groups, the line gets messy. The detector might get confused by a human writer who writes like a robot, or an AI that writes like a human, because it's only looking at the broad category, not the specific style.

The researchers realized that to catch the fakes, you need to understand the variety within the groups. You can't just say "this is human"; you need to know what kind of human writing it is. But here's the tricky part: if you just tell a computer, "Hey, make 8 different human detectors," the computer might converge on similar solutions. It might make 8 detectors that all look exactly the same, or they might all try to catch the same few types of writing, leaving the rest unguarded. The computer needs a way to force each detector to find a unique job.

The Solution: A Squad of Specialized Detectives

This is where MD-ProTector comes in. The team built a system that creates a "bank" of prototypes for both humans and machines. A "prototype" is just a fancy word for a perfect, average example of a specific style. Instead of one giant "Human" prototype, they have a bank of 8 different human prototypes. Instead of one "Robot" prototype, they have 8 different robot prototypes.

But how do they make sure these 8 prototypes don't all do the same thing? They invented a special training rule called Prototype Positioning.

Imagine you are organizing a group of friends for a scavenger hunt. You don't just say, "Go find things." You say, "Alice, you find red things; Bob, you find blue things; Charlie, you find things that are heavy." You give them specific directions based on what they are good at. In the computer's brain, the researchers first figure out what all the "Human" texts have in common (the "class hub"). Then, they look at what makes each specific text different from that average. They tell each prototype: "Don't worry about the common stuff; go find the unique, leftover details that make your group special."

This process forces the prototypes to spread out. One prototype might learn to spot "academic writing with lots of citations," while another learns to spot "casual blog posts with slang." They become a diverse team, each covering a different corner of the writing world.

What They Found: The Squad Wins

The researchers tested their new squad against the old single-bouncer methods using some of the toughest tests available. They threw everything at it: different languages, different topics, and even robots that were specifically trying to trick the detectors by changing their writing style.

The results were impressive. In a test called MAGE CDCM (which mixes up domains and models), MD-ProTector achieved an AvgRec (a score that balances catching both humans and robots) of 95.14%. This was the highest score among all the methods they tested. For comparison, the standard "single bouncer" method (Binary CE) only got 90.79%, and another advanced method called DeTeCtive got 94.84%.

They also tested it on RAID, a benchmark designed to see if detectors can handle tricky, adversarial attacks where the text is deliberately messed up to hide its origin. Here, MD-ProTector again took the top spot with an AvgRec of 88.18%, beating the next best method by a clear margin. It also managed to keep the "False Positive Rate" (mistakenly calling a human a robot) incredibly low, at just 27.78%, which is a huge deal because you don't want to accuse real people of being robots.

Even when they tested it on languages it hadn't seen before (the M4 benchmark), it performed very well, though it found that specific challenge a bit harder than the others. This suggests that while the squad is great, it still has some work to do on the most difficult, unseen languages.

Why This Matters

The paper suggests that the future of catching AI isn't about building a bigger, scarier wall; it's about building a smarter, more diverse team. By acknowledging that "human writing" and "AI writing" are not single, uniform blocks but rather collections of many different styles, MD-ProTector manages to see the details that others miss.

The researchers are careful to note that this isn't a magic wand that solves everything forever. They admit that if the robots get even smarter or if the writing styles change drastically over time, the system might need to be updated. But for now, this "squad of specialists" approach seems to be the most effective way we have to keep our digital library honest, ensuring that when we read a story, we know who really wrote it.

Technical Summary: MD-ProTector

Problem Statement

As Large Language Models (LLMs) generate increasingly sophisticated content, distinguishing machine-generated text from human-written text has become critical for maintaining digital credibility, preventing fake news, and upholding academic integrity. However, practical deployment of detection systems faces significant challenges:

Diversity: Detection systems must handle vast variations in writing styles, domains, languages, and generator models.
Constraints: In real-world scenarios, access to model internals (e.g., log-likelihoods) or watermarks is often unavailable. Consequently, detectors must rely on lightweight, input-only encoders.
Limitations of Standard Approaches: Standard binary classification treats all human-written and all LLM-generated texts as monolithic classes. This coarse supervision fails to explicitly organize the substantial intra-class diversity (e.g., different domains or styles within the "human" class), potentially limiting detection performance when facing unseen variations.

Methodology: MD-ProTector

The authors propose MD-ProTector, an input-only encoder detector that moves beyond single global class representations. Instead, it represents each class (human and machine) with multiple trainable reference vectors, termed prototypes, within the encoder embedding space.

