CoChat
Sign Up
Cited by 164Authorship Attribution and ProfilingSpam and Phishing DetectionDigital Media Forensic Detection

Paraphrasing evades detectors of AI-generated text, but retrieval is an effective defense

Open access
Krishna, Kalpesh, Song, Yixiao, Karpinska, Marzena, Wieting, John, Iyyer, Mohit·2023·Advances in Neural Information Processing Systems 36
DOI 10.52202/075280-1195
Open this paper in CoChat — free accountOpen PDF

Abstract

The rise in malicious usage of large language models, such as fake content creation and academic plagiarism, has motivated the development of approaches that identify AI-generated text, including those based on watermarking or outlier detection. However, the robustness of these detection algorithms to paraphrases of AI-generated text remains unclear. To stress test these detectors, we build a 11B parameter paraphrase generation model (DIPPER) that can paraphrase paragraphs, condition on surrounding context, and control lexical diversity and content reordering. Using DIPPER to paraphrase text generated by three large language models (including GPT3.5-davinci-003) successfully evades several detectors, including watermarking, GPTZero, DetectGPT, and OpenAI's text classifier. For example, DIPPER drops detection accuracy of DetectGPT from 70.3% to 4.6% (at a constant false positive rate of 1%), without appreciably modifying the input semantics. To increase the robustness of AI-generated text detection to paraphrase attacks, we introduce a simple defense that relies on retrieving semantically-similar generations and must be maintained by a language model API provider. Given a candidate text, our algorithm searches a database of sequences previously generated by the API, looking for sequences that match the candidate text within a certain threshold. We empirically verify our defense using a database of 15M generations from a fine-tuned T5-XXL model and find that it can detect 80% to 97% of paraphrased generations across different settings while only classifying 1% of human-written sequences as AI-generated. We open-source our models, code and data.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.52202/075280-1195

Cites

0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Simple paraphrasing leads to an average relative drop in T@1%F of 30.27%.

    “On average, simple paraphrasing leads to a 30.27% relative drop in T@1%F.”

    From Adversarial Paraphrasing: A Universal Attack for Humanizing AI-Generated Text (2025) · cites this paper as [15]

    Section 4.1 defines detection accuracy at a 1% false-positive rate, and Section 4.3 reports that paraphrasing significantly lowers it. But the paper reports results for DIPPER paraphrasing and does not state an average relative drop of 30.27% or identify that figure with simple paraphrasing. (LLM, conf=0.87)

    Experimental — accuracy not yet measured

  • Rather than promoting ethical academic behavior, AI detection tools often encourage strategic avoidance tactics, such as paraphrasing services or altering sentence structures to bypass detection.

    “Rather than promoting ethical academic behavior, AI detection tools often encourage strategic avoidance tactics, such as paraphrasing services or altering sentence structures to bypass detection [15,23].”

    From Evaluating the Effectiveness and Ethical Implications of AI Detection Tools in Higher Education (2025) · cites this paper as [23]

    Section 4.4 describes paraphrasing as a tactic for evading AI-text detectors, and the Ethical Considerations section notes that students could use such attacks. The paper does not establish that detection tools often encourage avoidance tactics or that they fail to promote ethical academic behavior. No page numbers were supplied in our copy. (LLM, conf=0.86)

    Experimental — accuracy not yet measured

  • This undermines the goal of meaningful learning, as students are more focused on passing algorithmic checks than developing deeper critical thinking and reflective writing skills.

    “This undermines the goal of meaningful learning, as students are more focused on “passing” algorithmic checks than developing deeper critical thinking and reflective writing skills [23].”

    From Evaluating the Effectiveness and Ethical Implications of AI Detection Tools in Higher Education (2025) · cites this paper as [23]

    The Ethical Considerations section mentions college students as potential users of ChatGPT in essays who might wish to evade AI-text detectors. It does not establish that students generally focus more on passing checks than on critical thinking or reflective writing, or that detection undermines meaningful learning. (LLM, conf=0.77)

    Experimental — accuracy not yet measured

  • Sadasivan et al. [28] and Krishna et al. [15] demonstrated how AI-generated text can be paraphrased by another AI model to evade detection by existing AI detectors.

