Online users often release multiple texts under the same identity, giving attackers an author profile that can reveal more than any single text. Existing authorship obfuscation methods optimize privacy independently for each document, leaving them blind to cross-document correlations that make aggregation dangerous. We propose Aggregation-Aware Synthetic Text Generation (AAST), a framework that addresses this gap by jointly selecting synthetic texts at the bundle level rather than optimizing each text in isolation. AAST targets attribution and verification attacks, including cross-genre settings where attacker references come from a genre not observed during generation or selection. Experiments across same-genre, cross-genre, neural, and independent non-neural stylometric attacks show that AAST lowers account-level linkability as bundle size grows, while preserving semantic quality, linguistic acceptability, and sentiment alignment.
Figures & tables
Figure 1: Overview of the AAST pipeline for aggregation-aware synthetic text generation.
Figure 2: Attribution risk, verification risk, NLI, and CoLA across bundle sizes on Reddit. In (c), each synthetic output is evaluated against its corresponding private text, so the private text serves as the reference and is not plotted.
Figure 3: Verification results under a stylometric transfer attack on Reddit and Blog.
Figure 4: Attribution risk, verification risk, NLI, and CoLA across bundle sizes on Blog. In (c), each synthetic output is evaluated against its corresponding private text, so the private text serves as the reference and is not plotted.
Computes semantic similarity between the private text and abstraction candidates.
Generator (§ 3.5 )
Mistral-Small mistralai2025mistralsmall32 and Phi-4 DBLP:journals/corr/abs-2412-08905
Generates synthetic candidate rewrites from selected abstractions.
Style embedding model (§ 3.6 )
intfloat/e5-base-v2 wang2022text
Filters candidates that remain too close to the private input in stylistic space.
Episode encoder model (§ 3.7.1 )
Luar-mud rivera2021learning
Computes bundle embeddings for partner and crowd similarity scoring.
Appendix
Table 2: Models and fixed implementation settings for AAST. These values are held constant across all experiments.
Figure 7
K
Method
Reddit
Blog
MRR ( ↓ )
R@8 ( ↓ )
MRR ( ↓ )
R@8 ( ↓ )
1
Private
32.2
45.6
38.5
52.4
AAST Φ
2.4
3.6
1.7
2.0
AAST M
2.2
2.9
2.6
2.4
JAMDEC
4.5
8.4
7.4
12.8
KiP
9.4
17.6
8.2
12.8
Appendix
Table 3: Attribution risk results on Reddit and Blog across bundle sizes.
K
Method
Reddit
Blog
AUC ( ≈ 50)
c@1 ( ↓ )
AUC ( ≈ 50)
c@1 ( ↓ )
1
Private
51.9
52.9
64.6
60.6
AAST Φ
50.6
51.7
48.3
48.6
AAST M
48.9
44.6
47.6
49.3
JAMDEC
51.2
52.0
60.8
53.4
KiP
51.3
52.6
63.2
57.7
Appendix
Table 4: Verification risk results on Reddit and Blog across bundle sizes.
K
Method
Reddit
Blog
MRR ( ↓ )
R@8 ( ↓ )
MRR ( ↓ )
R@8 ( ↓ )
1
Private
17.5 [14.1, 20.9]
28.0 [23.6, 32.8]
14.2 [11.2, 17.4]
25.6 [21.2, 30.4]
AAST Φ
3.9 [2.6, 5.4]
6.4 [4.6, 8.6]
3.4 [2.2, 4.8]
3.6 [2.4, 5.2]
AAST M
5.3 [3.8, 6.8]
8.9 [6.6, 11.6]
2.4 [1.6, 3.4]
3.6 [2.4, 5.0]
JAMDEC
4.2 [2.8, 6.0]
5.6 [3.8, 7.8]
7.9 [5.8, 10.4]
16.0 [12.6, 19.8]
KiP
7.8 [5.6, 10.2]
11.6 [8.6, 14.8]
5.1 [3.6, 6.8]
8.8 [6.4, 11.6]
Appendix
Table 5: Same-genre attribution results on Reddit and Blog under an independent classical n-gram stylometric attacker. The attributor uses character 2–5-grams, distance-character 1–3-grams, and word 1–3-grams. Values are percentages with 95% bootstrap confidence intervals computed over users.
