Who's Behind the Text? Robust Model Authorship Attribution

Minseok Ko; Hyunseok Lee; Woomin Song; Beomjun Kim; Jinwoo Shin; Kunwoong Kim

cs.AIOct 14, 2026

Who's Behind the Text? Robust Model Authorship Attribution

Authors: Minseok Ko, Hyunseok Lee, Woomin Song, Beomjun Kim, Jinwoo Shin, Kunwoong Kim

Organizations: Korea Advanced Institute of Science and Technology (KAIST)

Abstract

As large language models (LLMs) are increasingly used to generate text, their misuse has become a growing societal problem, with implications for academic misconduct, model distillation, and cyberattacks. For these reasons, Model Authorship Attribution (MAA), which identifies the source model of a given text, is important for promoting the responsible use of LLMs and improving AI safety. In practice, attribution systems must remain reliable beyond the distributions observed during training. They may encounter texts from unseen domains and writing settings, as well as generations from future versions of model families that were not available when the system was trained. However, existing MAA methods often exhibit substantial performance degradation under such distribution shifts. To address this challenge, we propose Authorship Tracing via Likelihood-based Attribution of Sources (ATLAS), which formulates MAA through source-conditioned text modeling rather than direct source prediction. ATLAS learns how text from each source family is generated and attributes a given text by comparing its likelihood under each learned source condition. We aggregate this likelihood evidence at the token level with clipping so that no single token dominates the decision. We further introduce MAABench, a broad MAA benchmark for evaluating practical OOD settings such as domain and version. Our experiments show that ATLAS consistently outperforms existing baselines across MAABench and OpenTuringBench. In particular, when both the generation domain and the model version change on MAABench, ATLAS achieves 74.27% accuracy, 9.00pp higher than the strongest baseline. Beyond MAA, ATLAS can also help identify distillation source models by measuring which source model a target LLM most closely resembles. Our extended experiments show that ATLAS recovers the known teacher of every distilled model we evaluate.

Figures & tables

Figure 1: Overview of ATLAS . Rather than directly predicting the source, ATLAS learns a source-conditioned language model for each model family and performs attribution from their relative token likelihoods. During training, for each source $k$ , ATLAS adapts a pretrained LLM with a prefix embedding $e_{k}$ and a LoRA update $W_{k}=W+B_{k}A$ , where $A$ is shared down-projection and $B_{k}$ is source-specific up-projection. For the ground-truth source $k^{*}$ , ATLAS optimizes $e_{k^{*}}$ , $B_{k^{*}}$ , and the shared $A$ using the mean negative log-likelihood. During inference, ATLAS calculates token log-likelihoods for all source $k$ , which serve as source model scores after clipping.

Distribution	Split	Setting	MGT	Human
ID	Train	–	149,760	29,952
	Val	–	9,990	1,998
	Test	–	9,985	1,997
OOD	Test	Domain	7,470	1,494
		Version	29,700	1,980 †
		Joint	21,615	1,441 †

Table 1: Summary of MAABench .

Method	ID		OOD
	ID		Domain		Version		Joint
	Acc	F1	Acc	F1	Acc	F1	Acc	F1
Fast-DetectGPT ( Bao et al., 2024 )	44.37	43.54	45.29	44.18	35.22	34.75	31.85	30.81
Binoculars ( Hans et al., 2024 )	45.61	44.81	46.53	45.70	36.09	35.30	32.56	31.17
GPT-who ( Venkatraman et al., 2024 )	58.63	58.29	55.29	56.17	41.71	40.34	39.94	38.43
Sniffer ( Li et al., 2023 )	76.00	75.83	64.51	64.89	51.97	50.72	47.57	45.85

Table 2: MAA performance on MAABench . We report accuracy (%,

\uparrow

) and macro-F1 (%,

\uparrow

). Best results are in bold . For ATLAS and the four encoder-tuning baselines, we report the mean over three random seeds, with standard deviations and per-seed results in Table 15 ; the remaining baselines are from a single run.

