Black-Box Detection of LLM-Generated Text Using Generalized Jensen-Shannon Divergence

AI summary

Overview

• Research area: Machine learning / AI text detection, specifically black-box detection of LLM-generated text using statistical hypothesis testing.
• Technical level: Intermediate. The method itself is simple to describe (surprisal discretization plus transition counting), but the paper pairs it with non-asymptotic statistical analysis and log-likelihood-ratio arguments.
• Scope: The paper introduces SurpMark, a reference-based detector that scores a passage by comparing its discretized token-surprisal transition dynamics against fixed human and machine reference corpora using a generalized Jensen–Shannon (GJS) gap, and validates it across many datasets, generators, and shift scenarios.

What This Paper Is About

Detecting machine-generated text is hard in realistic "black-box" conditions: the detector's proxy language model may not match the unknown model that wrote the text, and methods that regenerate or perturb each test passage are expensive. The authors build a detector that avoids both retraining and per-input regeneration by summarizing a passage through the dynamics of its token surprisals (how predictable tokens follow unpredictable ones) rather than through absolute likelihood values. The goal is a single-pass, reusable-reference detector that stays reliable when domains and generators shift.

Key Contributions

1. SurpMark, a black-box, reference-based detector: it quantizes proxy-LM token surprisals into k interpretable states via k-means, estimates a first-order state-transition matrix for each text, and scores the test text by the difference between its generalized Jensen–Shannon divergence from a machine reference and from a human reference.
2. Theoretical analysis giving design guidance for how the number of discretization bins should scale with data, plus a justification of the test statistic. Balancing an O(1/k) discretization error against an O(k^{3/2}/√N) statistical estimation term yields an optimal bin count of the form k* = Θ(N^{1/5}) (up to polylog factors).
3. A proof that the decision statistic is a log-likelihood ratio: Proposition 3.4 shows ΔGJS_n exactly equals the normalized generalized log-likelihood ratio Λ_{n,N} over stationary first-order Markov models on k states. The authors also state that asymptotic normality of ΔGJS_n is proved in Appendix D.3.3 and empirically verified in Appendix E.2.3.
4. A comprehensive empirical evaluation across multiple datasets, 9 open-source source models, 3 closed-source source models, non-English corpora, mixed-domain, mixed-generator, out-of-domain, corruption, and paraphrase settings, showing SurpMark matches or surpasses 13 baselines.

Main Findings

• A "recovery" pattern distinguishes LLM text. The authors observe that LLM-generated text tends to return to highly predictable tokens immediately after an unexpected one. Figure 2(a) visualizes conditional probabilities of transitioning into and out of the "Highly Surprising" state under a 5-bin discretization, showing a stronger recovery tendency and a more pronounced spiking tendency from low-surprisal contexts in LLM text.
• First-order modeling is sufficient. The approximation error between first- and second-order Markov approximations is at most I(a_t; a_{t-2} | a_{t-1}). Experimentally this is negligible: 0.0076 bits/token for GPT-5-chat with a +0.528% relative perplexity gain from 1st to 2nd order, and 0.0045 bits/token for Human with +0.314% relative gain. Higher-order summaries suffer from state-space explosion and sparse transitions.
• Strong open-source model results. On 9 open-source models, averaged over XSum, WritingPrompts, and SQuAD, SurpMark achieves average AUROC 91.23 at k=6 and 91.17 at k=7, ranking first on 6 of 9 models and within the top two on 7 of 9. For comparison, Fast-DetectGPT averaged 88.01 and Lastde++ 90.04.
• Strong closed-source model results. On Gemini-1.5-Flash, GPT-4.1-mini, and GPT-5-Chat, SurpMark averages 77.72 (k=6) and 78.32 (k=7), versus 69.55 for R-Detect and 65.09 for Binoculars. Performance is described as especially strong on GPT-5-Chat (81.33 at k=7).
• Much lower reference cost. Under a reference-per-test budget B = (#references)/(#tests), SurpMark operates at B=2, while DNA-GPT uses B=10 and DetectGPT, DetectNPR, and Lastde++ require B=100 — a 5x to 50x lower reference cost, with no per-input contrastive generation.
• k-means is the most robust discretization. In Table 4, on XSum@GPT-4.1-mini with k=7, k-means reaches 80.42 versus 80.41 for equal-width and 71.40 for equal-mass; at k=8, k-means reaches 79.32 versus 76.20 and 74.22. On WritingPrompts@GPT5-chat, k-means reaches 82.05 (k=7) and 84.86 (k=8), versus equal-width 62.90 and 72.06.
• Best bin counts land at k = 6–7. Across models, AUROC improves with more bins up to a moderate range, then saturates or declines slightly.
• Reference and test length trade off. AUROC improves sharply as references grow from very small counts to 100, with only minor gains beyond 100. AUROC climbs rapidly as test length grows from 50 to about 150–200. On WritingPrompts with Gemma-7B, SurpMark is competitive at short lengths and becomes the top method for test length larger than 150. Contour plots show larger reference length can compensate for smaller test length.
• Proxy model robustness. SurpMark is consistently top and stable across proxy models, performing strongly even with the smallest proxy and improving only modestly with larger ones, whereas several baselines are highly sensitive to proxy choice.
• Throughput. SurpMark's throughput improves monotonically as one-time preprocessing is amortized, crossing the Fast-DetectGPT line at roughly 298 test texts (proxy LM: GPT-2 Large; GPU: NVIDIA RTX 4090).
• Non-English performance. SurpMark ranks first on all four non-English datasets: German WMT19 (GPT-4o-mini source, Llama-3.2-1B proxy) and Chinese HC3 across psychology, medicine, and openqa domains (Qwen-2.0-0.5B proxy), with large margins on HC3-Chi-med.
• Mixed-domain and mixed-generator robustness. On DetectRL, SurpMark reaches AUROC 94.7 for Llama-2-70B and 80.92 for Claude-instant (where Fast-DetectGPT and Lastde++ fall below 50 AUROC), and 80.57 for GPT-3.5-turbo. Grouped by domain, SurpMark reaches 86.69 (arXiv), 81.32 (WritingPrompts), and 90.18 (Yelp_review).
• Out-of-domain generalization. Under reference-domain shift, SurpMark beats Fast-DetectGPT and Lastde++ in every setting, and on average improves over the strongest baseline by 13.26 AUROC and 11.06 TPR@5%FPR.
• Paraphrase robustness. Under paraphrase-induced OOD shift, SurpMark reaches AUROC/TPR@5%FPR of 99.21/99.33 (Polish), 99.45/99.33 (DIPPER), and 99.79/99.33 (Back-translation).

