Beyond Global Scalars: Synergizing Token-Level Statistics and Deep Semantics for Adversarial AIGC Text Detection

Peiming Li; Yifan Wang; Zhiyuan Hu; Shiyu Li; Zheng Wei; Yang Tang

cs.CLAug 28, 2026

Beyond Global Scalars: Synergizing Token-Level Statistics and Deep Semantics for Adversarial AIGC Text Detection

Authors: Peiming Li, Yifan Wang, Zhiyuan Hu, Shiyu Li, Zheng Wei, Yang Tang

Organizations: Tencent BAC · School of Electronic and Computer Engineering, Peking University

Abstract

The rapid evolution of large language models necessitates robust machine-generated text detection. Existing paradigms typically follow two isolated tracks. Training-free methods rely on global statistical scalars such as perplexity, while training-based methods utilize semantic hidden states. Both approaches exhibit fundamental vulnerabilities in adversarial scenarios. Global scalars act as lossy compressions that obscure local probabilistic burstiness in interleaved texts, whereas pure semantic models overfit to specific fingerprints and remain susceptible to spoofing. To expose these flaws, we introduce MOSAIC, a comprehensive adversarial benchmark comprising 16000 samples across a full-granularity attack spectrum. To address these challenges, we propose NeuroStat, an end-to-end framework bridging the statistical and semantic gap. NeuroStat captures uncompressed token-level probabilistic logits alongside deep semantic hidden states from a single causal language model backbone. We fuse these heterogeneous signals through Macro-State Residual Modulation, which adaptively calibrates local convolutional features using global uncertainty indicators. Orthogonal and contrastive losses further ensure the learning of complementary representations. Extensive experiments demonstrate that NeuroStat maintains exceptional robustness on MOSAIC compared to the severe degradation of state-of-the-art methods, establishing a new standard for adversarial text detection. Code and the MOSAIC benchmark are available at https://github.com/TencentBAC/NeuroStat.

Figures & tables

Figure 1: Comparison of detection paradigms under adversarial attacks. Existing methods fail due to their reliance on either (a) easily hijacked global statistical scalars (Training-Free) or (b) overfitted semantic patterns that can be disrupted by style manipulation (Training-Based). (c) NeuroStat robustly detects adversarial AIGC by synergizing uncompressed token-level statistical trajectories and deep semantic representations.

Figure 2: The overall architecture of NeuroStat. A CausalLM backbone simultaneously extracts token logits and hidden states. The Probabilistic Trajectories Branch (top) captures local statistical patterns, which are dynamically calibrated by the MSRM mechanism using global uncertainty indicators. Concurrently, the Semantic Artifacts Branch (bottom) extracts contextual styles via attention pooling. The fused representations are jointly optimized with $\mathcal{L}_{\mathrm{Orth}}$ and $\mathcal{L}_{\mathrm{SupCon}}$ objectives to ensure complementary and robust feature learning.

Benchmark

Data Statistics

MGT Tasks

Adversarial Attack Coverage

Summary

Size

#Dom.

Gen.

Pol.

Rew.

Inter- leaved

Stat. Hijack

Trans- lation

Para- phrase

Prompt Inj.

Char./ Enc.

Recur- sive

Dom./ Fmt.

#Cat.

#Atk.

TuringBench Uchendu et al. (2021)

168.6K

✓

✗

HC3 Guo et al. (2023)

85K

✓

✗

M4 Wang et al. (2024)

24.5K

✓

✗

✓

MAGE Li et al. (2024)

29K

✓

✗

✓

✗

✓

RAID Dugan et al. (2024)

628.7K

✓

✗

✓

✗

✓

✗

✓

✗

Table 1: Comparison with existing MGT detection benchmarks. Our benchmark provides 36 sub-methods across 8 linguistic granularity levels with full category coverage, generated via uniform random model assignment over 6 frontier LLMs. ✓ = supported; ✗ = not supported. Comprehensive details are provided in the Appendix Sec. B

