DGRM: Why AI Text Detectors Collapse When Text Gets Paraphrased

The benchmark number that hides the real story

Every paper about detecting AI generated text eventually reports an accuracy number, and this one is no exception. The abstract says the proposed method, DGRM, boosts detection performance by up to 10.5 percent on datasets with different content and up to 22.7 percent on datasets with altered syntax. Read quickly, that sounds like a modest, believable improvement, the kind distillation and adaptation papers report all the time. What it does not convey is how bad the starting point actually is, or how unevenly that starting point varies by task.

Look past the summary and into Table VI, where the authors test how their method holds up with limited training data, a realistic constraint for anyone building a detector for a new content type. At a full training budget, a plain supervised detector called Vanilla BCE scores 0.9865 AUROC identifying AI generated fake news articles built from the XSUM dataset in their original form. Paraphrase those same articles once with GPT-3.5-Turbo, using nothing more elaborate than an instruction to sound more natural, and the score collapses to 0.6529. Shrink the training set to ten percent of its original size, a plausible scenario for a smaller newsroom or platform building its own detector, and the paraphrased score falls to 0.1369. An AUROC under 0.5 means the detector is doing worse than a coin flip. This one is doing worse than that by a wide margin, which suggests it is not merely uncertain, it is confidently pointing the wrong direction on paraphrased fake news once its training data runs thin.

DGRM, added on top of that same weak baseline and given the identical ten percent of training data, reaches 0.9729 on the paraphrased set. That is the actual headline this paper buried, a fix for a failure mode severe enough that the unmodified baseline is actively misleading rather than simply weak.

Why a detector trained on one domain falls apart on another

To understand why this happens, it helps to know how machine generated text detection normally works. Some methods need no labeled training data at all. GLTR looks at how predictable each token is under a language model and visualizes that as a signal a human reviewer can eyeball. DetectGPT goes further, comparing the log probability of a passage of text against the log probabilities of slightly perturbed versions of it, on the theory that AI generated text sits in a sharper probability peak than human writing. Watermarking methods take a different route entirely, quietly biasing a language model toward certain vocabulary choices during generation so a downstream detector can look for that statistical fingerprint later. All three of these approaches share a weakness, they assume some access to the generating model’s internal probabilities or its generation process, which is often unavailable when the text in question comes from an unknown or proprietary system.

That is why supervised detectors, trained directly on labeled examples of human and machine generated text, have become the practical default. RADAR trains an adversarial paraphraser alongside the detector so the detector learns to withstand paraphrase attacks during training itself. CoCo builds a coherence graph over a text’s entities to capture structural patterns specific to how machine generated passages hang together. SCRN adds Gaussian noise to a text’s representation and then learns to remove it, treating detection as a denoising problem. Each of these approaches adds a clever new feature or training signal, and each one improves results on the benchmark it was designed around.

The catch, and the paper is candid about this, is that supervised detectors trained this way tend to memorize the particular topics, prompts, and sentence structures present in their training corpus rather than learning what genuinely separates human writing from machine writing in general. A detector trained on long form question answering learns to recognize long form question answering, not machine generated text as a category. Feed it a fabricated news article or an academic abstract from a completely different distribution and its accuracy can quietly fall apart, exactly the pattern shown in the introduction’s own Figure 1, where in dataset accuracy sits near the top of the chart and cross dataset accuracy sits meaningfully lower across nearly every baseline tested.

Two different ways a text can be unfamiliar

The paper’s contribution starts with a distinction that turns out to matter a great deal in practice. It separates domain generalization into two kinds. Semantic domain generalization is about content, whether a detector trained on Reddit question answers can still work on fabricated news articles or scientific abstracts it has never seen a single example of. Syntactic domain generalization is about structure, whether a detector still works once the same content gets reworded, reordered, or paraphrased while its underlying meaning stays intact. A detector can be strong on one axis and weak on the other, and the paper argues that most prior work only really addresses the first.

That distinction sets up the method’s core design choice. Rather than trying to build one representation that handles both kinds of unfamiliarity at once, DGRM deliberately splits a text’s internal representation into two separate pieces, one aimed at capturing task relevant syntactic signal and one aimed at capturing general contextual content, and then treats each piece with a different training objective suited to the kind of generalization it is responsible for.

How DGRM is actually built

DGRM is not a standalone detector. It is an add on module meant to sit on top of an existing supervised detector, taking whatever hidden representation that detector already produces for a piece of text and processing it further before the final prediction. The paper structures the training in two stages, feature disentanglement followed by feature regularization.

