As large language models (LLMs) are increasingly used to generate text, their misuse has become a growing societal problem, with implications for academic misconduct, model distillation, and cyberattacks. For these reasons, Model Authorship Attribution (MAA), which identifies the source model of a given text, is important for promoting the responsible use of LLMs and improving AI safety. In practice, attribution systems must remain reliable beyond the distributions observed during training. They may encounter texts from unseen domains and writing settings, as well as generations from future versions of model families that were not available when the system was trained. However, existing MAA methods often exhibit substantial performance degradation under such distribution shifts. To address this challenge, we propose Authorship Tracing via Likelihood-based Attribution of Sources (ATLAS), which formulates MAA through source-conditioned text modeling rather than direct source prediction. ATLAS learns how text from each source family is generated and attributes a given text by comparing its likelihood under each learned source condition. We aggregate this likelihood evidence at the token level with clipping so that no single token dominates the decision. We further introduce MAABench, a broad MAA benchmark for evaluating practical OOD settings such as domain and version. Our experiments show that ATLAS consistently outperforms existing baselines across MAABench and OpenTuringBench. In particular, when both the generation domain and the model version change on MAABench, ATLAS achieves 74.27% accuracy, 9.00pp higher than the strongest baseline. Beyond MAA, ATLAS can also help identify distillation source models by measuring which source model a target LLM most closely resembles. Our extended experiments show that ATLAS recovers the known teacher of every distilled model we evaluate.
Figures & tables
Figure 1: Overview of ATLAS . Rather than directly predicting the source, ATLAS learns a source-conditioned language model for each model family and performs attribution from their relative token likelihoods. During training, for each source k , ATLAS adapts a pretrained LLM with a prefix embedding ek and a LoRA update Wk=W+BkA , where A is shared down-projection and Bk is source-specific up-projection. For the ground-truth source k∗ , ATLAS optimizes ek∗ , Bk∗ , and the shared A using the mean negative log-likelihood. During inference, ATLAS calculates token log-likelihoods for all source k , which serve as source model scores after clipping.
Distribution
Split
Setting
MGT
Human
ID
Train
–
149,760
29,952
Val
–
9,990
1,998
Test
–
9,985
1,997
OOD
Test
Domain
7,470
1,494
Version
29,700
1,980 †
Joint
21,615
1,441 †
Table 1: Summary of MAABench .
Method
ID
OOD
Domain
Version
Joint
Acc
F1
Acc
F1
Acc
F1
Acc
F1
Fast-DetectGPT ( Bao et al., 2024 )
44.37
43.54
45.29
44.18
35.22
34.75
31.85
30.81
Binoculars ( Hans et al., 2024 )
45.61
44.81
46.53
45.70
36.09
35.30
32.56
31.17
GPT-who ( Venkatraman et al., 2024 )
58.63
58.29
55.29
56.17
41.71
40.34
39.94
38.43
Sniffer ( Li et al., 2023 )
76.00
75.83
64.51
64.89
51.97
50.72
47.57
45.85
Table 2: MAA performance on MAABench . We report accuracy (%, ↑ ) and macro-F1 (%, ↑ ). Best results are in bold . For ATLAS and the four encoder-tuning baselines, we report the mean over three random seeds, with standard deviations and per-seed results in Table 15 ; the remaining baselines are from a single run.
Method
ID
OOD
ID
E1
E2
E3
E4
Fast-DetectGPT ( Bao et al., 2024 )
18.93
19.49
17.57
21.68
15.37
19.92
Binoculars ( Hans et al., 2024 )
19.54
22.91
20.33
24.79
16.41
23.15
GPT-who ( Venkatraman et al., 2024 )
47.55
22.41
44.68
31.09
15.05
25.89
Sniffer ( Li et al., 2023 )
61.65
27.25
55.78
38.67
15.53
30.12
StatEnsemble ( La Cava et al., 2026 )
61.93
60.52
58.40
63.30
26.99
48.46
Table 3: MAA performance on OpenTuringBench. We report accuracy (%, ↑ ), and E1-E4 are the in-domain variation tasks. Best results are in bold .
