Towards Fine-grained and Robust Detection of Human-AI Co-authorship

AI summary

Overview

Research area: Natural Language Processing — AI-generated text detection, text provenance, and adversarial robustness.

Technical level: Intermediate. Readers should be comfortable with supervised text classification, pretrained language model encoders, and standard evaluation metrics (accuracy, macro-F1, ROC-AUC), but no specialized mathematics is required.

Scope (1 sentence): The paper reformulates human–AI co-authorship detection as a four-class provenance task and shows that training with DIPPER-generated adversarial paraphrases makes detectors substantially more robust to meaning-preserving rewrites.

What This Paper Is About

Most AI-text detectors output a single "how much AI was involved" score or a binary human-vs-machine label, but real documents are often co-authored: a person writes a draft and an LLM polishes it, restructures it, or expands it. The authors argue that a one-dimensional score does not carry signals directly tied to the actual authoring process, and that meaning-preserving paraphrasing attacks can quietly push AI-involved text across the decision boundary into the "human-written" class. Their goal is to define a discrete, provenance-oriented task with controlled levels of AI involvement and to test — then improve — detector robustness against adversarial rewriting.

Key Contributions

1. A four-class formulation of co-authorship detection. The paper replaces binary or continuous scoring with four discrete levels — Human-written, Low AI-involved (surface-level polishing), High AI-involved (AI reorganizes discourse and narrative while preserving facts), and Fully AI-generated (AI plans content from a brief topic). Labels come from the prompt-guided generation process, not from post-hoc similarity thresholds.

2. A benchmark dataset for fine-grained detection under adversarial paraphrasing. Human text is drawn from 600 BBC articles (XSum), 204 arXiv computer-science paper introductions from 2020–2021, and 599 five-sentence ROCStories; AI-involved variants are generated with GPT-4o and Claude Sonnet 4, then paraphrased with DIPPER. A held-out attack using GPT-5.1 is reserved purely for robustness evaluation.

3. A mechanistic analysis of why paraphrasing breaks detectors. Using PCA on Longformer document representations, the authors show that adversarial paraphrasing disperses the Low and High AI-involved clusters along the human-to-AI continuum and causes them to overlap, while the Fully AI-generated cluster mainly expands rather than shifting. They also report similarity analyses (Jaccard, BLEU, embedding cosine) and document-length statistics to confirm the benign classes follow the intended progression.

4. A robustness recipe and extensive evaluation. Training with adversarially paraphrased samples that keep their original labels yields consistent gains under increasing attack strength, across generators, and against an unseen GPT-5.1 paraphraser. An ablation over augmentation proportion identifies 100% single-step augmentation as the best operating point.

Main Findings

• Benign-condition performance is strong for PLM-based detectors. On XSum with GPT-4o-generated data, the Longformer model reaches accuracy 0.9805, macro-F1 0.9805, and AUC 0.9998, versus RoBERTa at 0.9716/0.9716/0.9995, BERT at 0.9387/0.9388/0.9942, a FastText linguistic baseline at 0.8694/0.8682/0.9694, and a LLaMA-2 perplexity + Random Forest detector at 0.5250/0.5054/0.7836.

• Domain difficulty varies sharply. The arXiv introductions are the hardest setting: with GPT-4o data the proposed model scores 0.7286 accuracy / 0.7252 macro-F1 / 0.9382 AUC, against BERT 0.6131, RoBERTa 0.5980, Linguistic 0.5200, and Perplexity 0.5650. With Claude data the same model reaches 0.9296/0.9287/0.9913.

• ROCStories is the easiest domain. With Claude Sonnet 4 data the model achieves 0.9972 accuracy, 0.9972 macro-F1, and 1.0000 AUC; BERT reaches 0.9944 and RoBERTa 0.9861.