Feature disentanglement

Given a text embedding produced by the underlying detector, two small networks map it into two separate spaces, a target specific attribute space and a common attribute space. The common space is trained with a self supervised contrastive objective borrowed from sentence embedding research, specifically the approach behind SimCSE, where parts of a sentence are masked and restored using a pretrained RoBERTa model, and the resulting embedding is pulled close to the original sentence’s embedding while being pushed away from other sentences in the batch. This teaches the common space to capture general contextual meaning rather than anything specific to the detection task.

The target specific space, by contrast, is trained directly on the detection labels through an auxiliary classifier, so it learns whatever syntactic pattern differences actually separate human and machine writing in the training data. A contrastive independence loss is layered on top of both spaces, explicitly pulling embeddings from the same space closer together while pushing embeddings from different spaces apart, so the two representations do not collapse into redundant copies of each other.

Feature regularization

Splitting the representation is only half the design. The common attribute space, on its own, is not yet useful for the final prediction, and using only the target specific space risks throwing away real contextual signal. So a recalibration network takes the common attribute, mixes it with a randomly shuffled example from the same batch using the MixUp technique, and learns to extract whatever additional task relevant information remains inside it. The recalibrated common attribute is then added to the target specific attribute for the final prediction.

Separately, to build resilience against paraphrasing specifically, DGRM computes the difference between a text’s target specific representation and the same representation after the text has been perturbed by the same masking process used earlier, then feeds that residual through a classifier behind a gradient reversal layer. The gradient reversal step trains the underlying representation to make that residual uninformative for prediction, which in effect teaches the model that superficial rewording should not change its answer.

At inference time, the final prediction simply sums the target specific attribute and the recalibrated common attribute and passes that combined vector to the classifier. None of this requires touching the underlying language model that generated the suspect text, and none of it requires access to an unlabeled sample of the target domain during training, an assumption the paper points out that most traditional domain adaptation methods quietly rely on and that does not hold in real deployment, since you rarely know in advance what kind of text a detector will be asked to judge next.

“Detecting human written text becomes more challenging due to its diversity.” From the paper’s qualitative analysis of cross dataset detection, Section V.B

Reading the numbers that matter most

The three benchmark datasets in this paper are deliberately varied. LFQA covers long, conversational answers to Reddit questions across six topics. OED asks a model to extend a WikiText passage by two sentences. XSUM prompts a model to fabricate a full news article from a short seed of real news text, the closest analog in the paper to a genuine misinformation scenario. That last dataset is where the paraphrase vulnerability concentrates most sharply, and the training data size experiment in Table VI makes the pattern impossible to miss.

Notice the shape of that middle row. At twenty five percent of the training data, DGRM still only reaches 0.5397 AUROC on paraphrased XSUM text, barely above chance itself, even though it clearly beats the baseline’s 0.4383. This is not a method that magically fixes every low data scenario. It is a method that meaningfully improves a genuinely broken baseline, and the improvement itself is uneven across data budgets in a way the abstract’s single headline percentage does not capture.

Across the paper’s main cross dataset evaluation, using five different generator models including GPT-2, GPT-3, OPT-1.3b, Llama2-7b, and ChatGPT, the average improvement over baseline detectors is reported at 3.2 percent on original GPT-2 text and 19.2 percent on paraphrased GPT-2 text, with GPT-3 showing 4.5 percent and 11.5 percent respectively. The pattern holds across nearly every backbone tested, gains on original text are modest, gains on paraphrased text are substantial, which is consistent with the paper’s framing that the real contribution here is syntactic robustness rather than raw accuracy.

What the ablation study says is actually doing the work

A method built from several moving parts invites an obvious question, which piece matters. The paper’s Table IV answers this directly by removing one component at a time and rerunning the GPT-3 experiments. The independence loss stands out. Remove it, and paraphrased XSUM accuracy falls from 0.9547 down to 0.7897, a drop of roughly seventeen points, while original text accuracy barely moves. Collapse the two attribute spaces into one embedding entirely, discarding the disentanglement idea altogether while keeping every other loss term, and paraphrased XSUM accuracy falls further still, down to 0.6972, close to where the unmodified baseline started.

That is a meaningful finding on its own. The paraphrase robustness this paper is built around does not come primarily from the recalibration network, the MixUp augmentation, or even the explicit perturbation invariance loss, each of which the ablation shows contributes a smaller amount individually. It comes overwhelmingly from forcing the model to maintain two genuinely separate representations in the first place. Everything downstream, the recalibration and the perturbation invariance training, appears to depend on that separation existing before it can do useful work.