Method
Trained on MAABench
ID
OOD
Domain
Version
Joint
Fast-DetectGPT ( Bao et al., 2024 )
×
65.59
65.25
57.56
50.74
Binoculars ( Hans et al., 2024 )
×
71.14
71.74
62.56
57.57
IRM ( Liu et al., 2025 )
×
73.85
62.62
70.16
54.31
ReMoDetect ( Lee et al., 2024 )
×
77.27
82.33
73.06
80.32
DeTeCtive ( Guo et al., 2024 )
✓
100.00
98.60
99.95
97.97
Table 4: MGT detection on MAABench . We report AUROC (%, ↑ ) with MGT as the positive class; Trained on MAABench marks methods trained on the MAABench training split, while the others use off-the-shelf models. Best results are in bold .
Up-projection
Scoring
Version
Joint
Shared B
Mean
76.06
66.11
Per-source Bk
Mean
78.24
66.95
Per-source Bk
Clipped
82.79
72.07
Table 5: Component analysis. Accuracy (%, ↑ ) under the two version-related shifts.
Backbone
Domain
Version
Joint
Qwen2.5-7B
97.59
82.79
72.07
OLMo-2-7B
97.05
83.75
72.99
Qwen3-8B
98.09
83.40
75.22
Table 6: Effect of backbone family. Accuracy (%, ↑ ) under three different backbones.
Figure 2: Effect of backbone and training data size. (a) Accuracy (%, ↑ ) of ATLAS with four Qwen2.5 backbone sizes, each trained on 10,000 texts per source family. (b) Accuracy (%, ↑ ) on Version Shift and Joint Shift against the number of training texts per source, compared with DA-MTL. The dotted lines mark DA-MTL on the full split of 30k texts.
Figure 3: Attribution of distilled and deployed models. Share of each model’s texts attributed to each candidate family, in percent. (a) Distilled models with known teachers: None is the share of texts that no condition explains better than the frozen backbone. (b) Seven recent releases of widely deployed models: segments under 12% are left unlabeled.
Table 7: Source models of MAABench . The training version is used for ID and Domain shift, and the three held-out versions for Version shift and Joint shift.
Domain
Corpus
Generation Fields
# Seeds
News
XSum 1 1 1 EdinburghNLP/xsum@7d4d486c
Headline
8,500
Wikipedia
Wikipedia EN 2 2 2 wikimedia/wikipedia:20231101.en@b04c8d1c
Table 8: Human-written text corpus of MAABench . Patents and Stack Exchange are the unseen domains of Domain shift and Joint shift; counts are the seed pool before filtering.
Domain
{output}
System prompt
News
news article
default
Wikipedia
encyclopedia article
default
Academic
research abstract
default
Product Reviews
product review
default
Patents
patent abstract
persona: a patent specialist
Stack Exchange
forum question
persona: a member of an online Q&A community
Appendix
Table 9: Domain-specific prompt substitutions. The four in-distribution domains use the default system prompt and the two unseen domains the persona-based one.
Setting
Pool
Seeds
Gen./seed
Machine
Human
Total
ID (train)
30,000
29,952
5
149,760
29,952
179,712
ID (validation)
2,000
1,998
5
9,990
1,998
11,988
ID (test)
2,000
1,997
5
9,985
1,997
11,982
Domain shift
1,500
1,494
5
7,470
1,494
8,964
Version shift
2,000
1,980
15
29,700
1,980 †
31,680
Joint shift
1,500
1,441
15
21,615
1,441 †
23,056
Appendix
Table 10: Composition of MAABench . Pool is the seed pool before filtering, Seeds the seeds retained after it, and Gen./seed the generations per retained seed. † marks a count reused from an earlier setting: Version shift reuses the in-distribution test seeds, and Joint shift is filtered from the same seed pool as Domain shift and shares all but two of its seeds.