Method	ID					OOD
Method	ID	E1	E2	E3	E4	OOD
Fast-DetectGPT ( Bao et al., 2024 )	18.93	19.49	17.57	21.68	15.37	19.92
Binoculars ( Hans et al., 2024 )	19.54	22.91	20.33	24.79	16.41	23.15
GPT-who ( Venkatraman et al., 2024 )	47.55	22.41	44.68	31.09	15.05	25.89
Sniffer ( Li et al., 2023 )	61.65	27.25	55.78	38.67	15.53	30.12
StatEnsemble ( La Cava et al., 2026 )	61.93	60.52	58.40	63.30	26.99	48.46

Table 3: MAA performance on OpenTuringBench. We report accuracy (%,

\uparrow

), and E1-E4 are the in-domain variation tasks. Best results are in bold .

Method	Trained on MAABench	ID	OOD
Method	Trained on MAABench	ID	Domain	Version	Joint
Fast-DetectGPT ( Bao et al., 2024 )	$\times$	65.59	65.25	57.56	50.74
Binoculars ( Hans et al., 2024 )	$\times$	71.14	71.74	62.56	57.57
IRM ( Liu et al., 2025 )	$\times$	73.85	62.62	70.16	54.31
ReMoDetect ( Lee et al., 2024 )	$\times$	77.27	82.33	73.06	80.32
DeTeCtive ( Guo et al., 2024 )	✓	100.00	98.60	99.95	97.97

Table 4: MGT detection on MAABench . We report AUROC (%,

\uparrow

) with MGT as the positive class; Trained on MAABench marks methods trained on the MAABench training split, while the others use off-the-shelf models. Best results are in bold .

Up-projection	Scoring	Version	Joint
Shared $B$	Mean	76.06	66.11
Per-source $B_{k}$	Mean	78.24	66.95
Per-source $B_{k}$	Clipped	82.79	72.07

Table 5: Component analysis. Accuracy (%,

\uparrow

) under the two version-related shifts.

Backbone	Domain	Version	Joint
Qwen2.5-7B	97.59	82.79	72.07
OLMo-2-7B	97.05	83.75	72.99
Qwen3-8B	98.09	83.40	75.22

Table 6: Effect of backbone family. Accuracy (%,

\uparrow

) under three different backbones.

Panel of Figure 2 — Figure 2: Effect of backbone and training data size. (a) Accuracy (%, $\uparrow$ ) of ATLAS with four Qwen2.5 backbone sizes, each trained on 10,000 texts per source family. (b) Accuracy (%, $\uparrow$ ) on Version Shift and Joint Shift against the number of training texts per source, compared with DA-MTL. The dotted lines mark DA-MTL on the full split of 30k texts.

Panel of Figure 3 — Figure 3: Attribution of distilled and deployed models. Share of each model’s texts attributed to each candidate family, in percent. (a) Distilled models with known teachers: None is the share of texts that no condition explains better than the frozen backbone. (b) Seven recent releases of widely deployed models: segments under $12\%$ are left unlabeled.

Appendix figures & tables20 assets

Supplementary material from the paper’s appendix.

Appendix

Family	Training Version	Version shift	Access
GPT	GPT-5	GPT-5.2 / GPT-5.4 / GPT-5.6-terra	API
Claude	Opus 4.6	Opus 4.7 / Opus 4.8 / Opus 5	API
Gemini	2.5 Flash	3 Flash / 3.5 Flash / 3.6 Flash	API
Mistral	Small-24B-2501	Small-3.1-24B-2503 / Small-3.2-24B-2506 / small-2603	Local
Llama	Llama-3-70B	Llama-3.1-70B / Llama-3.3-70B / Llama-4-Scout-17B	Local

Appendix

Table 7: Source models of MAABench . The training version is used for ID and Domain shift, and the three held-out versions for Version shift and Joint shift.