K
Method
Reddit
Blog
AUC ≈ 50
c@1 ↓
AUC ≈ 50
c@1 ↓
1
Private
54.2 [47.2, 61.0]
50.8 [44.4, 56.8]
60.0 [52.6, 66.7]
51.6 [45.6, 57.6]
AAST M
52.5 [45.5, 59.9]
49.2 [43.0, 55.4]
50.2 [43.2, 57.3]
50.8 [44.8, 56.9]
AAST Φ
49.8 [42.6, 57.5]
49.4 [43.0, 55.4]
50.3 [43.1, 57.9]
49.2 [42.8, 55.2]
JAMDEC
50.5 [43.3, 57.8]
48.4 [42.4, 54.8]
64.0 [57.2, 70.4]
59.2 [52.8, 65.6]
KiP
53.7 [46.2, 61.2]
48.8 [42.0, 54.8]
50.3 [42.8, 57.7]
50.0 [43.6, 56.0]
Appendix
Table 6: Same-genre verification results under a classical stylometric transfer attack on Reddit and Blog. The verifier uses character 3–5-gram term frequency–inverse document frequency features with logistic regression. Values are percentages with 95% bootstrap confidence intervals.
K
Method
Reddit
Blog
NLI ( ↑ )
CoLA ( ↑ )
NLI ( ↑ )
CoLA ( ↑ )
1
AAST Φ
55.1
94.7
55.0
93.6
AAST M
53.4
93.1
51.6
93.4
JAMDEC
20.2
91.4
20.0
90.0
KiP
65.4
63.2
58.1
55.8
2
AAST Φ
57.2
94.9
57.4
93.9
Appendix
Table 7: NLI and CoLA results on Reddit and Blog across bundle sizes.
K
Method
Sentiment Alignment( % ) ( ↑ )
Reddit
Blog
1
AAST Φ
83.0
83.6
AAST M
83.8
87.8
2
AAST Φ
83.7
85.7
AAST M
84.7
87.6
4
AAST Φ
85.3
85.0
Appendix
Table 8: Sentiment alignment results on Reddit and Blog across bundle sizes. Higher sentiment alignment indicates better preservation of private text sentiment.
K
Method
Reddit
Blog
Attribution
Verification
Utility
Attribution
Verification
Utility
R@8 ( ↓ )
MRR ( ↓ )
AUC ( ≈ 50)
c@1 ( ↓ )
NLI ( ↑ )
CoLA ( ↑ )
R@8 ( ↓ )
MRR ( ↓ )
AUC ( ≈ 50)
c@1 ( ↓ )
NLI ( ↑ )
CoLA ( ↑ )
1
Private
45.6
32.2
51.9
52.9
–
–
52.4
38.5
64.6
60.6
–
–
AAST Φ
3.6
2.4
50.6
51.7
55.1
94.7
2.0
1.7
48.3
48.6
55.0
93.6
AAST M
2.9
2.2
48.9
44.6
53.4
93.1
2.4
2.6
47.6
49.3
51.6
93.4
RUPTA Φ
8.4
14.5
51.0
47.9
62.1
85.8
26.4
16.8
59.6
57.6
60.5
84.5
Appendix
Table 9: Comparison with the LLM-based RUPTA baseline on Reddit and Blog across K =1,8,16. Utility is not reported for Private.
@[USER1] @[USER2] @[USER3] @[USER4] @[USER5] @[USER6] Congratulations to all fellow winners
2
#NewProfilePic [URL]
3
@[USER7] No
4
@[USER8] haha
Appendix
Table 12: Masked examples of tweet inputs from one author. Handles and URLs are replaced with placeholders.
K
σ
ϵ = 4
ϵ = 2
ϵ = 1
1
1.02
2.03
4.07
8
1.15
2.31
4.61
16
1.19
2.39
4.78
Appendix
Table 13: Gaussian noise standard deviations σ used for noisy abstraction selection.
Bundle Size K
Total Tokens (×106)
1
0.50
2
1.01
4
2.00
6
3.00
8
3.99
10
4.99
Appendix
Table 14: Token usage of AAST M on Blog across bundle sizes. Counts include both input and output tokens for Mistral generation.
Ablation configuration
K
Attribution
Verification
Utility
R@8 ( ↓ )
MRR ( ↓ )
AUC ( ≈ 50)
c@1 ( ↓ )
NLI ( ↑ )
CoLA ( ↑ )
Identifier Masking(§ 3.3 ) enabled
1
0
1.2
55.6
52.6
18.8
92.5
8
3.3
2.0
55.8
46.4
38.4
92.8
16
13.5
8.2
51.3
46.5
50.6
92.7
Identifier Masking disabled
1
2.9
2.2
48.9
44.6
53.4
93.1
8
28.4
18.4
64.2
48.2
65.7
94.1
Appendix
Table 15: Ablation study of AAST components on Reddit across K=1,8,16 . The first two row groups compare Identifier Masking configurations. The last three row groups disable one component relative to the Identifier Masking enabled configuration. In the reported main experiments, same-genre Reddit and Blog use Identifier Masking disabled, while cross-genre Article–Tweet and Tweet–Article use Identifier Masking enabled. Candidate Preselection, Refinement, and Bundle-Level Selection are enabled in all reported main AAST settings. Bundle-Level Selection consists of Bundle-level Candidate Scoring followed by Candidate Refinement.