Source
n
Mean
Median
p5
p95
GPT
45,704
194.5
198
155
218
Claude
45,704
198.8
199
180
218
Gemini
45,704
192.5
192
162
226
Mistral
45,704
161.8
161
114
215
Llama
45,704
175.9
173
147
214
Human
35,443
166.9
180
96
217
Appendix
Table 11: Length statistics of the retained texts for each model.
Optimizer
AdamW, β=(0.9,0.999) , weight decay 0.01
Learning rate
1×10−4
Schedule
linear warmup over 5% of steps, then cosine decay to 0
Gradient clipping
global norm 1.0
Effective batch
128
Epochs
5 on MAABench , 3 on OpenTuringBench
Maximum length
512 tokens ( MAABench ), 1024 (OpenTuringBench)
Appendix
Table 12: Optimization settings. Shared by ATLAS and the supervised baselines.
Method
Representation
Trained part
Prediction
Fast-DetectGPT
one score from a frozen proxy
classifier
logistic regression
Binoculars
one score from two frozen proxies
classifier
logistic regression
GPT-who
surprisal features, one proxy
classifier
logistic regression
Sniffer
pairwise features, four proxies
classifier
MLP
StatEnsemble
eight features (Table 14 )
classifier
MLP
DeTeCtive
LLM2Vec embedding
adapter and head
nearest neighbors
Appendix
Table 13: The MAA baselines. Fixed-feature methods train only a classifier on features from frozen proxy models. Encoder-tuning methods share the LLM2Vec trunk and the schedule of Table 12 .
Feature
Definition
Log-likelihood
the mean log-probability of the written tokens
Perplexity
the negative of the above, the mean token cross-entropy
Rank
the mean rank of the written token, counting from one
Log-rank
the mean of the logarithm of that rank, taken per token
Entropy
the mean next-token entropy, which ignores the written token
LRR
perplexity over log-rank, the statistic of DetectLLM ( Su et al., 2023 )
Appendix
Table 14: Features of StatEnsemble. Every statistic is an average over the scored tokens of a text.
Method
Run
ID
OOD
Domain
Version
Joint
Acc
F1
Acc
F1
Acc
F1
Acc
F1
DeTeCtive
Seed 42
99.49
99.49
95.39
95.40
70.12
69.46
62.87
61.54
Seed 123
99.47
99.47
94.27
94.28
70.46
70.03
63.20
62.76
Seed 456
99.56
99.56
94.42
94.47
71.22
71.14
63.89
63.60
Mean
99.51
99.51
94.69
94.72
70.60
70.21
63.32
62.63
Appendix
Table 15: Per-seed MAA performance on MAABench . Accuracy (%, ↑ ) and macro-F1 (%, ↑ ) of ATLAS and the four encoder-tuning baselines for each of the three random seeds, with their mean and standard deviation. The means are the entries of Table 2 .
Reported as
Task
What changes
ID
E0
Held-out news articles from the training source
E1
E1
Sampling temperature raised to 0.7 and 1.0
E2
E2
∼ 70B versions of Llama 3.1 and Qwen 2.5 in place of the 8B and 7B ones seen in training
E3
E3
Each model rewrites its own earlier generations
E4
E4
Human–machine mixing: models revise and continue human-written text
OOD
E5
Essay domain instead of news, about 1,000 essays per model
Appendix
Table 16: OpenTuringBench tasks.
Method
ID
OOD
ID
E1
E2
E3
E4
Fast-DetectGPT ( Bao et al., 2024 )
14.06
16.79
13.23
17.13
7.76
13.91
Binoculars ( Hans et al., 2024 )
13.41
18.28
13.88
20.88
9.26
19.42
GPT-who ( Venkatraman et al., 2024 )
47.00
16.49
43.80
29.82
6.77
24.25
Sniffer ( Li et al., 2023 )
61.48
18.15
54.94
37.42
7.28
27.68
StatEnsemble ( La Cava et al., 2026 )
61.18
60.58
57.42
63.06
26.13
48.26
Appendix
Table 17: MAA performance on OpenTuringBench (macro-F1). We report macro-F1 ( ↑ ) for the runs of Table 3 . Best results are in bold , and second-best results are underlined .