Domain	Corpus	Generation Fields	# Seeds
News	XSum 1 1 1 EdinburghNLP/xsum@7d4d486c	Headline	8,500
Wikipedia	Wikipedia EN 2 2 2 wikimedia/wikipedia:20231101.en@b04c8d1c	Title	8,500
Academic	arXiv abstracts 3 3 3 gfissore/arxiv-abstracts-2021@e4c5fbd4	Title, Field	8,500
Product Reviews	Amazon Reviews 2023 4 4 4 McAuley-Lab/Amazon-Reviews-2023@2b6d039e	Product, Category, Rating	8,500
Patents	HUPD 5 5 5 HUPD/hupd@f570a84b	Title, Classification	750
Stack Exchange	Stack Exchange title/body dumps 6 6 6 flax-sentence-embeddings/stackexchange_title_body_jsonl@a3d99bf2	Title, Tags, Community	750

Appendix

Table 8: Human-written text corpus of MAABench . Patents and Stack Exchange are the unseen domains of Domain shift and Joint shift; counts are the seed pool before filtering.

Domain	{output}	System prompt
News	news article	default
Wikipedia	encyclopedia article	default
Academic	research abstract	default
Product Reviews	product review	default
Patents	patent abstract	persona: a patent specialist
Stack Exchange	forum question	persona: a member of an online Q&A community

Appendix

Table 9: Domain-specific prompt substitutions. The four in-distribution domains use the default system prompt and the two unseen domains the persona-based one.

Setting	Pool	Seeds	Gen./seed	Machine	Human	Total
ID (train)	30,000	29,952	5	149,760	29,952	179,712
ID (validation)	2,000	1,998	5	9,990	1,998	11,988
ID (test)	2,000	1,997	5	9,985	1,997	11,982
Domain shift	1,500	1,494	5	7,470	1,494	8,964
Version shift	2,000	1,980	15	29,700	1,980 †	31,680
Joint shift	1,500	1,441	15	21,615	1,441 †	23,056

Appendix

Table 10: Composition of MAABench . Pool is the seed pool before filtering, Seeds the seeds retained after it, and Gen./seed the generations per retained seed. † marks a count reused from an earlier setting: Version shift reuses the in-distribution test seeds, and Joint shift is filtered from the same seed pool as Domain shift and shares all but two of its seeds.

Source	$n$	Mean	Median	p5	p95
GPT	45,704	194.5	198	155	218
Claude	45,704	198.8	199	180	218
Gemini	45,704	192.5	192	162	226
Mistral	45,704	161.8	161	114	215
Llama	45,704	175.9	173	147	214
Human	35,443	166.9	180	96	217

Appendix

Table 11: Length statistics of the retained texts for each model.

Optimizer	AdamW, $\beta=(0.9,0.999)$ , weight decay $0.01$
Learning rate	$1\times 10^{-4}$
Schedule	linear warmup over $5\%$ of steps, then cosine decay to $0$
Gradient clipping	global norm $1.0$
Effective batch	$128$
Epochs	$5$ on MAABench , $3$ on OpenTuringBench
Maximum length	$512$ tokens ( MAABench ), $1024$ (OpenTuringBench)

Appendix

Table 12: Optimization settings. Shared by ATLAS and the supervised baselines.

Method	Representation	Trained part	Prediction
Fast-DetectGPT	one score from a frozen proxy	classifier	logistic regression
Binoculars	one score from two frozen proxies	classifier	logistic regression
GPT-who	surprisal features, one proxy	classifier	logistic regression
Sniffer	pairwise features, four proxies	classifier	MLP
StatEnsemble	eight features (Table 14 )	classifier	MLP
DeTeCtive	LLM2Vec embedding	adapter and head	nearest neighbors

Appendix

Table 13: The MAA baselines. Fixed-feature methods train only a classifier on features from frozen proxy models. Encoder-tuning methods share the LLM2Vec trunk and the schedule of Table 12 .

Feature	Definition
Log-likelihood	the mean log-probability of the written tokens
Perplexity	the negative of the above, the mean token cross-entropy
Rank	the mean rank of the written token, counting from one
Log-rank	the mean of the logarithm of that rank, taken per token
Entropy	the mean next-token entropy, which ignores the written token
LRR	perplexity over log-rank, the statistic of DetectLLM ( Su et al., 2023 )

Appendix

Table 14: Features of StatEnsemble. Every statistic is an average over the scored tokens of a text.