A bias check that goes beyond the headline task

The paper also tests something outside the core misinformation framing, whether detectors trained mainly on native English text unfairly flag writing by non native English speakers as machine generated, an issue raised in prior work by Liang and colleagues in 2023. Using a dataset the authors compiled themselves from non native English submissions to ICLR OpenReview, spanning both European and Asian countries, they find that a baseline detector trained on native English data performs worse when tested on this non native writing, and that DGRM’s disentanglement approach measurably narrows that gap at both the continent and country level. This is a smaller experiment than the main results, but it is a genuinely useful one, since a fairness failure like this could cause real harm to non native academic authors or students if a detector like this were deployed in an educational setting without this kind of check.

Where this result is thinner than it looks

A few things temper how far to extend these findings. The training datasets used throughout are small by modern standards, between two thousand and three thousand samples, which the authors present as evidence the method works even with limited data, but it also means every reported number carries more sampling noise than a much larger benchmark would. The paraphrasing attack tested here is a single, fairly mild instruction to GPT-3.5-Turbo to sound more natural, not an adversarial or iterated paraphrase attack designed specifically to evade this detector, so real world attackers motivated to evade detection could plausibly do meaningfully worse damage than this evaluation captures. The method also assumes access to a pretrained RoBERTa encoder and to text embeddings generally, so it inherits any weaknesses in that base representation rather than solving them. Finally, this is a single research group’s evaluation. Independent replication on a broader range of generator models and detector architectures beyond the ones tested here would strengthen confidence in how general the independence loss finding really is.

The proposed model in PyTorch

Below is a condensed but complete implementation of DGRM’s core training step, following the paper’s formulation. It stands a simple linear encoder in for the pretrained RoBERTa backbone, since the paper’s actual contribution sits entirely in what happens after the encoder produces its embedding.

import torch
import torch.nn as nn
import torch.nn.functional as F

# --- Gradient reversal layer, used for the perturbation invariance loss ---
class GradReverseFn(torch.autograd.Function):
    @staticmethod
    def forward(ctx, x, eta):
        ctx.eta = eta
        return x.view_as(x)

    @staticmethod
    def backward(ctx, grad_output):
        return -ctx.eta * grad_output, None

def grad_reverse(x, eta=1.0):
    return GradReverseFn.apply(x, eta)

class DGRM(nn.Module):
    def __init__(self, embed_dim=64, attr_dim=32):
        super().__init__()
        self.s_common = nn.Sequential(nn.Linear(embed_dim, attr_dim), nn.ReLU())
        self.s_target = nn.Sequential(nn.Linear(embed_dim, attr_dim), nn.ReLU())
        self.f_con = nn.Sequential(nn.Linear(attr_dim, attr_dim), nn.ReLU(), nn.Linear(attr_dim, attr_dim))
        self.f_tar = nn.Linear(attr_dim, 1)
        self.recalib_net = nn.Sequential(nn.Linear(attr_dim, attr_dim), nn.ReLU())
        self.f_cls = nn.Linear(attr_dim, 1)

    def disentangle(self, h):
        h_c = self.s_common(h)
        h_t = self.s_target(h)
        return h_c, h_t

    def contrastive_loss(self, z1, z2, temperature=0.1):
        # SimCSE style in batch contrastive loss between two views of the same batch
        z1 = F.normalize(z1, dim=-1)
        z2 = F.normalize(z2, dim=-1)
        logits = z1 @ z2.t() / temperature
        labels = torch.arange(z1.size(0), device=z1.device)
        return F.cross_entropy(logits, labels)

    def independence_loss(self, h_c, h_t):
        # push common and target embeddings of the same sample apart
        h_c_n = F.normalize(h_c, dim=-1)
        h_t_n = F.normalize(h_t, dim=-1)
        cross_sim = (h_c_n * h_t_n).sum(dim=-1)
        return cross_sim.pow(2).mean()

    def recalibrate(self, h_c, alpha=0.2):
        perm = torch.randperm(h_c.size(0), device=h_c.device)
        h_c_shuffled = h_c[perm]
        lam = torch.distributions.Beta(alpha, alpha).sample((h_c.size(0), 1)).to(h_c.device)
        lam = torch.max(lam, 1 - lam)
        mixed = lam * h_c + (1 - lam) * h_c_shuffled
        return self.recalib_net(mixed)

    def forward(self, h, h_perturbed, y, machine_mask, alpha_mix=0.2, eta=1.0, lam1=0.3, lam2=0.3):
        h_c, h_t = self.disentangle(h)
        _, h_t_pert = self.disentangle(h_perturbed)