    “Sadasivan et al. [28] and Krishna et al. [15] demonstrated how AI-generated text can be paraphrased by another AI model to evade detection by the existing AI detectors.”

    From Adversarial Paraphrasing: A Universal Attack for Humanizing AI-Generated Text (2025) · cites this paper as [15]

  • Krishna et al. [15] proposed DIPPER, a powerful T5-based paraphrasing model that significantly enhances the effectiveness of such attacks.

    “Krishna et al. [15] proposed DIPPER, a powerful T5-based [24] paraphrasing model that significantly enhances the effectiveness of such attacks.”

    From Adversarial Paraphrasing: A Universal Attack for Humanizing AI-Generated Text (2025) · cites this paper as [15]

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

The publisher hasn’t deposited this paper’s reference list.

Research works printed but not linked: 69

  1. S. Abdelnabi and M. Fritz. Adversarial watermarking transformer: Towards tracing text provenance with data hiding. In 2021 IEEE Symposium on Security and Privacy (SP), pages 121-140, 2021.
  2. R. R. Agrawal, M. Turchi, and M. Negri. Contextual handling in neural machine translation: Look behind, ahead and on both sides. In 21st annual conference of the European association for machine translation, pages 11-20, 2018.
  3. S. Badaskar, S. Agarwal, and S. Arora. Identifying real or fake articles: Towards better language modeling. In Proceedings of the Third International Joint Conference on Natural Language Processing: Volume-II, 2008. URL https://aclanthology.org/I08-2115.
  4. A. Bakhtin, S. Gross, M. Ott, Y. Deng, M. Ranzato, and A. Szlam. Real or fake? learning to discriminate machine from human generated text. arXiv preprint arXiv:1906.03351, 2019. · arXiv
  5. D. Beresneva. Computer-generated text detection using machine learning: A systematic review. In 21st International Conference on Applications of Natural Language to Information Systems, NLDB, pages 421-426. Springer, 2016.
  6. T. Brown, B. Mann, N. Ryder, M. Subbiah, J. D. Kaplan, P. Dhariwal, A. Neelakantan, P. Shyam, G. Sastry, A. Askell, et al. Language models are few-shot learners. Advances in neural information processing systems, 33:1877-1901, 2020.
  7. N. Carlini, F. Tramèr, E. Wallace, M. Jagielski, A. Herbert-Voss, K. Lee, A. Roberts, T. Brown, D. Song, Ú. Erlingsson, A. Oprea, and C. Raffel. Extracting training data from large language models. In 30th USENIX Security Symposium (USENIX Security 21), pages 2633-2650. USENIX Association, Aug. 2021. ISBN 978-1-939133-24-3. URL https://www.usenix.org/ conference/usenixsecurity21/presentation/carlini-extracting.
  8. S. Chakraborty, A. S. Bedi, S. Zhu, B. An, D. Manocha, and F. Huang. On the possibilities of ai-generated text detection. arXiv preprint arXiv:2304.04736, 2023. · arXiv
  9. M. Connor and D. Roth. Context sensitive paraphrasing with a global unsupervised classifier. In European Conference on Machine Learning, pages 104-115. Springer, 2007.
  10. Y. Deng, A. Bakhtin, M. Ott, A. Szlam, and M. Ranzato. Residual energy-based models for text generation. In International Conference on Learning Representations, 2020.
  11. T. Dopierre, C. Gravier, and W. Logerais. PROTAUGMENT: Unsupervised diverse short-texts paraphrasing for intent detection meta-learning. In Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing (Volume 1: Long Papers), pages 2454-2466, Online, Aug. 2021. Association for Computational Linguistics. doi: 10.18653/v1/2021.acl-long.191. URL https://aclanthology.org/2021.acl-long.191. · DOI