Figure 7: Effect of removing bundle-level selection on Reddit and Blog. NoBundleSel Φ keeps the same settings as AAST Φ , but removes Bundle-level Candidate Scoring and Candidate Refinement.
K
Method
Attribution
Verification
NLI and CoLA
Reddit
Blog
Reddit
Blog
Reddit
Blog
MRR ↓
R@8 ↓
MRR ↓
R@8 ↓
AUC ≈ 50
c@1 ↓
AUC ≈ 50
c@1 ↓
NLI ↑
CoLA ↑
NLI ↑
CoLA ↑
1
AAST Φ
2.4
3.6
1.7
2.0
50.6
51.7
48.3
48.6
55.1
94.7
55.0
93.6
NoBundleSel Φ
9.1
14.5
6.5
8.9
53.3
50.0
52.1
49.0
54.0
95.0
53.6
93.8
2
AAST Φ
5.5
7.3
3.2
5.7
57.4
50.3
53.9
47.4
57.2
94.9
57.4
93.9
NoBundleSel Φ
14.4
23.4
10.6
16.3
61.1
53.6
62.6
52.5
55.6
95.1
57.6
94.0
Appendix
Table 16: Results for the effect of removing bundle-level selection on Reddit and Blog. NoBundleSel Φ keeps the same settings as AAST Φ , but removes Bundle-level Candidate Scoring and Candidate Refinement.
Dataset
K
Evaluation
Metric
ϵ=∞
ϵ=4
ϵ=2
ϵ=1
Reddit
1
Attribution
MRR( ↓ )
2.4
3.1
2.7
3.0
R@8( ↓ )
3.6
4.0
2.8
3.2
Verification
AUC( ≈ 50)
50.6
56.0
58.5
54.4
c@1( ↓ )
51.7
50.8
53.4
48.7
Utility
NLI( ↑ )
55.1
53.4
53.7
52.3
CoLA( ↑ )
94.7
94.9
94.9
94.8
Appendix
Table 17: Attribution risk, verification risk, and utility of AAST Φ on Reddit and Blog under different privacy budgets. Results are reported for K=1,8,16 .
Method
Observed Strengths
Observed Weaknesses
Main Pattern
AAST
Reduces aggregation linkability and preserves main events in qualitative examples. Does not require training generator.
May still reduce exact semantic entailment, especially in cross-genre rewriting. Some private topics and events can remain because utility is preserved.
Best privacy–utility balance under aggregation, with bundle-level selection reducing author signals across multiple released texts.
KiP
Often preserves local meaning and many details of private text.
Shows weaker privacy under aggregation. Qualitative examples suggest that outputs can stay close to private wording and structure, and may contain fragmented words or control artifacts. Requires model adaptation through fine tuning.
Strong meaning preservation, but higher authorship carryover and less stable output form.
JAMDEC
Can generate longer synthetic texts and does not require task specific generator fine tuning.
Longer outputs often contain repetitive or weakly grounded content, with substantial semantic drift in qualitative examples. It also has much higher generation time due to over generation and filtering.
Distance from the private text can help privacy, but often at the cost of meaning preservation and computational efficiency.
Appendix
Table 18: Qualitative summary of observed strengths and weaknesses. The table summarizes patterns from the quantitative results and qualitative examples.
Method
Bundle
Text
Private
Query ID:1
My mom just got diagnosed with Parkinson’s this week and we are pretty devastated . She just turned 60 , and I didn’t expect to have to confront major health problems so soon. We don’t know much about this disease and are scared and devastated , to say the least. She asked me to help her find resources so that she can understand her disease better , as she’s not internet-savvy . Can anyone please help me with this? Where can we read more about this disease? Are there any types of support that might be available to her? Anything I need to know about how to support her ?