        # --- feature disentanglement losses ---
        h_c_pert, _ = self.disentangle(h_perturbed)
        l_con = self.contrastive_loss(self.f_con(h_c), self.f_con(h_c_pert))
        l_tar = F.binary_cross_entropy_with_logits(self.f_tar(h_t).squeeze(-1), y)
        l_ind = self.independence_loss(h_c, h_t)
        l_dis = l_tar + l_con + lam1 * l_ind

        # --- feature regularization losses ---
        h_c_recal = self.recalibrate(h_c, alpha_mix)
        h_t_combined = h_t + h_c_recal
        l_rec = F.binary_cross_entropy_with_logits(self.f_cls(h_t_combined).squeeze(-1), y)

        h_r = h_t_pert - h_t
        h_r_rev = grad_reverse(h_r, eta)
        if machine_mask.sum() > 0:
            l_per = F.binary_cross_entropy_with_logits(
                self.f_cls(h_r_rev)[machine_mask].squeeze(-1), y[machine_mask]
            )
        else:
            l_per = torch.tensor(0.0, device=h.device)
        l_reg = l_rec + lam2 * l_per

        l_total = l_dis + l_reg
        return l_total, h_t_combined

# --- Smoke test on dummy data, standing in for RoBERTa sentence embeddings ---
if __name__ == "__main__":
    torch.manual_seed(0)
    batch_size = 16
    embed_dim = 64

    model = DGRM(embed_dim=embed_dim, attr_dim=32)
    optimizer = torch.optim.AdamW(model.parameters(), lr=1e-3)

    h = torch.randn(batch_size, embed_dim)
    h_perturbed = h + 0.05 * torch.randn_like(h)  # stand in for a masked and restored version
    y = torch.randint(0, 2, (batch_size,)).float()
    machine_mask = y.bool()

    losses = []
    for step in range(100):
        loss, _ = model(h, h_perturbed, y, machine_mask)
        optimizer.zero_grad()
        loss.backward()
        optimizer.step()
        losses.append(loss.item())

    assert losses[-1] < losses[0], "loss did not decrease, smoke test failed"
    print(f"Smoke test passed. Loss went from {losses[0]:.4f} to {losses[-1]:.4f}")

The gradient reversal layer is the piece most likely to trip someone up on a first implementation. Its forward pass does nothing but copy the input through unchanged. Its entire purpose lives in the backward pass, where it flips the sign of the incoming gradient, which is what trains the upstream representation to make the perturbation residual uninformative rather than informative.

Conclusion

DGRM’s real contribution is less about the headline ten and twenty two percent improvement figures and more about what those figures were covering up. A supervised detector that looks nearly flawless in its own training domain can, once training data is realistically limited and the text has been lightly paraphrased, perform worse than random guessing on exactly the use case that matters most, catching fabricated news. That is a finding worth taking seriously on its own, independent of whether DGRM turns out to be the best possible fix for it.

The fix the paper proposes is architecturally modest, an add on module rather than a new detector built from scratch, which is part of what makes it practical. Teams already running a supervised detector in production do not need to replace it, they can bolt this module on top and retrain. The ablation study’s finding that the independence loss between a task specific and a general contextual representation carries most of the benefit is a useful simplification for anyone trying to reproduce a lighter version of this idea rather than the full four component pipeline.

Whether this generalizes past the three datasets and five generator models tested here is genuinely open. Every generator tested is a general purpose language model, not one specifically fine tuned to evade detection, and every paraphrase attack tested is a single mild pass through GPT-3.5-Turbo rather than a determined adversary iterating against the detector itself. A more adversarial evaluation, where an attacker has access to the detector and optimizes specifically to fool it, would be a meaningfully harder test than anything shown here, and it is the test that matters most for anyone deploying this kind of system against people actively trying to spread misinformation.

The honest limitations, a small training corpus, a single mild paraphrase attack, and reliance on a single pretrained encoder, do not erase the value of the central finding. They do mean this should be read as a strong first step rather than a solved problem, particularly for teams whose training data will be smaller and whose adversaries will be more motivated than what this paper’s evaluation captures.

For anyone currently building or maintaining a machine generated text detector, the actionable takeaway is straightforward. Do not trust an in domain accuracy number as a stand in for real world reliability, and specifically test paraphrase robustness on the smallest training budget you are realistically going to deploy with, not just the largest one you happened to benchmark against. If that number looks anything like 0.1369, the fix is not a bigger model. It is exactly the kind of representation splitting this paper describes.

Frequently asked questions

Related reading