  12. A. Fan, Y. Jernite, E. Perez, D. Grangier, J. Weston, and M. Auli. Eli5: Long form question answering. In Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics, pages 3558-3567, 2019.
  13. S. Garg, S. Prabhu, H. Misra, and G. Srinivasaraghavan. Unsupervised contextual paraphrase generation using lexical control and reinforcement learning. arXiv preprint arXiv:2103.12777, 2021. · arXiv
  14. D. Gomes, M. Costa, D. Cruz, J. Miranda, and S. Fontes. Creating a billion-scale searchable web archive. In Proceedings of the 22nd International Conference on World Wide Web, pages 1059-1066, 2013.
  15. T. Goyal and G. Durrett. Neural syntactic preordering for controlled paraphrase generation. Pro- ceedings of the Association for Computational Linguistics, 2020. URL https://arxiv.org/ abs/2005.02013. · arXiv
  16. E. Grechnikov, G. Gusev, A. Kustarev, and A. Raigorodsky. Detection of artificial texts. RCDL2009 Proceedings. Petrozavodsk, pages 306-308, 2009.
  17. A. Grinbaum and L. Adomaitis. The ethical need for watermarks in machine-generated language. arXiv preprint arXiv:2209.03118, 2022. · arXiv
  18. A. Holtzman, J. Buys, L. Du, M. Forbes, and Y. Choi. The curious case of neural text degeneration. In Proceedings of the International Conference on Learning Representations, 2020. URL https: //openreview.net/forum?id=rygGQyrFvH.
  19. J. House. Text and context in translation. Journal of pragmatics, 38(3):338-358, 2006.
  20. J. E. Hu, R. Rudinger, M. Post, and B. Van Durme. Parabank: Monolingual bitext generation and sentential paraphrasing via lexically-constrained neural machine translation. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 33, pages 6521-6528, 2019.
  21. K.-H. Huang and K.-W. Chang. Generating syntactically controlled paraphrases without using annotated parallel pairs. In Proceedings of the 16th Conference of the European Chapter of the Association for Computational Linguistics: Main Volume, pages 1022-1033, Online, Apr. 2021. Association for Computational Linguistics. doi: 10.18653/v1/2021.eacl-main.88. URL https://aclanthology.org/2021.eacl-main.88. D. Ippolito, D. Duckworth, C. Callison-Burch, and D. Eck. Automatic detection of generated text is easiest when humans are fooled. In Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, pages 1808-1822, July 2020. doi: 10.18653/v1/2020.acl-main.164. URL https://aclanthology.org/2020.acl-main.164. · DOI
  22. S. Jean, S. Lauly, O. Firat, and K. Cho. Does neural machine translation benefit from larger context? arXiv preprint arXiv:1704.05135, 2017. · arXiv
  23. S. Jean, A. Bapna, and O. Firat. Fill in the blanks: Imputing missing sentences for larger-context neural machine translation. arXiv preprint arXiv:1910.14075, 2019. · arXiv
  24. J. Johnson, M. Douze, and H. Jégou. Billion-scale similarity search with gpus. IEEE Transactions on Big Data, 7(3):535-547, 2019.
  25. M. Junczys-Dowmunt. Microsoft translator at WMT 2019: Towards large-scale document-level neural machine translation. In Proceedings of the Fourth Conference on Machine Translation (Volume 2: Shared Task Papers, Day 1), pages 225-233, Florence, Italy, Aug. 2019. Association for Computational Linguistics. doi: 10.18653/v1/W19-5321. URL https://aclanthology. org/W19-5321. · DOI
  26. V. Karpukhin, B. Oguz, S. Min, P. Lewis, L. Wu, S. Edunov, D. Chen, and W.-t. Yih. Dense passage retrieval for open-domain question answering. In Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP), pages 6769-6781, 2020.
