Existing evasion attacks can fool standard machine-text detectors, but they do not remove the stylistic fingerprint of machine-generated text. As a result, detectors that leverage style remain robust. We show that it is possible to construct a style-aware paraphrasing attack that jointly optimizes for undetectability and alignment with a target author’s style, evading all detectors when detection relies on a single document. However, when multiple documents are aggregated, the human and machine distributions separate again.</p>\n","updatedAt":"2026-06-16T23:06:09.924Z","author":{"_id":"6434f41795b8ab04938dcf48","avatarUrl":"https://cdn-avatars.huggingface.co/v1/production/uploads/6434f41795b8ab04938dcf48/DHQTRQ-SsTTrF1CYPfSW1.jpeg","fullname":"Rafael","name":"rrivera1849","type":"user","isPro":false,"isHf":false,"isHfAdmin":false,"isMod":false,"followerCount":3,"isUserFollowing":false}},"numEdits":0,"identifiedLanguage":{"language":"en","probability":0.8526856899261475},"editors":["rrivera1849"],"editorAvatarUrls":["https://cdn-avatars.huggingface.co/v1/production/uploads/6434f41795b8ab04938dcf48/DHQTRQ-SsTTrF1CYPfSW1.jpeg"],"reactions":[],"isReport":false}}],"primaryEmailConfirmed":false,"paper":{"id":"2505.14608","authors":[{"_id":"683ff2faf43eda6f39bd78b0","user":{"_id":"6434f41795b8ab04938dcf48","avatarUrl":"https://cdn-avatars.huggingface.co/v1/production/uploads/6434f41795b8ab04938dcf48/DHQTRQ-SsTTrF1CYPfSW1.jpeg","isPro":false,"fullname":"Rafael","user":"rrivera1849","type":"user","name":"rrivera1849"},"name":"Rafael Rivera Soto","status":"claimed_verified","statusLastChangedAt":"2026-06-15T13:25:18.833Z","hidden":false},{"_id":"683ff2faf43eda6f39bd78b1","name":"Barry Chen","hidden":false},{"_id":"683ff2faf43eda6f39bd78b2","user":{"_id":"666a838f71a81dca8d5dc97e","avatarUrl":"/avatars/38792103ebf3cdb7733bb6258930193e.svg","isPro":false,"fullname":"Nicholas Andrews","user":"noandrews","type":"user","name":"noandrews"},"name":"Nicholas Andrews","status":"extracted_confirmed","statusLastChangedAt":"2025-06-22T20:15:25.701Z","hidden":false}],"publishedAt":"2026-06-08T00:00:00.000Z","submittedOnDailyAt":"2026-06-16T00:00:00.000Z","title":"Attacks on Machine-Text Detectors Retain Stylistic Fingerprints","submittedOnDailyBy":{"_id":"6434f41795b8ab04938dcf48","avatarUrl":"https://cdn-avatars.huggingface.co/v1/production/uploads/6434f41795b8ab04938dcf48/DHQTRQ-SsTTrF1CYPfSW1.jpeg","isPro":false,"fullname":"Rafael","user":"rrivera1849","type":"user","name":"rrivera1849"},"summary":"Despite considerable progress in the development of machine-text detectors, the ease with which machine-text can be manipulated to evade detection has led to suggestions that the problem is inherently intractable. In this work, we investigate the limits of such evasion strategies. We demonstrate that while current attacks, ranging from prompt engineering to detector-guided optimization can effectively degrade performance of standard detectors, they fail to erase the underlying stylistic \"fingerprints\" of machine text. We show that few-shot detectors that utilize the stylistic feature space are robust to these evasion attempts, reliably detecting samples even from models explicitly tuned to prevent detection. This raises the question: does style represent a universal defense against machine-detection attacks? We demonstrate that the answer is \"no'' by introducing a novel paraphrasing approach that simultaneously optimizes for undetectability and adherence to specific human styles. We show that unlike prior methods, this attack effectively evades all considered detectors, including those that utilize writing style. However, we find that this evasion is not absolute: as the number of documents available for analysis grows, the human and machine distributions become distinguishable again. Overall, our findings suggest that reliable machine-text detection requires moving beyond single-document analysis to multi-document analysis.","upvotes":1,"discussionId":"683ff2fbf43eda6f39bd78ec","githubRepo":"https://github.com/rrivera1849/style-aware-paraphrasing","githubRepoAddedBy":"user","ai_summary":"Machine-text detection remains challenging despite evasion techniques, but stylistic features can provide robust defense when analyzed across multiple documents rather than individual instances.","ai_keywords":["machine-text detectors","evasion strategies","prompt engineering","detector-guided optimization","few-shot detectors","stylistic fingerprints","paraphrasing approach","multi-document analysis"],"ai_summary_model":"Qwen/Qwen2.5-Coder-32B-Instruct","githubStars":2},"canReadDatabase":false,"canManagePapers":false,"canSubmit":false,"hasHfLevelAccess":false,"upvoted":false,"upvoters":[{"_id":"6434f41795b8ab04938dcf48","avatarUrl":"https://cdn-avatars.huggingface.co/v1/production/uploads/6434f41795b8ab04938dcf48/DHQTRQ-SsTTrF1CYPfSW1.jpeg","isPro":false,"fullname":"Rafael","user":"rrivera1849","type":"user"}],"acceptLanguages":["en"],"dailyPaperRank":0,"markdownContentUrl":"https://huggingface.co/buckets/huggingchat/papers-content/resolve/2505/2505.14608.md","query":{}}">
Attacks on Machine-Text Detectors Retain Stylistic Fingerprints
Published on Jun 8
· Submitted by Rafael on Jun 16 Abstract
Machine-text detection remains challenging despite evasion techniques, but stylistic features can provide robust defense when analyzed across multiple documents rather than individual instances.
Despite considerable progress in the development of machine-text detectors, the ease with which machine-text can be manipulated to evade detection has led to suggestions that the problem is inherently intractable. In this work, we investigate the limits of such evasion strategies. We demonstrate that while current attacks, ranging from prompt engineering to detector-guided optimization can effectively degrade performance of standard detectors, they fail to erase the underlying stylistic "fingerprints" of machine text. We show that few-shot detectors that utilize the stylistic feature space are robust to these evasion attempts, reliably detecting samples even from models explicitly tuned to prevent detection. This raises the question: does style represent a universal defense against machine-detection attacks? We demonstrate that the answer is "no'' by introducing a novel paraphrasing approach that simultaneously optimizes for undetectability and adherence to specific human styles. We show that unlike prior methods, this attack effectively evades all considered detectors, including those that utilize writing style. However, we find that this evasion is not absolute: as the number of documents available for analysis grows, the human and machine distributions become distinguishable again. Overall, our findings suggest that reliable machine-text detection requires moving beyond single-document analysis to multi-document analysis.
Community
Existing evasion attacks can fool standard machine-text detectors, but they do not remove the stylistic fingerprint of machine-generated text. As a result, detectors that leverage style remain robust. We show that it is possible to construct a style-aware paraphrasing attack that jointly optimizes for undetectability and alignment with a target author’s style, evading all detectors when detection relies on a single document. However, when multiple documents are aggregated, the human and machine distributions separate again.
Upload images, audio, and videos by dragging in the text input, pasting, or clicking here.
Tap or paste here to upload images
Cite arxiv.org/abs/2505.14608 in a Space README.md to link it from this page.
Discussion (0)
Sign in to join the discussion. Free account, 30 seconds — email code or GitHub.
Sign in →No comments yet. Sign in and be the first to say something.