Method	Run	ID		OOD
		ID		Domain		Version		Joint
		Acc	F1	Acc	F1	Acc	F1	Acc	F1
DeTeCtive	Seed 42	99.49	99.49	95.39	95.40	70.12	69.46	62.87	61.54
	Seed 123	99.47	99.47	94.27	94.28	70.46	70.03	63.20	62.76
	Seed 456	99.56	99.56	94.42	94.47	71.22	71.14	63.89	63.60
	Mean	99.51	99.51	94.69	94.72	70.60	70.21	63.32	62.63

Appendix

Table 15: Per-seed MAA performance on MAABench . Accuracy (%,

\uparrow

) and macro-F1 (%,

\uparrow

) of ATLAS and the four encoder-tuning baselines for each of the three random seeds, with their mean and standard deviation. The means are the entries of Table 2 .

Reported as	Task	What changes
ID	E0	Held-out news articles from the training source
E1	E1	Sampling temperature raised to $0.7$ and $1.0$
E2	E2	$\sim$ 70B versions of Llama 3.1 and Qwen 2.5 in place of the 8B and 7B ones seen in training
E3	E3	Each model rewrites its own earlier generations
E4	E4	Human–machine mixing: models revise and continue human-written text
OOD	E5	Essay domain instead of news, about $1{,}000$ essays per model

Appendix

Table 16: OpenTuringBench tasks.

Method	ID					OOD
Method	ID	E1	E2	E3	E4	OOD
Fast-DetectGPT ( Bao et al., 2024 )	14.06	16.79	13.23	17.13	7.76	13.91
Binoculars ( Hans et al., 2024 )	13.41	18.28	13.88	20.88	9.26	19.42
GPT-who ( Venkatraman et al., 2024 )	47.00	16.49	43.80	29.82	6.77	24.25
Sniffer ( Li et al., 2023 )	61.48	18.15	54.94	37.42	7.28	27.68
StatEnsemble ( La Cava et al., 2026 )	61.18	60.58	57.42	63.06	26.13	48.26

Appendix

Table 17: MAA performance on OpenTuringBench (macro-F1). We report macro-F1 (

\uparrow

) for the runs of Table 3 . Best results are in bold , and second-best results are underlined .

Method	Trained	ID		OOD
		ID		Domain		Version		Joint
		TPR	FPR	TPR	FPR	TPR	FPR	TPR	FPR
Fast-DetectGPT ( Bao et al., 2024 )	$\times$	17.31	95.04	24.90	95.78	13.14	96.31	13.35	98.82
Binoculars ( Hans et al., 2024 )	$\times$	26.13	91.29	18.31	83.94	19.75	93.99	11.76	93.48
IRM ( Liu et al., 2025 )	$\times$	18.09	78.27	15.39	90.09	13.25	80.35	10.41	92.85
ReMoDetect ( Lee et al., 2024 )	$\times$	17.65	78.97	31.41	71.95	15.11	82.17	29.72	75.09

Appendix

Table 18: MGT detection on MAABench at fixed operating points. For the runs of Table 4 , we report the true positive rate at a

1\%

false positive rate (TPR,

\uparrow

) and the false positive rate at a

95\%

true positive rate (FPR,

\downarrow

), with MGT as the positive class; Trained marks methods trained on MAABench , as in Table 4 . Best results are in bold .

Up-projection	Scoring	ID	OOD
Up-projection	Scoring	ID	Domain	Version	Joint
shared $B$	mean	99.70	97.51	76.06	66.11
per-source $B_{k}$	mean	99.86	96.91	78.24	66.95
per-source $B_{k}$	clipped	99.64	97.59	82.79	72.07

Appendix

Table 19: Component analysis on all four evaluation settings of MAABench . We report accuracy (

\uparrow

) with

10{,}000

training texts per source family. Up-projection is shared across sources or per source, and Scoring is the mean likelihood or the clipped score. Best results are in bold .