Query ID:2
Have any of you gone through a grieving process after leaving the church ? I have been a jack Mormon for many years, and just in the past couple of years have I finally fully lost my faith and left completely. I was already living the "worldly" life, so there hasn’t been much to gain since I left, but there has been a lot to lose. I am terrified of death now, I feel much more pessimistic about the future and cynical about life, and sometimes I miss that feeling of being part of a community. To make matters worse, my mom was just diagnosed with a degenerative disease that will probably kill her . I find myself actually wishing that I had some belief system and community support to sustain me through the shock and grief I feel from her diagnosis, but I don’t know that I can ever believe in any religion again. I am grieving for my mom , and grieving for all I feel that I lost when I lost my faith. I feel like I will be crushed under the weight of all of this grief.
Target ID:1
I’m a student taking evening classes and have also been working full time to pay the bills. My job is getting steadily more stressful and demanding , and I’m struggling to mentally cope and to perform my duties. But I took some tuition assistance from my employer to pay for school, and their stipulation is that I have to stay at this job until at least Jan of 2021 or I have to pay back all the money (which I can’t do). I am losing my mind because of how much I hate this job , and I need some advice on how to keep my sanity . What keeps you sane when you’re stuck at a job you hate but can’t afford to leave ?
Target ID:2
I just need to vent . I have a friend who has to come home early from her mission due to mental health issues . I just had dinner with her the other day and was saddened to see how much she’s struggling with feelings of failure from being home, compounded by the incredibly insensitive comments some members have made. It was so hard for me to keep my mouth shut while I was with her, because I was just boiling inside with rage at the church for making young folks feel this way. I had to go home early from my mission also, and although I returned eventually I never fully got over the guilt until I left the church. Missions are emotionally (and sometimes physically) traumatic for many people, and the church does NOT take care of those kids the way it should protect its UNPAID VOLUNTEERS . I could go on and on about everything that is fucked up about the way missions are run .
AAST M
Query ID:1
The news that my mother was recently diagnosed with Parkinson’s has left our family deeply shaken . She was looking forward to enjoying her retirement , and this unexpected diagnosis has been incredibly difficult to process. The reality of facing such a serious health challenge so soon is overwhelming. We’re still learning about the disease and feel a mix of fear and uncertainty about what lies ahead. My mom, who isn’t comfortable navigating the internet , has asked for my help in finding reliable information so she can better understand her condition. If anyone has recommendations for trustworthy resources , I’d be so grateful for your guidance. Where should we turn for accurate and helpful information ?
Query ID:2
The weight of my grief is twofold: I mourn the absence of my mother , and I mourn the dissolution of the beliefs that once shaped my world. For years, I identified as a jack Mormon , but only recently did I fully sever my ties to the faith . The transition hasn’t been a revelation or a release; it’s been a quiet, aching loss . I was already living outside the church expectations, so the departure didn’t bring new freedoms, only a deepening sense of emptiness . The absence of faith hasn’t lifted me; it’s left me adrift .
Appendix
Table 19: Qualitative examples on Reddit at K =2. This part shows the private bundle and the AAST outputs. Bold text marks key semantic elements in the private texts and corresponding preserved content in the synthetic texts.
Method
Bundle
Text
KiP
Query ID:1
My mother was just diagnosed with p y lor i this week, and we are pretty devastated . She just turned 60 , and I didn’t expect to have to confront major health problems so soon. We don’t know much about this disease and are, to say the least, scared and devastated . She asked me to help her find resources so that she might better understand her disease, as she is not web-savvy . Can anyone please help me with this?. Where can we read more about this disease?. A re there any kinds of support that might be available to her?. Anything I need to know about how to support her ?
Query ID:2
H a ve any of you gone through a griev ing process after leaving the church ?. I have been a jack-mor mon for many years, and only in the last couple of years have I completely lost my faith and left completely. I was already living a life of the world ly life. So there has n’t been much to gain since I left, but there has been a lot to lose. I am now more f right ened of death ; I feel much more pe s s im istic about the future and c y n ical about life ; and sometimes I miss that feeling of being part of a community. To make matters worse, my mother was just diagnosed with a de generative disease that will probably kill her . And really, I find myself wanting that I had some belief system and community support to sustain me through the shock and grief I feel from her diagnosis, but I don’t know that I can ever again believe in any religion . I am griev ing for my mother , and griev ing for all that I feel that I have lost when I have lost my faith . I feel as if I shall be crushed under the weight of all these grief s
Target ID:1
I am a student taking evening classes and have been working full time to pay the bills. lexic al = 60. My job is steadi ly more difficult and more demanding ; and I am struggling to cope mentally and perform my duties. But I took some tuition assistance from my employer to pay for school, and their s tipul ation is that I have to stay at this job until at least Jan of 20 21, or I must pay back all the money , which I cannot do. I am losing my mind because of how much I hate this job . I need some advice on how to keep my s an ity . What keeps you s an e when you are stuck at a job you hate but can’t afford to leave ?
