Paraphrasing evades detectors of AI-generated text, but retrieval is an effective defense

“Consequently, post-processing can weaken surface-level evidence without necessarily removing every relation between the text and an LLM-conditioned generation process (Krishna et al., 2023).”

“We specifically evaluate novelty checks as deployed inside AI-scientist pipelines, and also focus on counterfactual changes rather than alignment with explicit human novelty labels, akin to how paraphrase attacks test text detectors (Krishna et al., 2023).”

“…classifiers or word-frequency signatures whose calibration is uncertain [8–10], which drift as models change and as authors adapt their usage [11, 12], and which can be expected to be least reliable for agentic workflows, in which a model writes analysis code and generates results as well as…”

“5-32B-Instruct (Yang et al., 2024) and the dgMARK prompt (cf. Krishna et al., 2023).”

“AI-generated text detection has proven fragile: paraphrasing can substantially degrade detectors (Sadasivan et al., 2024; Krishna et al., 2023), while detectors may capture unintended linguistic characteristics such as non-native writing style (Liang et al., 2023a).”

“…scenario in which producers adapt the surface until the metric is flunked, as with AI-text detectors defeated by paraphrasing and humanization (Krishna et al. 2023; Li et al. 2026), and in our case the paratactic profile, such as the one in Figure B.3, shows exactly which surface to adopt.”

“The most widely studied approach is paraphrasing, where an auxiliary model rewrites the generated text while attempting to preserve its semantic meaning [21].”

“Such signals can make attribution relatively easy, but they are also fragile, and post-generation editing can weaken text-based detectors (Krishna et al., 2023; Dugan et al., 2024).”

“Behavioral differences between models from the same family or between different parameter scales may be subtle, task-dependent, and easy to smooth or obscure through prompt engineering or response post-processing [3, 17].”

“Paraphrasing uses DIPPER-XXL (Krishna et al., 2023) with lexical and order diversity both set to 20.”

“Paraphrasing attacks substantially reduce the quality of detectors of machine-generated text [6], which calls into question the reliability of such detection in general [8].”

“Krishna et al. (2023) established paraphrase evasion and proposed retrieval as a defense.”

“06 under DIPPER, so Pegasus alone is an artifact of a weak attacker.”

“Prior attacks remove the watermark (Krishna et al., 2023; Zhang et al., 2024) or spoof its presence (Jovanovi´c et al., 2024; Gu et al., 2024; Pang et al., 2024; Jiang et al., 2025).”

“Paraphrasing (Krishna et al., 2023), expert edits (Artemova et al., 2025) and homoglyphs (Creo and Pudasaini, 2025; Macko et al., 2024) evade detection, and detectors flag lightly AI-polished writing (Saha and Feizi, 2025).”

“The inability of conventional methods to examine semantic equivalence allows such content to easily escape detection (Krishna et al., 2023).”

“Screening at a low rate of flagging human-written texts has been recommended in the first place [17,19].”

“Baselines include simple and recursive paraphrasing following Cheng et al. [17], building on prior paraphrasing attacks [16, 28], as well as the AdvPara variants [17].”

“For rewriting-based attacks, we consider synonym substitution and para-phrasing (with DIPPER paraphraser (Krishna et al., 2023)).”

“Paraphrasing and synonym substitution change token distributions, and earlier work has pushed detector accuracy close to chance with them (Krishna et al., 2023; Sadasivan et al., 2023).”

“85, computed over sentence embeddings from a pretrained encoder (Krishna et al., 2023).”

“Paraphrasing alone likewise substantially degrades trained classifiers, zero-shot methods, and watermark-based approaches [28, 47], and broader stress tests that add editing, prompting, and co-generation attacks report similar failures [50, 53].”

“Together with DIPPER (Krishna et al., 2023), these methods form our six published baselines.”

“To address the third, we insert DIPPER paraphrasing and back-translation before surrogate training and jointly assess the provenance evidence, capability, and fidelity of the resulting surrogates (Krishna et al., 2023; Liang et al., 2025a).”

“Robustness is evaluated under Parrot (Damodaran, 2021) and Pegasus paraphrasing (Zhang et al., 2020), DIPPER rewriting (Krishna et al., 2023), and API-based rewriting with DeepSeek-V4-Pro (Xu et al., 2026).”

“DIPPER also fares poorly on these tasks.”

“Researchers have proposed several approaches for detecting AI-generated text, including zero-shot statistical methods [5], [6], token-distribution analysis tools [7], watermarking techniques [8], and supervised classifiers [9], [10].”

“Likelihood-based zero-shot detectors collapse under paraphrasing: DetectGPT falls from 70.3 percent to 4.6 percent detection at 1 percent false positives (Krishna et al., 2023).”

“Dipper performs context-aware para-phrasing by controlling lexical diversity and content reordering (Krishna et al., 2023).”

“Paraphrasing with a second model substantially reduces the per-token signal [25], [29], and the watermark does not survive translation [26].”

“Similarly, Krishna et al. [24] explored paraphrasing strategies and showed that even when content is rewritten, certain stylistic signatures of the originating model can persist.”

“Following prior research [4], we evaluate our method ToSS using the following datasets: OpenGen [15], C4-News [16], and Essays [17].”

“We use DIPPER [Krishna et al., 2023] as the humanizer and apply it to our corpus of Llama generated documents for all 3 datasets.”

“It was shown in Krishna et al. [18] that a one-pass paraphrasing system (DIPPER) can cause English detector performance to decline by as much as 30 F1 points, leading to a new line of work in augmented defenses based on information retrieval and watermarks [2].”