Method
Trained
ID
OOD
Domain
Version
Joint
TPR
FPR
TPR
FPR
TPR
FPR
TPR
FPR
Fast-DetectGPT ( Bao et al., 2024 )
×
17.31
95.04
24.90
95.78
13.14
96.31
13.35
98.82
Binoculars ( Hans et al., 2024 )
×
26.13
91.29
18.31
83.94
19.75
93.99
11.76
93.48
IRM ( Liu et al., 2025 )
×
18.09
78.27
15.39
90.09
13.25
80.35
10.41
92.85
ReMoDetect ( Lee et al., 2024 )
×
17.65
78.97
31.41
71.95
15.11
82.17
29.72
75.09
Appendix
Table 18: MGT detection on MAABench at fixed operating points. For the runs of Table 4 , we report the true positive rate at a 1% false positive rate (TPR, ↑ ) and the false positive rate at a 95% true positive rate (FPR, ↓ ), with MGT as the positive class; Trained marks methods trained on MAABench , as in Table 4 . Best results are in bold .
Up-projection
Scoring
ID
OOD
Domain
Version
Joint
shared B
mean
99.70
97.51
76.06
66.11
per-source Bk
mean
99.86
96.91
78.24
66.95
per-source Bk
clipped
99.64
97.59
82.79
72.07
Appendix
Table 19: Component analysis on all four evaluation settings of MAABench . We report accuracy ( ↑ ) with 10,000 training texts per source family. Up-projection is shared across sources or per source, and Scoring is the mean likelihood or the clipped score. Best results are in bold .
Backbone
ID
OOD
Domain
Version
Joint
Acc
F1
Acc
F1
Acc
F1
Acc
F1
Qwen2.5-0.5B
98.32
98.32
88.19
88.28
78.33
78.54
64.98
64.92
Qwen2.5-1.5B
99.01
99.01
96.17
96.18
81.00
81.08
70.28
70.21
Qwen2.5-3B
99.38
99.38
94.59
94.63
82.18
82.20
71.21
71.33
Qwen2.5-7B
99.64
99.64
97.59
97.60
82.79
82.75
72.07
71.78
Appendix
Table 20: Effect of backbone size. We report accuracy (Acc, ↑ ) and macro-F1 (F1, ↑ ) for Qwen2.5 backbones of four sizes, each trained on 10,000 texts per source family; the last row is the change in accuracy from 0.5B to 7B. Best results are in bold .
Backbone
ID
OOD
Domain
Version
Joint
Acc
F1
Acc
F1
Acc
F1
Acc
F1
Qwen2.5-7B
99.64
99.64
97.59
97.60
82.79
82.75
72.07
71.78
OLMo-2-7B
99.60
99.60
97.05
97.07
83.75
83.79
72.99
73.07
Qwen3-8B
99.73
99.73
98.09
98.09
83.40
83.26
75.22
74.88
Appendix
Table 21: Effect of backbone family. We report accuracy (Acc, ↑ ) and macro-F1 (F1, ↑ ) for three backbones of comparable size, each trained on 10,000 texts per source family. Best results are in bold .
Method
Training texts per source
1k
3k
5k
10k
15k
full
ID
DeTeCtive ( Guo et al., 2024 )
96.25
98.08
98.52
99.20
99.28
99.49
OTBDetector ( La Cava & Tagarelli, 2025 )
48.64
73.83
81.87
98.29
99.07
99.42
DA-MTL ( Rao et al., 2025 )
95.91
98.34
98.92
99.30
99.41
99.45
Idiosyncrasies ( Sun et al., 2025 )
95.44
98.41
98.90
99.03
99.30
99.52
Appendix
Table 22: Effect of training-data scale. We report accuracy ( ↑ ) against the number of training texts per source family; the full column of every method is its entry in Table 2 . Best results in each column of a block are in bold .
Figure 4: Confusion matrices of ATLAS on MAABench . Each row is a true source family and each column a predicted one; entries are the percentage of the row’s texts, so the diagonal is the per-family recall.