MIRAGE-DIG (Disjoint-Input Generation)
Methods	Generate				Polish				Rewrite
Methods	AUROC	Accuracy	MCC	TPR@5%	AUROC	Accuracy	MCC	TPR@5%	AUROC	Accuracy	MCC	TPR@5%
Likelihood Solaiman et al. (2019)	0.4936	0.5091	0.0183	0.0147	0.4653	0.5000	0.0000	0.0214	0.4337	0.5000	0.0000	0.0148
LogRank Ippolito et al. (2020)	0.4992	0.5128	0.0260	0.0220	0.4512	0.5000	0.0000	0.0195	0.4225	0.5000	0.0000	0.0132
Entropy Gehrmann et al. (2019)	0.6522	0.6150	0.2543	0.1099	0.5543	0.5417	0.1247	0.0954	0.5805	0.5566	0.1650	0.1189
RoBERTa-Base Liu et al. (2019)	0.5523	0.5397	0.1434	0.1250	0.4859	0.5010	0.0088	0.0460	0.5020	0.5049	0.0293	0.0569

Table 2: Experimental results across three tasks (Generate, Polish, Rewrite). Metrics include AUROC, Accuracy, MCC, and TPR@5%. Best results are highlighted in bold.

Robustness Evaluation on the MOSAIC Adversarial Benchmark
Methods	AUROC across 8 Adversarial Attack Categories								Overall Performance (%)
Methods	Interleaved	Stat. Hijack	Translation	Paraphrase	Prompt Inj.	Char./Enc.	Recursive	Dom./Fmt.	AUROC	TPR@5%
Likelihood Solaiman et al. (2019)	49.8	30.6	62.8	47.0	47.8	34.1	46.4	50.0	46.1	3.5
LogRank Ippolito et al. (2020)	50.3	69.9	37.9	53.4	53.1	65.5	54.5	51.2	54.5	9.3
Entropy Gehrmann et al. (2019)	48.2	65.1	40.8	50.3	50.1	60.7	49.9	49.5	51.8	6.9
RoBERTa-Base Liu et al. (2019)	47.6	46.8	55.6	50.0	45.2	46.4	47.9	43.9	47.9	3.0

Table 3: Adversarial robustness evaluation on the MOSAIC benchmark. The left section reports the AUROC scores across all 8 fine-grained attack categories, demonstrating the detectors’ resilience against specific spoofing strategies (e.g., Statistical Hijacking, Interleaved texts). The right section reports the overall detection performance. Best results are highlighted in bold , and second-best results are underlined .

Figure 3: t-SNE visualization of TF, TB, and fused representations. The fusion space shows better class separation.

Figure 4: Reliability diagrams of NeuroStat vs. DetectAnyLLM. Lower ECE indicates better calibration.

Configuration	TF	TB	MSRM	MIRAGE DIG (AUROC)
Configuration	TF	TB	MSRM	Polish	Rewrite	Generate
TB-Only (Seq. Cls.)	$\times$	✓	$\times$	0.8990	0.8918	0.9787
TF + TB (Concat)	✓	✓	$\times$	0.9280	0.9145	0.9934
NeuroStat (Full)	✓	✓	✓	0.9576	0.9490	0.9955

Table 4: Ablation on core architectural components. “TB-Only” is a standard sequence classification model.

Configuration	$\mathcal{L}_{CE}$	$\mathcal{L}_{\mathrm{SupCon}}$	$\mathcal{L}_{\mathrm{Orth}}$	MIRAGE DIG (AUROC)
Configuration	$\mathcal{L}_{CE}$	$\mathcal{L}_{\mathrm{SupCon}}$	$\mathcal{L}_{\mathrm{Orth}}$	Polish	Rewrite	Generate
CE Only	✓	$\times$	$\times$	0.8859	0.8798	0.9850
+ $\mathcal{L}_{\mathrm{SupCon}}$	✓	✓	$\times$	0.9179	0.9124	0.9922
+ $\mathcal{L}_{\mathrm{Orth}}$	✓	$\times$	✓	0.9129	0.9051	0.9865
NeuroStat (Full)	✓	✓	✓	0.9576	0.9490	0.9955

Table 5: Impact of auxiliary losses. All variants use the full architecture, differing only in the loss configuration.

