Paraphrasing evades detectors of AI-generated text, but retrieval is an effective defense

“The first is the paraphrase attack, which uses the Dipper paraphraser [41] and Google Translate’s Back-translation to rewrite the generated MGT.”

“Despite various advances, most models still fall short in detecting AI-generated text due to the usage of AI-979-8-3315-8649-2 based paraphrasers and other tools to bypass detection [6][7].”

“…[25], (RBM)Restricted Boltzmann Machine [26] , Hybrid methods that combine the advantages of different technologies to deliver better results [27][28][29][30][31][32]. they used clustering as a means of extracting features [33][34][35] [36] [37] Each algorithm or method has advantages and…”

“This approach utilized paraphrased sentence patterns introduced by an external model known as DIPPER [35], highlighting the challenges associated with detecting discourse-paraphrased sentences which combines LLMs such as T5 and a sentence shuffle strategy to generate training data for discourse…”

“For instance, they exhibit different behaviors for semantically equivalent sentences composed with different syntactic/lexical structures (Krishna et al., 2023; Cao et al., 2021; Zou et al., 2023; Meng et al., 2022).”

“A large body of research is attributed to building detectors for the text generated by AI bots [1], [3], [4], [5], [6], [17], [18], [19], [20].”

“…identify and generate para-phrases is of significant interest, with applications in data augmentation (Iyyer et al., 2018), question answering (Dong et al., 2017), duplicate question detection (Shah et al., 2018) and more recently on studies about detecting AI-generated text (Krishna et al., 2023).”

“Previous studies in the field of AI detection tools indicate that the detection accuracy of these tools can be manipulated (Krishna et al., 2023).”

“Although remarkable advancements have been made, the current methodologies have serious shortcomings [13] that have hindered their large-scale implementation.”

“We evaluate our watermarking method’s robustness against two types of attacks on HumanEval dataset: DIPPER paraphrase attacks [17] and variable renaming attacks.”

“…there are research directions aimed at addressing the challenges to detection, such as robustness analysis of existing classifiers against paraphraser (Sadasivan et al., 2023; Krishna et al., 2023), there is a lack of fundamental analysis regarding the factors that impact the detection performance.”

“We evaluate robustness on Dolly-CW using both the original Dipper paraphrasing attack [33] and the stronger Boosted-Dipper variant proposed by Jovanovi ´ c et al. [8] (Table VI).”

“We consider four datasets: Reddit Writing-Prompts (Verma et al., 2024), LFQA dataset (Krishna et al., 2023), MMW BookReport and FakeNews (Piet et al., 2025).”

“Whereas token-level signals can be removed by paraphrasing (Krishna et al., 2023), repairing these patterns requires restoring the missing relations without changing the underlying science.”

“LLM watermarking has therefore emerged as a promising solution because it embeds machine-verifiable signals during generation [16] and does not depend only on post-hoc detection, which is fragile under paraphrasing [17, 23].”

“Post-generation methods use paraphrasing, rewriting, watermark modification, and transferable substitutions to change detectable traces while preserving much of the original content (Krishna et al., 2023; Sadasivan et al., 2025; Wang et al., 2024a; Fang et al., 2025; Dathathri et al., 2024).”

“We evaluate mainly on C4 RealNewsLike [Raffel et al., 2020], and additionally use Mistral-7B [Jiang et al., 2023] and OpenGen [Krishna et al., 2023] for ablation experiments.”

“As a pure semantic-rewriting reference we include Dipper (Krishna et al., 2023), an 11B paraphraser not designed for anonymization.”

“Second, robust detectors should generalize across generators and domains: the MAGE benchmark shows that existing detectors degrade sharply on unseen generators [26], and our use of paraphrased text, which strongly evades detection [15], further stresses this setting.”

“(3) We identify double erasure : AI-assisted text may simultaneously become difficult to attribute to its human author and difficult to identify using current AI-text detectors [16, 19].”

“Table 6 reports the robustness of DEW under four DIPPER configurations.”

“While these methods are successful at identifying entirely AI-generated texts, they lack resilience against diverse attack strategies (Gao et al., 2018; Dyrmishi et al., 2023; Krishna et al., 2024; He et al., 2024; Dugan et al., 2024; Wu et al., 2024; Wang et al., 2024; Zhou et al., 2024).”

“Krishna et al. [ 17 ] demonstrated that paraphrasing substantially degrades detection accuracy, establishing that lexical stability alone provides an insufficient basis for robust identification.”