Backbone	ID		OOD
	ID		Domain		Version		Joint
	Acc	F1	Acc	F1	Acc	F1	Acc	F1
Qwen2.5-0.5B	98.32	98.32	88.19	88.28	78.33	78.54	64.98	64.92
Qwen2.5-1.5B	99.01	99.01	96.17	96.18	81.00	81.08	70.28	70.21
Qwen2.5-3B	99.38	99.38	94.59	94.63	82.18	82.20	71.21	71.33
Qwen2.5-7B	99.64	99.64	97.59	97.60	82.79	82.75	72.07	71.78

Appendix

Table 20: Effect of backbone size. We report accuracy (Acc,

\uparrow

) and macro-F1 (F1,

\uparrow

) for Qwen2.5 backbones of four sizes, each trained on

10{,}000

texts per source family; the last row is the change in accuracy from 0.5B to 7B. Best results are in bold .

Backbone	ID		OOD
	ID		Domain		Version		Joint
	Acc	F1	Acc	F1	Acc	F1	Acc	F1
Qwen2.5-7B	99.64	99.64	97.59	97.60	82.79	82.75	72.07	71.78
OLMo-2-7B	99.60	99.60	97.05	97.07	83.75	83.79	72.99	73.07
Qwen3-8B	99.73	99.73	98.09	98.09	83.40	83.26	75.22	74.88

Appendix

Table 21: Effect of backbone family. We report accuracy (Acc,

\uparrow

) and macro-F1 (F1,

\uparrow

) for three backbones of comparable size, each trained on

10{,}000

texts per source family. Best results are in bold .

ID
Method	Training texts per source
Method	1k	3k	5k	10k	15k	full
DeTeCtive ( Guo et al., 2024 )	96.25	98.08	98.52	99.20	99.28	99.49
OTBDetector ( La Cava & Tagarelli, 2025 )	48.64	73.83	81.87	98.29	99.07	99.42
DA-MTL ( Rao et al., 2025 )	95.91	98.34	98.92	99.30	99.41	99.45
Idiosyncrasies ( Sun et al., 2025 )	95.44	98.41	98.90	99.03	99.30	99.52

Appendix

Table 22: Effect of training-data scale. We report accuracy (

\uparrow

) against the number of training texts per source family; the full column of every method is its entry in Table 2 . Best results in each column of a block are in bold .

Panel of Figure 4 — Figure 4: Confusion matrices of ATLAS on MAABench . Each row is a true source family and each column a predicted one; entries are the percentage of the row’s texts, so the diagonal is the per-family recall.

Panel of Figure 5 — Figure 5: Version Shift accuracy by held-out version. Accuracy ( $\uparrow$ ) of ATLAS (solid) and OTBDetector (dashed) on each of the three held-out versions of a family, ordered from the oldest to the newest release; Table 7 lists the versions.

Base model (teacher)
Model	Attribution (%)			Reject (%)
Model	GPT	Claude	Gemini	Reject (%)
000 Qwen3-8B (GPT)	93.6	5.3	1.1	10.6
000 Llama-3.1-8B (GPT)	87.3	11.9	0.8	30.2
000 Qwen3.5-27B (Claude)	5.8	92.9	1.3	1.8
000 Qwen3.5-4B (Claude)	23.0	76.4	0.6	8.0

Appendix

Table 23: Attribution of distilled and deployed models. Share of each model’s texts attributed to each candidate family, in percent. Each validation model is listed by the base model it was fine-tuned from, with the family of the teacher stated, and the most attributed family is in bold . Reject is the share of texts that no condition explains better than the frozen backbone.