  27. O. Khattab and M. Zaharia. Colbert: Efficient and effective passage search via contextualized late interaction over bert. In Proceedings of the 43rd International ACM SIGIR conference on research and development in Information Retrieval, pages 39-48, 2020.
  28. J. Kirchenbauer, J. Geiping, Y. Wen, J. Katz, I. Miers, and T. Goldstein. A watermark for large language models. arXiv preprint arXiv:2301.10226, 2023a. · arXiv
  29. J. Kirchenbauer, J. Geiping, Y. Wen, M. Shu, K. Saifullah, K. Kong, K. Fernando, A. Saha, M. Gold- blum, and T. Goldstein. On the reliability of watermarks for large language models. arXiv preprint arXiv:2306.04634, 2023b. · arXiv
  30. R. Koike, M. Kaneko, and N. Okazaki. Outfox: Llm-generated essay detection through in-context learning with adversarially generated examples. arXiv preprint arXiv:2307.11729, 2023. · arXiv
  31. K. Krishna, J. Wieting, and M. Iyyer. Reformulating unsupervised style transfer as paraphrase generation. In Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP), pages 737-762, 2020.
  32. K. Krishna, Y. Chang, J. Wieting, and M. Iyyer. RankGen: Improving text generation with large ranking models. arXiv preprint arXiv:2205.09726, 2022a. · arXiv
  33. K. Krishna, D. Nathani, X. Garcia, B. Samanta, and P. Talukdar. Few-shot controllable style transfer for low-resource multilingual settings. In Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 7439-7468, 2022b.
  34. S. Kuang, D. Xiong, W. Luo, and G. Zhou. Modeling coherence for neural machine transla- tion with dynamic and topic caches. In Proceedings of the 27th International Conference on Computational Linguistics. Association for Computational Linguistics, Aug. 2018. URL https://aclanthology.org/C18-1050.
  35. A. Kumar, K. Ahuja, R. Vadapalli, and P. Talukdar. Syntax-guided controlled generation of para- phrases. Transactions of the Association for Computational Linguistics, 2020.
  36. T. Kumarage, P. Sheth, R. Moraffah, J. Garland, and H. Liu. How reliable are ai-generated-text detectors? an assessment framework using evasive soft prompts. arXiv preprint arXiv:2310.05095, 2023. · arXiv
  37. V. Lakshman, C. H. Teo, X. Chu, P. Nigam, A. Patni, P. Maknikar, and S. Vishwanathan. Embracing structure in data for billion-scale semantic product search. arXiv preprint arXiv:2110.06125, 2021. · arXiv
  38. M. Lewis, M. Ghazvininejad, G. Ghosh, A. Aghajanyan, S. Wang, and L. Zettlemoyer. Pre-training via paraphrasing. Advances in Neural Information Processing Systems, 33:18470-18481, 2020.
  39. N. Lu, S. Liu, R. He, and K. Tang. Large language models can be guided to evade ai-generated text detection. arXiv preprint arXiv:2305.10847, 2023. · arXiv
  40. S. Maruf, F. Saleh, and G. Haffari. A survey on document-level neural machine translation: Methods and evaluation. ACM Computing Surveys (CSUR), 54(2):1-36, 2021.
  41. A. Max. Sub-sentencial paraphrasing by contextual pivot translation. In Proceedings of the 2009 Workshop on Applied Textual Inference (TextInfer), pages 18-26, 2009.
  42. H. M. Meral, B. Sankur, A. S. Özsoy, T. Güngör, and E. Sevinç. Natural language watermarking via morphosyntactic alterations. Computer Speech & Language, 23(1):107-125, 2009.
  43. S. Merity, C. Xiong, J. Bradbury, and R. Socher. Pointer sentinel mixture models. In International Conference on Learning Representations, 2017.