“The retrieval-generation pipeline dilutes green-token statistics, and adversarial paraphrasing can actively erase the watermark (Krishna et al., 2023; Kirchenbauer et al., 2023b; Liu et al., 2024).”

“Specifically, detector feedback is used to construct supervised fine-tuning datasets (Krishna et al., 2023), as guided sampling score (Cheng et al., 2026; Sadasivan et al., 2025).”

“Early attack approaches use paraphrasing to preserve semantics while resampling expressions (Krishna et al., 2023), or sampling from multiple keys to perform majority voting (Pang et al., 2024).”

“Prior work argues this defense is effective against learned token-level schemes (Roger and Greenblatt, 2023), and paraphrase has been shown to neutralize related surface-level signals including LLM watermarks and AI-text detector cues (Kirchenbauer et al., 2023; Krishna et al., 2023).”

“…to specifically target robustness to paraphrasing and adversarial attacks (e.g., Hu et al., 2023; Koike et al., 2024; Sadasivan et al., 2025; Krishna et al., 2023), short-text settings (e.g., Tian et al., 2024; Ku-marage et al., 2023), bias and fairness concerns (e.g., Liang et al., 2023),…”

“From the application side, edit errors naturally model transformations that arise in modern AI pipelines, including paraphrasing, rewriting, cropping, and other operations that disrupt synchronization [KSK + 23, SKB + 23, QZT + 25, KKR + 24, SZL + 24, ASG + 19].”

“Each non-paraphrased condition has an ID-aligned paraphrased counterpart constructed by passing the user prompt through DIPPER [17] ( lex =60 , order =60 ) before re-querying the teacher.”

“The original audio captions are retained to preserve large-scale event-level corresponding relations, mean-while avoiding additional linguistic noise introduced by LLM rewriting [63].”

“Importantly, simple paraphrasing and rewriting strategies have also been shown to evade or destabilize existing detectors [17, 20, 41].”

“Stronger rewrite attacks, including recursive paraphrasing and learned paraphrase models, further show that surface-level watermark signals can be diluted while much of the meaning is preserved [Krishna et al., 2023, Piet et al., 2023].”

“…fall short in accuracy and reliability, especially as AI models and writers’ practices (e.g., prompting and editing strategies) continue to evolve [57, 59, 130], transparent AI use relies largely on writers’ AI disclosure —the practice of disclosing AI contribution in content creation [96, 124].”

“While these detectors achieve high in-domain accuracy, both zero-shot and supervised methods degrade substantially under real-world adversarial settings, such as AI-polished text or perturbation attacks (Wu et al., 2024; Krishna et al., 2023).”

“Retrieval-based approaches (Krishna et al., 2023) match text against known generator outputs via semantic similarity.”

“First, trigger-based watermarking [23, 26, 34] relies on fragile surface-form cues, making it vulnerable to paraphrasing [13, 27].”

“Scrubbing attacks can be implemented using pure text modification techniques(Zhang et al., 2023; Krishna et al., 2023; Chang et al., 2025).”

“In contrast, strong training-free baselines exhibit substantially higher robustness to paraphrasing attacks, likely because DIPPER-based paraphrasing mainly introduces lexical and syntactic variations without fundamentally altering underlying statistical features.”

“Finally, information retrieval-based methods [13] detect AI-generated content by searching a database for semantically similar matches.”

“…muestra que la reformulación y la paráfrasis pueden eludir detectores de texto generado por IA, reduciendo su confiabilidad como solución central (Krishna et al., 2023), evidencia lo que Morin define como una ceguera del conocimiento: el error de intentar resolver un problema complejo mediante…”

“For the text-based data, we tokenized GPT-and human-generated answers [19] to prompts and embedded them using a pretrained Roberta model.”

“Paraphrased data was created using the model DIPPER developed for adversarial paraphrasing attacks on machine-generated text detectors (Krishna et al., 2024).”

“Nonethe-less, both supervised and zero-shot detection techniques are notably sensitive to out-of-distribution texts and are vulnerable to attacks, such as para-phrasing (Krishna et al., 2023), which significantly undermine their robustness in adversarial scenarios.”

“In particular, an accused can para-phrase or otherwise obfuscate text prior to training (Krishna et al., 2023; Sadasivan et al., 2025; Zhang et al., 2025).”

“For every instance, anonymized outputs are generated by A ZURE , D IPPER , A DV .”

“To remove water-marks, mainstream methods typically apply heuristic perturbations to the AIGC, such as paraphrasing [23,35] or inserting perturbations [20, 22] for the generated texts, or using processing operations [4, 43] such as photometric distortions for images.”