Methodology in Plain English

The detector works in two phases. Offline, the authors take existing human-written and machine-generated corpora and run them through a fixed "proxy" language model to get each token's surprisal, meaning how unexpected that token was given everything before it. These continuous surprisal values are grouped into a small number of levels (states) using k-means clustering, with a shared quantizer used for all texts. Counting how often one state follows another produces a transition matrix for the human reference and one for the machine reference.

Online, a test passage goes through the same steps: tokenize, compute surprisals with the proxy, quantize with the same shared bin boundaries, and count the same kinds of transitions to get the test text's transition matrix. The final score is the difference between two generalized Jensen–Shannon divergences: the divergence between the test matrix and the machine reference minus the divergence between the test matrix and the human reference. If the score exceeds a threshold, the text is called human; otherwise it is called machine. Nothing is retrained per input, and no neighborhood is regenerated around the test passage, so the reference corpora are built once and reused for all test samples. The theory analyzes an idealized version of this pipeline — a first-order Markov chain over the discretized states — and shows the scoring rule coincides with a normalized log-likelihood ratio between the two hypotheses, which is why the authors treat the choice of statistic as principled rather than arbitrary.

Why This Matters

Research impact. The paper bridges two earlier families of detectors: classifier-based methods that need domain-balanced labeled data and retraining, and statistics-based methods that either rely on unstable global statistics (likelihood, LogRank, entropy) or require costly per-instance regeneration (DetectGPT, Fast-DetectGPT, DNA-GPT). It also connects to likelihood-free hypothesis testing and kernel-based relative tests such as R-Detect, but replaces kernel parameter optimization with a lightweight discretization step. The theoretical result linking the two-reference GJS gap to a log-likelihood ratio gives a formal reason for using a two-sided human/machine comparison instead of a single reference.

Real-world applications:

• Content moderation and platform integrity, where detectors must run at scale with high throughput and low latency rather than regenerating text per item.
• Academic integrity and publishing workflows, where quickly flagging machine-written submissions matters but domain-specific training data is scarce.
• Journalism, fact-checking, and disinformation monitoring, where the generator is often unknown and may be a proprietary closed-source model.
• Multilingual content pipelines, given demonstrated performance on German and Chinese corpora.

Industry relevance. The very low reference budget (B=2 versus 10 or 100 for competing methods), the absence of per-input generation, and the stability across weak and strong proxy models make SurpMark attractive for low-resource or high-volume deployment. The authors specifically emphasize the closed-source results as evidence of suitability for real-world commercial systems, and attribute that strength to the fact that stronger models show a vanishingly small gap in marginal surprisal distributions versus humans while the "transition gap" remains significant.

Future Directions

• Characterizing the transition gap more precisely: the authors attribute SurpMark's advantage on strong closed-source models to a persistent transition gap when marginal surprisal distributions nearly match humans; how this gap behaves across even stronger or differently trained generators is left open.
• Choosing the bin count in practice: the theory gives k* of order N^{1/5} for total reference length N, and the constant C is calibrated empirically in Appendix E.2.2; a fully data-driven selection rule that avoids this calibration would be a natural extension.
• Reducing reliance on the first-order approximation: the analysis explicitly treats first-order Markov structure as an idealization of the discretized proxy-surprisal sequence, not a claim about true generation. Whether richer but still data-efficient summaries exist in the low-data regime remains an open question.
• Extending the shift evaluations: the paper already covers domain shift, mixed generators, sentence-level corruption, and three paraphrase settings; broader adversarial settings and additional languages beyond German and Chinese are logical next steps.

Target Audience

Researchers and practitioners working on machine-generated text detection, LLM provenance, and content moderation will get the most from this paper, particularly those who care about black-box deployment conditions and reference-cost budgets. It is also relevant to readers interested in likelihood-free hypothesis testing and Markov-approximation theory applied to NLP. A working familiarity with Kullback–Leibler divergence, Jensen–Shannon divergence, and basic Markov chain notation is helpful for the analysis sections, though the method itself is accessible to anyone comfortable with language model perplexity and clustering.

Authors’ abstract

We study black-box detection of machine-generated text under practical constraints: the scoring model (proxy LM) may mismatch the unknown source model, and per-input contrastive generation is costly. We propose SurpMark, a reference-based detector that summarizes a passage by the dynamics of its token surprisals. SurpMark discretizes surprisals into interpretable states, estimates a state-transition matrix for the test text, and scores it via a generalized Jensen-Shannon (GJS) gap between the test transitions and two fixed references (human vs. machine) built once from existing corpora. Theoretically, we derive design guidance for how the discretization bins should scale with data and provide a principled justification for our test statistic. Empirically, across multiple datasets, source models, and scenarios, SurpMark consistently matches or surpasses baselines, demonstrating strong robustness across domains and generators; our experiments on hyperparameter sensitivity exhibit trends that our theoretical results help to explain.