Target ID:2
I just need to vent . lexic al = 60. And order = 60. I have a friend who has to come home early from her mission because of mental health problems . I just had dinner with her the other day and was sad d ened to see how much she was struggling with feelings of failure from being at home, compound e d by the incredibly in sensitive comments some members made. I t was so hard for me to keep my mouth shut while I was with her, because I was boiling inside with rage at the church for making young people feel this way. …(omitted)
JAMDEC
Query ID:1
We are trying to figure out what we are going to do with the money, but we don’t know if we will be able to take care of her for the rest of our lives or if she will need to be in a nursing home for the remainder of her life, so we are just trying to get as much money as we can to help her out as much as possible while we are still able to do so! Thank you so much for taking the time to read our story and if you are able to help us out , we would love to hear from you so we can thank you for your kindness! ! …(omitted)
Query ID:2
If so, what was it like for you, and what advice would you give to someone who is going through the same thing right now? Please share your thoughts and experiences in the comments section below, and if you’d like to learn more about this topic, check out my book, Becoming a Supporter (affiliate link). If so, what was it like for you, and what advice would you give to someone who is going through the same thing right now? I was raised in the church , went to seminary, and served a mission, but after a few years I realized that the church was full of lies and that I had been lied to for so long, that I just couldn’t take it anymore. …(omitted)
Appendix
Table 20: Qualitative examples on Reddit at K =2, continued. This part shows KiP and JAMDEC outputs for the same private bundle in Table 19 . Bold text marks retained content related to the private text.
Subreddits
frugal
povertyfinance
poverty
poor
assistance
homeless
almosthomeless
tenanthelp
section8publichousing
unemployment
foodstamps
povertykitchen
debt
bankruptcy
borrow
studentloans
medicaid
Appendix
Table 21: Subreddits and filtering keywords used to construct the Reddit dataset.
Authorship attribution models can re-identify users from seemingly anonymized text by exploiting stable stylistic fingerprints, even after explicit identifiers are removed, posing a growing privacy risk for text publishing and analytics. This risk extends to speech-derived text such as ASR transcripts of meetings and call-center conversations, where stylometric leakage can persist even after acoustic anonymization. Differential privacy-based anonymization often severely degrades text quality and utility. We propose a style-aware, prompt-driven anonymization approach that uses pretrained large language models to construct compact stylistic profiles from minimal samples and rewrite text to suppress identifiable style markers while preserving meaning. Across blog and review datasets, our approach reduces authorship attribution F1 by 60-70% while maintaining content quality and readability, substantially outperforming DP-based and non-DP baselines.
Existing AI-generated text detectors are vulnerable to attacks that manipulate textual characteristics. In this study, we propose a novel Triospect Detection Framework by using additional perspectives of content (core ideas) and expression (stylistic elements) within a given text. Experiments on two benchmarks involving 17 attacks, 12 domains, and 17 source models demonstrate that Triospect is robust against these attacks. It improves the strong baseline by a significant margin of 22.3% (AUROC) and 13% (TPR01) on the Humanize-16K after-attack subset, and by 9.1% (AUROC) and 22% (TPR01) on the adversarial RAID. This framework marks a pioneering effort in statistical methods to enhance detection reliability against attacks. We release our data and code at https://github.com/baoguangsheng/triospect.
Guangsheng Bao, Lihua Rong, Yanbin Zhao +3
Zhejiang University · Zhejiang University of Technology · Shanghai Polytechnic University +2
Detecting AI-generated text is becoming increasingly challenging as modern language models approach human-level fluency and can evade detectors that rely on surface statistics or likelihood-based signals. We propose AEyeDE, an attribution-driven approach to human-AI authorship detection that leverages model attention as a discriminative signal. Specifically, we extract attention-based attribution matrices for both human- and AI-generated text using a proxy Transformer model with white-box access and train a lightweight Convolutional Neural Network to learn representations from these attribution maps. Across encoder-decoder translation settings, our method consistently outperforms a text-only baseline. In decoder-only settings, it performs strongly in generator-specific detection, remains competitive on standard benchmarks, and shows robustness under cross-dataset transfer and alternative-spelling perturbations. We further show that attention maps exhibit recurring local structures whose relative frequencies differ consistently between human- and AI-generated text across datasets and proxy models. These findings suggest that attention-based attribution maps provide a complementary and interpretable signal for AI-generated text detection. We will make the code publicly available to support future research.
Aria Nourbakhsh, Adelaide Danilov, Christoph Schommer +1
Department of Computer Science, University of Luxembourg