“The P-SP metric is widely used to measure paraphrasing quality (Rastogi, Maini, and Pruthi 2025; Krishna et al. 2023).”

“On one side, model providers and researchers seek to improve detection accuracy and robustness; on the other, adversaries explore evasion techniques such as paraphrasing, synonym substitution, noise injection, or the use of multiple LLMs to dilute detectable patterns [1], [2].”

“The rapid evolution of large language models has made detecting LLM-generated text increasingly challenging, especially under paraphrase-based obfuscation attacks [6,7].”

“In contrast, DIPPER-1 and DIPPER-2 perform poorly against SimMark because they paraphrase each sentence independently, preserving the sentence segmentation exploited by sentence-level watermarks.”

“Yet, such models overlook structural cues and are vulnerable to paraphrasing or prompt-based polishing (PSP), leading to performance drops sharply under PSP attacks [12] as shown in fig.”

“As shown in Table 2, we evaluate CodeTracer ’s robustness against DIPPER [10] paraphrasing and variable renaming attacks [13].”

“2) Retrieval Based Methods: [14] introduced a retrieval-based detection approach that relies on a database storing all machine-generated texts from a specific model, limiting its implementation to the model owner.”

“Texts were generated with Llama 2-7B model and prompts were taken from the OpenGen dataset [12].”

“The most effective approach is DIPPER [23].”

“Prior work on watermark scrubbing studies effective watermark removal by paraphrasing [4, 11, 13, 13, 29] or leveraging the LM’s side information [22].”

“In this case, we assume Q ϕ = LLaVA and W ϕ = DIPPER.”

“That’s how the idea of a cloud-based approach to ruling out AI-generated materials was born [10].”

“Studies by Sadasivan et al. (2024) and Krishna et al. (2023) demonstrated that paraphrasing can effectively eliminate the watermark, rendering this method ineffective.”

“It is beneficial to maximize N , hence maximizing the gap in exits between the two classes, because the task should be easier to learn if the samples are more definitive examples of early-exiting and late-exiting texts.”

“Various approaches exist to trick or bypass these detection mechanisms, including paraphrasing the generated texts (Krishna et al., 2023).”

“The proposed defense is retrieval against a store of previously generated text rather than any representation of the paraphrase (Krishna et al., 2023).”

“Krishna et al. (2023) and Weber-Wulff et al. (2023) describe evasion strategies designed to bypass detection, such as paraphrasing, synonym replacement, misspelling, and article deletion, that can successfully bypass many AI detectors, which questions their reliability.”

“Krishna et al. in [4] report similar challenges, noting that AI-assisted paraphrasing often avoids detection due to preservation of human syntactic patterns.”

“Such retrieval-enhanced methods improve robustness of detectors across diverse domains and attacks (Krishna et al., 2023; Sadasivan et al., 2023), or enhance the LLM-based detection performance through adversarial in-context learning (Koike et al., 2024b) and improve detection interpretability…”

“Krishna et al. [37] proposed the DIPPER paraphrase model to evade AI-text detectors and a corresponding retrieval-based defense to secure detection against such attacks.”

“AIGT detectors are known to be vulnerable to para-phrase attacks (Wang et al., 2024a; Krishna et al., 2023).”

“Krishna et al. (2023) introduced DIP-PER, an 11b paraphrase generation model that can evade several detectors, including watermarking, GPTZero, DetectGPT, and OpenAI’s now defunct text classifier (Tian, 2023; Mitchell et al., 2023; Kirchner et al., 2023).”

“…focuses on distinguishing between human and AI-generated content generated independently (Gehrmann et al., 2019; Sadasivan et al., 2023; Mitchell et al., 2023; Krishna et al., 2023; Chakraborty et al., 2023), neglecting the nuances of different human writing styles, and ignoring co-authored text.”

“5-turbo is more powerful in removing the watermarks compared to Dipper model [31].”

“Prior works have focused on detecting fake images and videos [11], [14], [18], [37], [52], [61], [66], [69], as well as AI-generated text [31], [41].”

“…range and familiar with adversarial evasion strategies available at inference, such as generation parameters modification (Fishchuk and Braun, 2023; Ippolito et al., 2020), paraphrasing (Krishna et al., 2023a), or alternative prompting strategies (Wu and Hooi, 2023a; Bakhtin et al., 2019).”

“The interfaces are in Figure 5 and Figure 6 respectively.”

“Common transformations include synonym substitution, paraphrasing, back-translation, summarization, sentence restructuring, and LLM-based rewriting [67], [69], [70].”