Appendix figures & tables8 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 5: The full-granularity adversarial attack taxonomy of the MOSAIC benchmark. The sunburst chart illustrates the hierarchical structure of our dataset, encompassing 8 primary attack categories (inner circle) and 36 fine-grained sub-methods (outer circle). This comprehensive spectrum ensures a rigorous evaluation of detectors against both statistical hijacking and semantic obfuscation.

Source Dataset	Domain	Raw Samples
MIRAGE-BENCH DIG	Multi-domain	16,411
MIRAGE-BENCH SIG	Multi-domain	16,388
AI Detection 3000	Mixed	3,354
PubMed	Biomedical	150
SQuAD	Wikipedia/QA	150
Writing Prompts	Creative Writing	150

Appendix

Table 6: Source datasets used for collecting human seed texts.

ImBD Test Dataset (GPT-3.5 & GPT-4o polished)
Methods	GPT-3.5			GPT-4o
Methods	XSum	Writing	PubMed	XSum	Writing	PubMed
Likelihood Solaiman et al. (2019)	0.4982	0.8788	0.5528	0.4396	0.8077	0.4596
LogRank Ippolito et al. (2020)	0.4711	0.8496	0.5597	0.4002	0.7694	0.4472
Entropy Gehrmann et al. (2019)	0.6742	0.3021	0.5662	0.6122	0.2802	0.5899
RoBERTa-Base Liu et al. (2019)	0.5806	0.7225	0.4370	0.4921	0.4774	0.2496

Appendix

Table 7: Detection performance (AUROC) on the standard ImBD test dataset. Best results are highlighted in bold , and second-best results are underlined .

Config	Int.	S.H.	Trans.	Para.	P.I.	C/E	Rec.	D/F	Avg.
TB-Only	68.0	70.0	71.0	70.0	82.0	60.0	85.0	93.0	74.9
TF-Only	70.5	76.0	64.0	66.0	77.0	65.5	88.0	90.0	74.6
Concat	71.8	76.2	73.4	71.5	84.1	66.7	90.2	96.1	78.8
+MSRM	76.9	80.5	77.3	77.3	89.9	71.2	95.5	98.9	83.4

Appendix

Table 8: Per-category AUROC on MOSAIC. Int. Interleaved, S.H. Statistical Hijacking, Trans. Translation, Para. Paraphrase, P.I. Prompt Injection, C/E Character/Encoding, Rec. Recursive, D/F Domain/Format.

Fusion Mechanism	Params	MOSAIC AUROC
Naive concatenation	0	78.8
Multiplicative gate (w/o residual)	192	79.7
Log-rank-only gate	96	80.6
Cross-attention fusion	16,640	80.9
Entropy-only gate	96	81.3
SE-style modulation	2,128	81.5

Appendix

Table 9: Comparison of MSRM with alternative fusion mechanisms on MOSAIC. The residual formulation, not additional parameters, accounts for the gain.

Train Pairs	MIRAGE-Polish	MOSAIC Avg.	MOSAIC TPR@5%
100	0.8891	71.4	39.7
250	0.9247	78.9	51.6
500 (default)	0.9576	83.4	57.7
1,000	0.9631	84.7	60.5
2,000	0.9694	85.9	63.4
5,000	0.9718	86.5	64.9

Appendix

Table 10: Training-sample sensitivity of NeuroStat (Qwen2-0.5B). Performance saturates around 2,000 to 5,000 pairs.

Target Generator	Access	AUROC	TPR@5%
GPT-5.4	Closed	79.6	51.2
Claude-Opus-4-6	Closed	81.3	54.7
Gemini-3.1-Pro	Closed	82.7	56.9
MiniMax-M2.7	Closed	84.1	58.8
GLM-5.0	Open	86.2	62.4
Kimi-K2.5	Open	86.5	62.9

Appendix

Table 11: Per-generator performance of NeuroStat (Qwen2-0.5B), acting as an open-source surrogate for both open and closed-source target generators.