  44. E. Mitchell, Y. Lee, A. Khazatsky, C. D. Manning, and C. Finn. Detectgpt: Zero-shot machine- generated text detection using probability curvature. arXiv preprint arXiv:2301.11305, 2023. · arXiv
  45. S. B. Needleman and C. D. Wunsch. A general method applicable to the search for similarities in the amino acid sequence of two proteins. Journal of molecular biology, 48(3):443-453, 1970.
  46. L. Ouyang, J. Wu, X. Jiang, D. Almeida, C. L. Wainwright, P. Mishkin, C. Zhang, S. Agarwal, K. Slama, A. Ray, et al. Training language models to follow instructions with human feedback. arXiv preprint arXiv:2203.02155, 2022. · arXiv
  47. V. Patil, P. Hase, and M. Bansal. Can sensitive information be deleted from llms? objectives for defending against extraction attacks. arXiv preprint arXiv:2309.17410, 2023. · arXiv
  48. A. Popescu-Belis, S. Loáiciga, C. Hardmeier, and D. Xiong, editors. Proceedings of the Fourth Work- shop on Discourse in Machine Translation (DiscoMT 2019), Hong Kong, China, Nov. 2019. Asso- ciation for Computational Linguistics. URL https://aclanthology.org/D19-6500.
  49. A. Radford, J. Wu, R. Child, D. Luan, D. Amodei, and I. Sutskever. Language models are unsu- pervised multitask learners. OpenAI Blog, 1(8), 2019. URL https://openai.com/blog/ better-language-models/.
  50. C. Raffel, N. Shazeer, A. Roberts, K. Lee, S. Narang, M. Matena, Y. Zhou, W. Li, and P. J. Liu. Exploring the limits of transfer learning with a unified text-to-text transformer. Journal of Machine Learning Research, 21:1-67, 2020.
  51. A. Roberts, H. W. Chung, A. Levskaya, G. Mishra, J. Bradbury, D. Andor, S. Narang, B. Lester, C. Gaffney, A. Mohiuddin, et al. Scaling up models and data with T5X and seqio. arXiv preprint arXiv:2203.17189, 2022. · arXiv
  52. A. Roy and D. Grangier. Unsupervised paraphrasing without translation. In Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics, pages 6033-6039, Florence, Italy, July 2019. Association for Computational Linguistics. doi: 10.18653/v1/P19-1605. URL https://aclanthology.org/P19-1605. · DOI
  53. V. S. Sadasivan, A. Kumar, S. Balasubramanian, W. Wang, and S. Feizi. Can ai-generated text be reliably detected? arXiv preprint arXiv:2303.11156, 2023. · arXiv
  54. R. Shokri, M. Stronati, C. Song, and V. Shmatikov. Membership inference attacks against machine learning models. In 2017 IEEE symposium on security and privacy (SP), pages 3-18. IEEE, 2017.
  55. N. Thakur, N. Reimers, A. Rücklé, A. Srivastava, and I. Gurevych. Beir: A heterogenous benchmark for zero-shot evaluation of information retrieval models. arXiv preprint arXiv:2104.08663, 2021. · arXiv
  56. B. Thompson and M. Post. Paraphrase generation as zero-shot multilingual translation: Disentangling semantic similarity from lexical and syntactic diversity. In Proceedings of the Fifth Conference on Machine Translation, pages 561-570, Online, Nov. 2020. Association for Computational Linguistics. URL https://aclanthology.org/2020.wmt-1.
  57. M. Topkara, C. M. Taskiran, and E. J. Delp III. Natural language watermarking. In Security, Steganography, and Watermarking of Multimedia Contents VII, volume 5681, pages 441-452, 2005.
  58. H. Touvron, T. Lavril, G. Izacard, X. Martinet, M.-A. Lachaux, T. Lacroix, B. Rozière, N. Goyal, E. Hambro, F. Azhar, et al. Llama: Open and efficient foundation language models. arXiv preprint arXiv:2302.13971, 2023. · arXiv
