Paraphrasing evades detectors of AI-generated text, but retrieval is an effective defense

“Watermarking schemes face a parallel limitation: they require cooperation from the model provider, and are trivially defeated by paraphrasing, re-generation through a non-watermarked model, or post-processing [51].”

“Early systems based on n-gram statistics, entropy, or distributional features were reasonably interpretable, but they struggle with modern LLMs that produce fluent and diverse text [1].”

“Sadasivan et al. (2023) prove a fundamental upper bound on detector accuracy as the gap between the human and model distributions shrinks, and Krishna et al. (2023) show empirically that even a small paraphrasing bud-get collapses the performance of state-of-the-art detectors.”

“…close to chance, whereas our R EACT degrades much less and remains substantially more robust. revolve around humanizing MGT to evade detection (Krishna et al., 2023; Koike et al., 2024), we are motivated by the intuition of “fight poison with poison” and focus on constructing highly humanized…”

“Finally, we build a dataset for DPO, { (cid:0) q, t j + , t j − (cid:1) | q ∈ Q } by selecting a chosen response t j + t j − for each query q ∈ Q , j + = argmax j ∈{ 1 ,...,k } S j , j − = argmin j ∈{ 1 ,...,k } S j .”

“Studies also show that while some detectors perform well on unedited AI-generated text, their accuracy can decline substantially when outputs are paraphrased or human-edited; for example, paraphrasing can dramatically reduce detection accuracy, in some cases from over 70% to below 5% [10].”

“The practice of translation and paraphrase laundering, which uses AI tools to hide text origins while avoiding detection, has direct marketing support from commercial humanizer services although there is limited information about its actual occurrence [5,23].”

“AI-generated text detectors are known to be brittle under adversarial perturbations (Krishna et al., 2023).”

“Concretely, we train UPV’s generator and detector networks on C4 and OpenGen for Llama-3.”

“[4] .”

“Across all settings, WorldCup delivers both reliable watermark detection and accurate bit recovery, even as payload scales up.”

“[2, 11, 14] Early plagiarism and AI-text detectors relied heavily on n n-gram overlap and simple stylometric fingerprints, but recent work shows that targeted paraphrasing can reduce detection accuracy for state-of-the-art detectors by large margins while preserving semantic content .”

“Adversarial attacks : For code, adversarial attacks often involve subtle, functionality-preserving modifications (e.g., reordering non-dependent code lines, renaming variables) to evade detection—unlike natural language, where heavy rewriting may still preserve meaning [7][8][9].”

“Krishna et al. [10] showed that paraphrasing operations can substantially reduce the effectiveness of several detection schemes, illustrating that likelihood-based cues can be altered without changing the underlying content.”

“Existing paraphrasing-based methods, such as Dipper [13], Recursion [14], and prompt-based attacks [15], have shown limited effectiveness, primarily due to their reliance on fixed models or prompt templates.”

“• DIPPER(2024) [29]: a controllable paraphrasing framework that disentangles privacy and utility dimensions to support adjustable rewriting.”

“[4] and [8] have shown mixed results in AI-generated text detection when obfuscation techniques are used.”

“Beyond watermarking, another proactive detection approach is the use of retrieval-based systems (Krishna et al., 2024).”

“As outlined in Section 1, empirical evidence from [13] higlights the vulnerability of the KGW method to paraphrasing attacks, which significantly degrade detection performance.”

“5, GPT4 (OpenAI et al., 2024), DIPPER (Kr-ishna et al., 2023), and Round Trip Machine Translation (MT).”

“One strategy is to record [27] or watermark all generated text [28], but such preemptive measures require complete control over the generative models.”

“Successors such as RingID and ShapeMark extend these ideas to support multiple keys and better preserve output diversity while retaining robustness [21], [23].”

“These methods are generally susceptible to paraphrasing attacks [14] but effective retrieval mechanisms can mitigate paraphrasing attacks and improve detection rates [15].”

“It’s utilized in machine translation [37], dialogue systems [38], summarization [39], and paraphrasing [40].”

“Additionally, watermarks can be defeated by rewriting the text: a clever user could paraphrase the AI output, diluting or destroying the watermark signal [17].”

“…paraphrasing and RL-based anonymization improve the privacy– utility trade-off compared with redaction-only base-lines, but they typically optimize uniform objectives across all inputs (Krishna et al., 2024; Chong et al., 2025; Yang et al., 2025; Kim et al., 2025; Loiseau et al., 2025).”

“Moderate, semantics-preserving rewriting by systems such as DIP-PER (Krishna et al., 2023) can significantly degrade detection accuracy.”

“As these models become more accessible, discerning between human-authored and AI-generated text is a significant concern for maintaining trust and accountability in digital communication [4].”

“The DIPPER attack employs the 11B document-level paraphrasing model proposed by (Krishna et al., 2023), which rewrites LLM outputs with controlled lexical diversity and content reordering.”

“…noted that machine-generated text is hard to detect in general (Jakesch et al., 2023), across domains (Li et al., 2024), in adversarial contexts (Krishna et al., 2023), and in social media-like interactions (Radivojevic et al., 2024), with humans often performing worse than automatic systems…”

“Because token-level carriers are tightly bound to specific lexical sequences, they lack robustness against synonym substitution and paraphrasing [1], [2], [3], [7].”

“For paraphrasing, we apply two Dipper [29] configurations that vary in lexical and order diversity.”

“Howerver, many studies[31, 8, 32, 33, 6, 34] have indicated that current MGT detectors exhibit vulnerabilities in real-world detection scenarios, facing challenges to their robustness when subjected to various attacks and adversarial paraphrasing from other pre-trained models.”

“Paraphrase For paraphrasing we run the DIPPER-11B model 12 from Krishna et al. (2023) through HuggingFace (Wolf et al., 2020).”

“The experimental results also confirm that compared to paraphrase attacks [14, 15], SICO can achieve much higher attack success rate and better textual quality across all the three tasks and six detectors.”

“Unfortunately, such methods allow adversaries to check if some output was produced as a response to another user’s query, as acknowledged by [79].”

“While a great deal of past work has focused on the classification of human-written and AI-written content (Jawahar et al., 2020; Krishna et al., 2023; Mitchell et al., 2023; Sadasivan et al., 2025), there has been little work on classifying between content generated by different LLMs, either…”

“Krishna et al. (2023) has reported the attack success of their paragraph-level paraphraser on some MGT detectors, but a comprehensive study across a wider range of paraphrasers and detectors is missing in the literature.”