CoChat
Sign Up
PreprintCited by 4Adversarial Robustness in Machine LearningDigital Media Forensic DetectionSpam and Phishing Detection

Efficient Black-Box Adversarial Attacks on Neural Text Detectors

Open access
Fishchuk, Vitalii, Braun, Daniel·2023·arXiv
DOI 10.48550/arxiv.2311.01873arXiv 2311.01873
Open this paper in CoChat — free account

Abstract

Neural text detectors are models trained to detect whether a given text was generated by a language model or written by a human. In this paper, we investigate three simple and resource-efficient strategies (parameter tweaking, prompt engineering, and character-level mutations) to alter texts generated by GPT-3.5 that are unsuspicious or unnoticeable for humans but cause misclassification by neural text detectors. The results show that especially parameter tweaking and character-level mutations are effective strategies.

Integrity signals

Registry

DataCite · 10.48550/arxiv.2311.01873

Cites

Statistics

Recomputing p-values needs the paper’s full text.

Claims the paper makes

We couldn’t retrieve this paper’s full text, so its claims and self-check weren’t run. The registry and citation checks still apply.

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • GPT-4 has richer prose than GPT-3.5, and many detectors perform significantly worse on GPT-4.

    “GPT-4 has a richer prose than GPT-3.5 (Fishchuk, 2023), and many detectors perform significantly worse on the former.”

    From Generative AI detection in higher education assessments (2025) · cites this paper as Fishchuk, 2023

  • Existing detectors lack robustness to repetition penalties.

    “Existing detectors also lack robustness to various factors, such as alternative decoding strategies [Ippolito et al., 2020], input sequence length [Solaiman et al., 2019], different prompts [Kumarage et al., 2023;Lu et al., 2023], and repetition penalties [Fishchuk and Braun, 2023].”

    From Authorship Attribution in the Era of LLMs: Problems, Methodologies, and Challenges (2025) · cites this paper as Fishchuk and Braun, 2023

Cited by

Sorted by citations

Authors
Fishchuk, V., & Braun, D.
Affiliations
University of Twente (NL)
ORCID
Braun, Daniel
Venue
arXiv
Publisher
arXiv
Published
2023
DOI
10.48550/arxiv.2311.01873
arXiv
2311.01873
OpenAlex
W4388444665
Cited by
3
References
0
Citations by year
2026: 1 · 2025: 1 · 2024: 1
FWCI
0.53
Type
conference paper
Language
en
Open access
Licence
Locations
  • University of Twente Research Information (publishedVersion, other-oa)
  • arXiv (Cornell University) (submittedVersion, cc-by)
  • arXiv (Cornell University) (cc-by)
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
  • Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Digital Media Forensic Detection
  • Physical Sciences › Computer Science › Information Systems › Spam and Phishing Detection
Keywords
adversarial attacks, black-box attacks, GPT-3.5, prompt engineering, text classification

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review