Core Architecture

Encoder: A lightweight encoder $f_\theta$ maps input text $x$ into a normalized embedding $z$ .
Prototype Banks: Separate banks of $R$ learnable prototypes are maintained for human ( $P_1$ ) and machine ( $P_0$ ) texts.
Inference: The detection score is derived by comparing the input embedding to the most similar prototype in each bank: $S(z) = \max_r(z^\top p_{1,r}) - \max_r(z^\top p_{0,r})$ .

Training Objectives

To ensure prototypes capture distinct intra-class variations rather than becoming redundant, MD-ProTector employs three specific loss functions:

Prototype-to-Class Loss ( $L_{P2C}$ ): Aligns each prototype with the "class hub" (the mean direction of its class in the current mini-batch). This ensures all prototypes within a bank remain aligned with the general class direction.
Sample-to-Prototype Loss ( $L_{S2P}$ ): Associates individual samples with the prototypes of their ground-truth class. This creates a soft assignment of samples to specific prototypes within the correct class bank.
Prototype Positioning Loss ( $L_{PP}$ ): This is the novel core of the method. It addresses the ambiguity of which variation each prototype should represent.
- It removes the class-shared direction (the hub) from both sample embeddings and prototype vectors, isolating the residual variation.
- It constructs a data-driven target for each prototype based on the aggregate of residual vectors from samples assigned to it.
- It optimizes the prototype to align with this specific residual aggregate.
- Significance: This mechanism separates the class-level structure from the within-class variation, forcing different prototypes to specialize in different groups of samples (e.g., different domains or styles) without explicit supervision on those groups.

Initialization

Prototypes are initialized using K-Means clustering on the training set embeddings for each class, ensuring they start within observed data distributions rather than random directions.

Key Contributions

Multi-Prototype Input-Only Detector: The development of a detector where separate human and machine prototype banks directly define the detection score, avoiding reliance on model internals.
Prototype Positioning Loss: A novel loss function that positions prototypes in a data-driven manner to capture within-class variation by utilizing hub-removed residuals.
Comprehensive Evaluation: Rigorous evaluation across five controlled settings covering domain shifts, generator shifts, language shifts, and adversarial perturbations.

Experimental Results

The method was evaluated on three large-scale benchmarks: MAGE (domain/generator generalization), M4 (multilingual generalization), and RAID (adversarial robustness).

Overall Performance: MD-ProTector ranked within the top two in Average Recall (AvgRec) across all five evaluation settings among input-only encoder detectors trained under identical protocols.
MAGE CDCM (Mixed Conditions): Achieved the highest AvgRec (95.14), with balanced recalls of 95.81% for human and 94.47% for machine text.
RAID (Adversarial/Robustness): Achieved the highest AvgRec (88.18), highest AUROC (95.41), and the lowest False Positive Rate at 95% recall (FPR95) of 27.78% among compared methods.
M4 (Multilingual): Achieved the second-highest AvgRec (86.03). While it improved HumanRec significantly over baselines, the authors note that AUROC and FPR95 remained lower than some baselines, indicating remaining challenges in representing human text in unseen languages.
Ablation Studies:
- Removing the Prototype Positioning loss ( $L_{PP}$ ) reduced performance (95.14 $\to$ 94.78).
- Replacing $L_{PP}$ with simple prototype repulsion or positioning without removing the class hub direction resulted in lower performance, validating the necessity of the residual-based positioning strategy.
- K-Means initialization outperformed random initialization.
- Performance peaked at $R=8$ prototypes per class.

Significance and Claims

The paper claims that MD-ProTector effectively addresses the limitation of standard binary classification by explicitly organizing intra-class diversity. By separating the shared class direction from the specific variations that distinguish groups of samples, the method constructs distinct training targets for multiple prototypes.

The authors emphasize that this approach allows for data-driven positioning of prototypes, where the model learns to represent different writing styles, domains, or generator patterns as separate entities within the same class. This organization leads to more robust detection scores, particularly in mixed domain/generator conditions and adversarial settings, without requiring access to the generator's internal parameters.

Limitations

The authors acknowledge several limitations:

The method assumes a fixed-label binary setting and does not handle partial generation, human-machine co-editing, or estimating degrees of machine involvement.
The number of prototypes ( $R$ ) is an empirically fixed hyperparameter; adaptive mechanisms for adjusting prototype cardinality are not explored.
Experiments rely on fixed data splits; the method does not yet address continual adaptation to temporal distribution drifts in generator prompts or styles.
The "Human" class is sourced from web texts, which may contain inherent biases.