• Benign-only training collapses under attack. On XSum with GPT-4o, a benign-trained detector drops from 0.9805 accuracy on benign test data to 0.7695 on Level-1 and 0.6652 on Level-2 test sets. With Claude data the drop is steeper: 0.6789 on Level-1 and 0.5373 on Level-2 (AUC 0.8326).

• Single-step adversarial augmentation recovers most of the loss. Level-1 training on GPT-4o data reaches 0.9475 accuracy / 0.9514 macro-F1 / 0.9947 AUC on Level-1 tests and 0.9396/0.9413/0.9920 on Level-2 tests. With Claude data, Level-1 training gives 0.9491/0.9504/0.9927 on Level-1 and 0.9332/0.9356/0.9926 on Level-2.

• Stronger augmentation yields diminishing returns. Level-2 training (single- plus two-step DIPPER paraphrases) preserves robustness but improves accuracy and AUC only marginally over Level-1; on the Claude Level-2 test set it scores 0.9143/0.9197/0.9913.

• Cross-generator transfer is competitive but slightly lower than in-generator performance. Training on Claude data and testing on GPT-4o data gives 0.9387/0.9386/0.9960 (benign), 0.9062/0.9043/0.9898 (Level-1), and 0.8877/0.8849/0.9833 (Level-2); the reverse direction gives 0.8997/0.8991/0.9933, 0.9078/0.9084/0.9825, and 0.8954/0.9010/0.9816.

• Augmentation transfers to an unseen paraphraser. Against GPT-5.1 paraphrases, GPT-4o-trained detectors improve from 0.6212 accuracy / 0.5377 macro-F1 / 0.8413 AUC (benign training) to 0.8691/0.8682/0.9662 (Level-1) and 0.8719/0.8680/0.9554 (Level-2). Claude-trained detectors improve from 0.4903/0.3694/0.7882 to 0.8134/0.8038/0.9433 and 0.7911/0.7756/0.9324.

• More augmented data helps monotonically. On the Level-1 test set, accuracy rises from 0.7695 at 0% augmentation to 0.9078 at 25%, 0.9348 at 50%, 0.9396 at 75%, and 0.9475 at 100%.

• The four classes are surface-separable. Using normalized Levenshtein distance thresholds (0.233 for GPT/XSum, 0.247 for GPT/arXiv, 0.605 for GPT/ROCStory, 0.298 for Claude/XSum, 0.366 for Claude/arXiv, 0.678 for Claude/ROCStory), 90.00%–95.00% of samples are classified as Low AI-involved and 91.18%–98.83% as High AI-involved, confirming the two classes remain distinguishable in surface form.

• Paraphrases occupy their own directions in representation space. A 10-class PCA analysis shows DIPPER outputs cluster coherently along distinct principal directions rather than interpolating smoothly within the human-writing distribution, indicating the paraphraser introduces its own stylistic regularities.

Methodology in Plain English

The researchers start by defining four authorship levels and generating each one with a different prompt strategy. The "low AI" prompt forces the model to rewrite sentence by sentence with a strict one-to-one mapping, preserving every fact, entity, date, and number. The "high AI" prompt lets the model merge, split, and restructure sentences and paragraphs while keeping all factual content. The "fully AI" prompt gives the model only a short prefix and asks it to write the complete article. Human source texts come from three domains: news, academic introductions, and short stories.

Two commercial models, GPT-4o and Claude Sonnet 4, produce the AI-involved variants. To simulate an adversary, the team runs DIPPER over the AI-involved samples, setting lexical diversity and order diversity both to 60, and applies it either once (Level-1) or twice (Level-2). A key design decision: paraphrased samples keep their original class label, because paraphrasing is a post-hoc rewrite and does not change how the text was authored.