Figure 5: Version Shift accuracy by held-out version. Accuracy ( ↑ ) of ATLAS (solid) and OTBDetector (dashed) on each of the three held-out versions of a family, ordered from the oldest to the newest release; Table 7 lists the versions.
Model
Attribution (%)
Reject (%)
GPT
Claude
Gemini
Base model (teacher)
000 Qwen3-8B (GPT)
93.6
5.3
1.1
10.6
000 Llama-3.1-8B (GPT)
87.3
11.9
0.8
30.2
000 Qwen3.5-27B (Claude)
5.8
92.9
1.3
1.8
000 Qwen3.5-4B (Claude)
23.0
76.4
0.6
8.0
Appendix
Table 23: Attribution of distilled and deployed models. Share of each model’s texts attributed to each candidate family, in percent. Each validation model is listed by the base model it was fine-tuned from, with the family of the teacher stated, and the most attributed family is in bold . Reject is the share of texts that no condition explains better than the frozen backbone.
Given the current trend to employ large language models (LLMs) in almost any imaginable context, LLM-generated text detection and authorship attribution have become a pressing issue. Prior work has primarily focused on surface-level linguistic features, an approach shown to be susceptible to paraphrasing and other obfuscation techniques. In this paper, we go beyond the linguistic surface, extracting and analysing reasoning structures in LLM-generated texts with the goal of capturing more complex signals of LLM authorship. We propose a graph neural network approach that leverages reasoning graphs extracted by an argument mining pipeline, demonstrating improved robustness and generalisation over a traditional Longformer baseline. Our approach outperforms the baseline by up to 27 percentage points under the obfuscation attacks such as paraphrasing and backtranslation, and 19 percentage points when evaluated on the texts generated by the unseen model versions, simulating real-world conditions in which new LLM versions are continuously released.
Zlata Kikteva, Artur Romazanov, Annette Hautli-Janisz +1
University of Passau, Germany · University of Dundee, United Kingdom
In this paper, we introduce GhostWriteBench, a dataset for LLM authorship attribution. It comprises long-form texts (50K+ words per book) generated by frontier LLMs, and is designed to test generalisation across multiple out-of-distribution (OOD) dimensions, including domain and unseen LLM author. We also propose TRACE -- a novel fingerprinting method that is interpretable and lightweight -- that works for both open- and closed-source models. TRACE creates the fingerprint by capturing token-level transition patterns (e.g., word rank) estimated by another lightweight language model. Experiments on GhostWriteBench demonstrate that TRACE achieves state-of-the-art performance, remains robust in OOD settings, and works well in limited training data scenarios.
Anudeex Shetty, Qiongkai Xu, Olga Ohrimenko +1
School of Computing and Information Systems, The University of Melbourne, Australia · School of Computing, FSE, Macquarie University, Australia
Model-attribution classifiers can often identify which language model produced a text, making model-specific writing patterns a signal of provenance. Accurate attribution on unmodified text, however, does not show whether the prediction still identifies the original source after deliberate rewriting. We formulate this problem as targeted fingerprint transfer: rewriting one model's output so that attribution classifiers assign it to a chosen target model. We study summarization, where different models receive the same document and express the same underlying content, providing a controlled setting for conditional generation. We introduce ForgePrint, a search-then-distil framework that first searches for rewrites that move attribution toward a target fingerprint, then distils the selected rewrites into a one-pass 4B Student model. On CNN/DM, the Student reaches 70.2% target success rate, outperforming both its Teacher (54.1%) and the strongest of six published rewriting baselines (39.3%), against held-out classifiers that are never queried by the attack. It also reaches 68.3% target success when transferring summaries from an open model toward chosen commercial models. These results show that fingerprint detectability should not be conflated with source authenticity, and that text-only attribution can provide misleading evidence of model identity under targeted rewriting, even when it is accurate on unmodified text.
Haohan Yuan, Simin Chen, Xi Niu +3
University of North Carolina at Charlotte · George Mason University · Indiana University