Checkpoint	Stated teacher
TeichAI/Qwen3-8B-GPT-5.2-High-Reasoning-Distill 7 7 7 https://huggingface.co/TeichAI/Qwen3-8B-GPT-5.2-High-Reasoning-Distill	GPT-5.2
Jackrong/GPT-5-Distill-llama3.1-8B-Instruct 8 8 8 https://huggingface.co/Jackrong/GPT-5-Distill-llama3.1-8B-Instruct	GPT-5
TeichAI/Qwen3.5-27B-Claude-Opus-4.6-Distill 9 9 9 https://huggingface.co/TeichAI/Qwen3.5-27B-Claude-Opus-4.6-Distill	Claude Opus 4.6
TeichAI/Qwen3.5-4B-Claude-Opus-Reasoning-Distill 10 10 10 https://huggingface.co/TeichAI/Qwen3.5-4B-Claude-Opus-Reasoning-Distill	Claude Opus
TeichAI/Qwen3-30B-A3B-Thinking-2507-Gemini-2.5-Flash-Distill 11 11 11 https://huggingface.co/TeichAI/Qwen3-30B-A3B-Thinking-2507-Gemini-2.5-Flash-Distill	Gemini 2.5 Flash
TeichAI/Qwen3-8B-Gemini-2.5-Flash-Distill 12 12 12 https://huggingface.co/TeichAI/Qwen3-8B-Gemini-2.5-Flash-Distill	Gemini 2.5 Flash

Appendix

Table 24: Validation models for teacher identification. Publicly released checkpoints whose model cards state the teacher they were distilled from.

Authorship Attribution

Authorship attribution identifies or verifies who wrote a text, code sample, or other creative work from patterns in its style and content.

See all 66 papers

Show Me How You Reason and I'll Tell You Who You Are: Reasoning Graphs for Robust LLM Authorship Attribution
Jul 16, 2026Zlata Kikteva, Artur Romazanov, Annette Hautli-Janisz +1AI-Generated Text Detection Authorship Attribution
University of Passau, Germany · University of Dundee, United Kingdom
Who Wrote the Book? Detecting and Attributing LLM Ghostwriters
Mar 30, 2026Anudeex Shetty, Qiongkai Xu, Olga Ohrimenko +1OOD Generalization Language Model Fingerprinting
School of Computing and Information Systems, The University of Melbourne, Australia · School of Computing, FSE, Macquarie University, Australia
Forging LLM Authorship Fingerprints with Targeted Rewriting
Sep 30, 2026Haohan Yuan, Simin Chen, Xi Niu +3Language Model Fingerprinting Adversarial Text Attacks
University of North Carolina at Charlotte · George Mason University · Indiana University

Jul 16, 2026J/K move · Enter open · S save

Show Me How You Reason and I'll Tell You Who You Are: Reasoning Graphs for Robust LLM Authorship Attribution

Zlata Kikteva, Artur Romazanov, Annette Hautli-Janisz, Ramon Ruiz-Dolz

University of Passau, Germany · University of Dundee, United Kingdom

AI-Generated Text Detection Authorship Attribution Language Model Robustness Robustness of Machine-Generated Text Detection

Open paper AskPDF arXiv

Given the current trend to employ large language models (LLMs) in almost any imaginable context, LLM-generated text detection and authorship attribution have become a pressing issue. Prior work has primarily focused on surface-level linguistic features, an approach shown to be susceptible to paraphrasing and other obfuscation techniques. In this paper, we go beyond the linguistic surface, extracting and analysing reasoning structures in LLM-generated texts with the goal of capturing more complex signals of LLM authorship. We propose a graph neural network approach that leverages reasoning graphs extracted by an argument mining pipeline, demonstrating improved robustness and generalisation over a traditional Longformer baseline. Our approach outperforms the baseline by up to 27 percentage points under the obfuscation attacks such as paraphrasing and backtranslation, and 19 percentage points when evaluated on the texts generated by the unseen model versions, simulating real-world conditions in which new LLM versions are continuously released.

Abstract

Authorship Attribution

Explore similar work

Show Me How You Reason and I'll Tell You Who You Are: Reasoning Graphs for Robust LLM Authorship Attribution

Who Wrote the Book? Detecting and Attributing LLM Ghostwriters

Forging LLM Authorship Fingerprints with Targeted Rewriting