  59. A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, Ł. Kaiser, and I. Polosukhin. Attention is all you need. In Proceedings of Advances in Neural Information Processing Systems, pages 5998-6008, 2017. URL http://papers.nips.cc/paper/ 7181-attention-is-all-you-need.pdf.
  60. J. Wieting, K. Gimpel, G. Neubig, and T. Berg-kirkpatrick. Paraphrastic representations at scale. In Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing: Sys- tem Demonstrations, pages 379-388, Abu Dhabi, UAE, Dec. 2022. Association for Computational Linguistics. URL https://aclanthology.org/2022.emnlp-demos.
  61. X. Xie, X. Lu, and B. Chen. Multi-task learning for paraphrase generation with keyword and part- of-speech reconstruction. In Findings of the Association for Computational Linguistics: ACL 2022, pages 1234-1243, Dublin, Ireland, May 2022. Association for Computational Linguis- tics. doi: 10.18653/v1/2022.findings-acl.97. URL https://aclanthology.org/2022. findings-acl. · DOI
  62. H. Xiong, Z. He, H. Wu, and H. Wang. Modeling coherence for discourse neural machine translation. In Proceedings of the AAAI conference on artificial intelligence, volume 33, pages 7338-7345, 2019.
  63. W. Xu, C. Callison-Burch, and C. Napoles. Problems in current text simplification research: New data can help. Transactions of the Association for Computational Linguistics, 3:283-297, 2015.
  64. K. Yang, D. Liu, W. Lei, B. Yang, H. Zhang, X. Zhao, W. Yao, and B. Chen. Gcpg: A general frame- work for controllable paraphrase generation. In Findings of the Association for Computational Linguistics: ACL 2022, pages 4035-4047, 2022.
  65. K. Yin, P. Fernandes, A. F. Martins, and G. Neubig. When does translation require context? a data-driven, multilingual exploration. arXiv preprint arXiv:2109.07446, 2021. · arXiv
  66. K. Yoo, W. Ahn, and N. Kwak. Advancing beyond identification: Multi-bit watermark for language models. arXiv preprint arXiv:2308.00221, 2023. · arXiv
  67. R. Zellers, A. Holtzman, H. Rashkin, Y. Bisk, A. Farhadi, F. Roesner, and Y. Choi. Defending against neural fake news. Advances in neural information processing systems, 32, 2019.
  68. S. Zhang, S. Roller, N. Goyal, M. Artetxe, M. Chen, S. Chen, C. Dewan, M. Diab, X. Li, X. V. Lin, et al. Opt: Open pre-trained transformer language models. arXiv preprint arXiv:2205.01068, 2022. · arXiv
  69. X. Zhao, P. Ananth, L. Li, and Y.-X. Wang. Provable robust watermarking for ai-generated text. arXiv preprint arXiv:2306.17439, 2023. · arXiv

Cited by

Sorted by citations

Related

Authors
Krishna, K., Song, Y., Karpinska, M., Wieting, J., & Iyyer, M.
ORCID
Venue
Advances in Neural Information Processing Systems 36
Publisher
Neural Information Processing Systems Foundation, Inc. (NeurIPS)
Published
2023
Pages
27469-27500
ISSN
1049-5258 (ISSN-L)
DOI
10.52202/075280-1195
OpenAlex
W7133209433
Cited by
150
References
0
Citations by year
2026: 55 · 2025: 33 · 2024: 36 · 2023: 25 · 2021: 1
FWCI
26.40
Type
conference paper
Language
en
Open access
Locations
  • neural information processing systems (publishedVersion)
  • arXiv (Cornell University) (submittedVersion)
  • arXiv (Cornell University)
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Authorship Attribution and Profiling
  • Physical Sciences › Computer Science › Information Systems › Spam and Phishing Detection
  • Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Digital Media Forensic Detection
Keywords
paraphrase, AI-generated text detection, text retrieval, large language models

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review