The detector is a Longformer encoder — chosen because its sparse attention handles long documents — with mean pooling over the final hidden layer (weighted by the attention mask) feeding a single fully connected layer and softmax over four classes. Training minimizes class-weighted cross-entropy to counter class imbalance. Three training regimes are compared (Benign, Level-1, Level-2), each evaluated against test sets at all three adversarial levels, plus cross-generator and cross-attack evaluations. Baselines include a FastText linguistic classifier, a LLaMA-2 perplexity detector with a Random Forest head, BERT, and RoBERTa. Metrics are accuracy, macro-F1, and ROC-AUC at a default decision threshold of 0.5.

Why This Matters

Impact on research. The paper reframes AI-text detection as a provenance problem with discrete, generation-grounded labels rather than an unobservable continuous "AI-ness" score. It also supplies a controlled benchmark and a clear diagnosis — representation-space overlap among neighboring classes — for why paraphrasing attacks succeed, which prior work on EDITLENS-style regression scoring did not address directly.

Real-world applications:

• Academic integrity screening: distinguishing a lightly proofread student essay from one whose argument structure was written by a model.
• Publishing and editorial provenance: flagging submissions where AI restructured the discourse, not merely corrected grammar.
• Copyright and authorship attribution: providing discrete evidence about which contributor (human or model) shaped content versus surface form.
• Misinformation and content tracking: tracing how much of a circulating article originated from a model versus a human source.

Industry relevance. Any platform deploying AI-text classifiers — educational technology, publishing pipelines, content moderation, and provenance tooling — faces the paraphrasing vulnerability documented here. The finding that a single round of adversarial augmentation is nearly as effective as two rounds matters practically, because it keeps training cost low while delivering large robustness gains, including against a paraphraser the model never saw.

Future Directions

• Richer simulation of real collaboration. The authors note that real human–AI writing involves multiple revision rounds and interleaved human and AI contributions, which their controlled single-pass generation does not capture.

• Broader generator and paraphraser coverage. The limitations section flags the limited set of LLMs and paraphrasers used, constrained by API availability, cost, and output stability, and notes that fully covering the fast-moving LLM landscape remains challenging.

• Understanding why two-step augmentation plateaus. The paper reports diminishing returns from Level-2 augmentation but leaves the cause open, along with whether other paraphrase families would behave differently — the authors note other paraphrasing approaches were explored but were less effective at generating reliable adversarial examples in this multi-class setting.

• Defense against adaptive attackers. The ethics statement acknowledges that detection and paraphrasing techniques could be misused to evade detection systems, and that defending against every potential attack is outside the project's scope.

Target Audience

Researchers and practitioners working on AI-generated text detection, text provenance, and watermarking robustness; NLP engineers building content-integrity or authorship-attribution systems; and policy, publishing, or academic-integrity stakeholders who need to reason about graded rather than binary AI involvement. It is also a useful case study for readers interested in how adversarial data augmentation interacts with fine-grained classification boundaries.

Authors’ abstract

The widespread adoption of large language models (LLMs) is reshaping how textual content is produced, complicating text provenance, and raising concerns for misinformation, plagiarism, and intellectual property. While prior work on AI-generated text detection has progressed, one-dimensional human-AI co-authorship scores lack signals directly relevant to ``AI involvement''. It remains unclear how adversarial paraphrasing distorts detection signals. In this work, we formulate a discrete-class text provenance detection framework. This framework allows an abstraction of realistic co-authorship scenarios into distinct degrees of AI involvement, differentiating the AI polishing on the surface level from the AI updating the discourse structures. This framework reveals the mechanisms of how adversarial paraphrasing blurs the decision boundaries for co-authorship detectors. To improve robustness of the detectors, we augment training data with adversarial paraphrases generated by the state-of-the-art paraphrasing attack model, exposing detectors to challenging meaning-preserving rewrites. Extensive experiments across multiple datasets and generation models demonstrate that adversarial paraphrasing substantially degrades detectors trained only on benign data, while adversarial data augmentation leads to consistent robustness gains and good cross-generator transferability. Overall, our findings highlight the value of discrete-class formulation and principled data augmentation for building reliable detectors of human-AI co-authorship.