Method	Train. Params	Peak Mem	Latency/Sample	Throughput	Train Time
RoBERTa-Base	125M	3.1GB	6.2ms	161/s	3min
Fast-DetectGPT	0 (frozen)	2.4GB	22.7ms	44/s	–
ImBD (LoRA)	4M	4.7GB	25.9ms	39/s	12min
DetectAnyLLM	0.50B	5.8GB	28.4ms	35/s	21min
NeuroStat (Qwen2-0.5B)	0.51B	6.4GB	31.1ms	32/s	24min
NeuroStat (Qwen3.5-0.8B)	0.82B	9.9GB	42.6ms	23/s	38min

Appendix

Table 12: Measured computational cost on a single NVIDIA H20 GPU (batch size 8, sequence length 512).

AI-Generated Text Detection

AI-generated text detection develops methods to distinguish human-written, machine-generated, and AI-edited text.

See all 170 papers

Luminol-AIDetect: Fast Zero-shot Machine-Generated Text Detection based on Perplexity under Text Shuffling
Apr 28, 2026Lucio La Cava, Andrea TagarelliAI-Generated Text Detection
DIMES Dept., University of Calabria v. P. Bucci 44Z, 87036 Rende, CS, Italy
Triospect: A Three-Dimensional Framework for Robust Statistical AI-Generated Text Detection Against Diverse Attacks
Jun 30, 2026Guangsheng Bao, Lihua Rong, Yanbin Zhao +3AI-Generated Text Detection Robustness of Machine-Generated Text Detection
Zhejiang University · Zhejiang University of Technology · Shanghai Polytechnic University +2
Detecting the Machine: A Comprehensive Benchmark of AI-Generated Text Detectors Across Architectures, Domains, and Adversarial Conditions
Mar 18, 2026Madhav S. Baidya, S. S. Baidya, Chirag ChawlaAI-Generated Text Detection Robustness of Machine-Generated Text Detection
Indian Institute of Technology (BHU), Varanasi, India · Indian Institute of Technology Guwahati, India

Apr 28, 2026J/K move · Enter open · S save

Luminol-AIDetect: Fast Zero-shot Machine-Generated Text Detection based on Perplexity under Text Shuffling

Lucio La Cava, Andrea Tagarelli

DIMES Dept., University of Calabria v. P. Bucci 44Z, 87036 Rende, CS, Italy

AI-Generated Text Detection

Open paper AskPDF arXiv

Machine-generated text (MGT) detection requires identifying structurally invariant signals across generation models, rather than relying on model-specific fingerprints. In this respect, we hypothesize that while large language models excel at local semantic consistency, their autoregressive nature results in a specific kind of structural fragility compared to human writing. We propose Luminol-AIDetect, a novel, zero-shot statistical approach that exposes this fragility through coherence disruption. By applying a simple randomized text-shuffling procedure, we demonstrate that the resulting shift in perplexity serves as a principled, model-agnostic discriminant, as MGT displays a characteristic dispersion in perplexity-under-shuffling that differs markedly from the more stable structural variability of human-written text. Luminol-AIDetect leverages this distinction to inform its decision process, where a handful of perplexity-based scalar features are extracted from an input text and its shuffled version, then detection is performed via density estimation and ensemble-based prediction. Evaluated across 8 content domains, 11 adversarial attack types, and 18 languages, Luminol-AIDetect demonstrates state-of-the-art performance, with gains up to 17x lower FPR while being cheaper than prior methods.

Abstract

AI-Generated Text Detection

Explore similar work

Luminol-AIDetect: Fast Zero-shot Machine-Generated Text Detection based on Perplexity under Text Shuffling

Triospect: A Three-Dimensional Framework for Robust Statistical AI-Generated Text Detection Against Diverse Attacks

Detecting the Machine: A Comprehensive Benchmark of AI-Generated Text Detectors Across Architectures, Domains, and Adversarial Conditions