“Not all attack vectors are included, since the paraphraser was never trained adversarially on top of a particular detector, which could have improved the attack [4].”

“As emphasized by Krishna et al., detectors often exhibit “conservative” behavior when under attack, tending to label suspicious text as “Human” [7].”

“As detection methods advance, attackers simultaneously employ advanced paraphrasers like DIPPER to evade detection frameworks [18].”

“Instead, they employ Interleaved Human-AI Writing or Statistical Hijacking (Sadasi-van et al., 2025; Krishna et al., 2023).”

“Paraphrasing attacks pose a major challenge for watermark detection (Krishna et al., 2023; Kirchenbauer et al., 2024).”

“It preserves the main meaning of a passage while evading several detector families [16].”

“Third, they can be easily attacked by malicious users and have been found to completely fail to detect non-native speech when a simple paraphrase of the input is used, with accuracy dropping from over 90% to under 30% [8,9].”

“Krishna et al. [9] introduced a dedicated paraphraser; Sadasivan et al. [13] iterated it; a recent large-scale study [3] chains rewritings up to five deep and reports detection falling from 87 .”

“However, supervised detectors are often sensitive to distribution shift: performance can degrade under paraphrasing attacks [28], unseen generators [29], or changes in content domain.”

“First, many detectors rely on style-level signals (probability curvature, perplexity ratios, stylometric features) that paraphrasing can alter without changing semantics [1, 12].”

“Prior work shows that surface edits, stylometric camouflage and prompt-based rewriting can each reduce the reliability of AI-generated text detectors [19, 20, 22, 18, 21].”

“…partitions into “green” and “red” partitions; A. Experimental Setup 1) Dataset and Prompt: We utilize two English datasets (i.e., C4 [34] and LFQA [36]) and a Chinese dataset (i.e., HC3-Chinese [37]) to evaluate watermark algorithms, where 500 samples with lengths of 190 to 210 tokens are…”

“…provides additional context for evaluating rewritten machine text: RAID finds substantial degradation across unseen generators, decoding strategies, and adversarial transformations [10], while controlled paraphrasing can sharply reduce detector accuracy without large semantic changes [11].”

“Five directions are immediate: (i) evaluate against grammar-preserving paraphrase (e.g. DIPPER), the strongest attack left untested; (ii) tighten the analytic FPR bound under non-i.i.d. statistics, where the empirical-SD recalibration of Subsection D.2 closes the deployment gap but the closed form stays loose at large…”

“Paraphrasing For paraphrasing, we utilise DIP-PER paraphrasing tool (Krishna et al., 2023), a detection-model-agnostic method (as opposed to the adversarial paraphrasers) that performs lexical rephrasing as well as sentence reordering.”

“Sadasivan et al. [14] and Krishna et al. [15] argue that paraphrase attacks reduce achievable detection AUC and, in the limit, prevent reliable detection without watermarking [16].”

“For text generation, we use the C4 realnewslike dataset [Raffel et al., 2020], which contains formal journalistic content, and the OpenGen dataset [Krishna et al., 2023], which covers conversational and creative text.”

“Literature indicates that rewriting LLM-generated text using the DIPPER (Discourse Paraphraser) model can drastically reduce the detection rate of DetectGPT from 70.3% down to 4.6% [4].”

“13,20 A major challenge is that detection methods can quickly become outdated as AI text generation evolves.”

“Previous research demonstrated that state-of-the-art detectors like DetectGPT experience significant performance drops under token perturbations or LLM paraphrasing [12].”

“Krishna et al. [18] showed that even simple paraphrasing attacks can reduce detector accuracy to near-random levels, raising questions about practical deployability.”

“Recursive paraphrasing [16], [17] effectively removes token-level watermarks while preserving meaning.”

“Linguistic and process based methods, such as analyzing draft histories or writing style deviations, are also being developed to identify AI-assisted work [22].”

“Paraphrasing and semantic rewriting can eventually destroy most token-level watermarks, including ours, if the attacker is allowed sufficient edit budget and can rewrite aggressively [25, 11].”

“For instance, while we find that people most often use physical cues, such as hands or teeth to detect AI-generated content, we also find evidence to suggest that people are increasingly moving away from relying on fine-grained details, and instead using mental models developed over time about…”

“Alternatively, machine text may be passed through a trained paraphraser to disrupt rank order scores of tokens (Krishna et al., 2023), or a pipeline of multiple paraphrasers, which can amplify this degradation.”

“Orthogonal to watermarking, paraphrasing-detection methods attempt to identify machine paraphrase patterns directly, e.g., by modeling machine paraphrasing behavior or by inverting paraphrases (Krishna et al., 2023; Lu et al., 2025).”

“The paraphrasing model DIPPER-XXL (Krishna et al., 2023) is used with the parameters Lexical diversity = 60 and Reordering = 20 .”

“For capacity expansion and generalizability tests, we also use the GPT-2 model [22] and the OpenGen dataset [23].”

“SeedHijack is compared against three state-of-the-art baselines: self-paraphrasing [4], token editing [5], and prompt injection [6].”

“It also provides paraphrased texts generated by Dipper [63], LLM-based polishing, and back translation.”

“While paraphrasing remains a significant threat to detector accuracy, research suggests that semantic retrieval and caching API outputs can act as effective defenses [16].”

“As AI-generated content becomes indistinguishable from human output [41, 42], especially under adversarial optimization [43, 44], content-level detection will fail.”

“This property was first observed by Krishna et al. [8] and is exploited by SIGIL’s Semantic Topic strategy.”