{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/red-teaming-language-model-detectors-with","title":"Red Teaming Language Model Detectors with Language Models","arxiv_id":"2305.19713","date":"2023-05-31","proceeding":null,"authors":["Zhouxing Shi","Yihan Wang","Fan Yin","Xiangning Chen","Kai-Wei Chang","Cho-Jui Hsieh"],"abstract":"The prevalence and strong capability of large language models (LLMs) present significant safety and ethical risks if exploited by malicious users. To prevent the potentially deceptive usage of LLMs, recent works have proposed algorithms to detect LLM-generated text and protect LLMs. In this paper, we investigate the robustness and reliability of these LLM detectors under adversarial attacks. We study two types of attack strategies: 1) replacing certain words in an LLM's output with their synonyms given the context; 2) automatically searching for an instructional prompt to alter the writing style of the generation. In both strategies, we leverage an auxiliary LLM to generate the word replacements or the instructional prompt. Different from previous works, we consider a challenging setting where the auxiliary LLM can also be protected by a detector. Experiments reveal that our attacks effectively compromise the performance of all detectors in the study with plausible generations, underscoring the urgent need to improve the robustness of LLM-generated text detection systems.","url_abs":"https://arxiv.org/abs/2305.19713v2","url_pdf":"https://arxiv.org/pdf/2305.19713v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"red-teaming-language-model-detectors-with","repo_url":"https://github.com/shizhouxing/Attack-LM-Detectors","is_official":1,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"BSD-3-Clause"}},{"paper_slug":"red-teaming-language-model-detectors-with","repo_url":"https://github.com/shizhouxing/LLM-Detector-Robustness","is_official":0,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"BSD-3-Clause"}}],"tasks":[{"task_slug":"adversarial-robustness","task_name":"Adversarial Robustness"},{"task_slug":"llm-generated-text-detection","task_name":"LLM-generated Text Detection"},{"task_slug":"language-modeling","task_name":"Language Modeling"},{"task_slug":"language-modelling","task_name":"Language Modelling"},{"task_slug":"red-teaming","task_name":"Red Teaming"},{"task_slug":"text-detection","task_name":"Text Detection"},{"task_slug":"model","task_name":"model"}],"methods":[{"method_slug":"test","method_name":"Test"}],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2305.19713","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2305.19713"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/shizhouxing/LLM-Detector-Robustness","reach":{"status":"ok","spdx":"BSD-3-Clause"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/shizhouxing/Attack-LM-Detectors","reach":{"status":"ok","spdx":"BSD-3-Clause"}}],"summary":{"ran_violates":1,"unverified":17},"by_repo_kind":{"official":{"samples":13,"ran":0,"repositories":1},"named_in_paper":{"samples":5,"ran":1,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"678874b625786116","entry":"str2bool","repo":"shizhouxing/LLM-Detector-Robustness","repo_kind":"named_in_paper","path":"lm_watermarking/demo_watermark.py","file_url":"https://github.com/shizhouxing/LLM-Detector-Robustness/blob/HEAD/lm_watermarking/demo_watermark.py","link_basis":"plan_row","language":"python","status":"ran_violates","verification_level":1,"contract_check":"VIOLATES","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"BSD-3-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"678874b625786116"}},{"code_sha256_prefix":"021e54e68430a412","entry":"clip","repo":"shizhouxing/Attack-LM-Detectors","repo_kind":"official","path":"utils.py","file_url":"https://github.com/shizhouxing/Attack-LM-Detectors/blob/HEAD/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"BSD-3-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"021e54e68430a412"}},{"code_sha256_prefix":"23c3416429f69fee","entry":"count_masks","repo":"shizhouxing/LLM-Detector-Robustness","repo_kind":"named_in_paper","path":"DetectGPT/run_attack.py","file_url":"https://github.com/shizhouxing/LLM-Detector-Robustness/blob/HEAD/DetectGPT/run_attack.py","link_basis":"plan_row","language":"python","status":"unverified","verification_level":0,"contract_check":"OPAQUE_PARAMS","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"BSD-3-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"23c3416429f69fee"}},{"code_sha256_prefix":"a69e4a6bacf133b7","entry":"generate_attack_with_T5","repo":"shizhouxing/Attack-LM-Detectors","repo_kind":"official","path":"lm_watermarking/demo_watermark.py","file_url":"https://github.com/shizhouxing/Attack-LM-Detectors/blob/HEAD/lm_watermarking/demo_watermark.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"BSD-3-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"a69e4a6bacf133b7"}},{"code_sha256_prefix":"480e7079dc543792","entry":"get_chatgpt_response","repo":"shizhouxing/Attack-LM-Detectors","repo_kind":"official","path":"openai_adapters.py","file_url":"https://github.com/shizhouxing/Attack-LM-Detectors/blob/HEAD/openai_adapters.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"BSD-3-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"480e7079dc543792"}},{"code_sha256_prefix":"9420861d60bd47e5","entry":"get_chatgpt_response_content","repo":"shizhouxing/Attack-LM-Detectors","repo_kind":"official","path":"openai_adapters.py","file_url":"https://github.com/shizhouxing/Attack-LM-Detectors/blob/HEAD/openai_adapters.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"BSD-3-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"9420861d60bd47e5"}},{"code_sha256_prefix":"5d5e9dfd7e7d9a52","entry":"get_post","repo":"shizhouxing/Attack-LM-Detectors","repo_kind":"official","path":"prompt_attack.py","file_url":"https://github.com/shizhouxing/Attack-LM-Detectors/blob/HEAD/prompt_attack.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"BSD-3-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"5d5e9dfd7e7d9a52"}},{"code_sha256_prefix":"3e92d9232d362c91","entry":"llama_parse_response","repo":"shizhouxing/Attack-LM-Detectors","repo_kind":"official","path":"DetectGPT/llama_adapters.py","file_url":"https://github.com/shizhouxing/Attack-LM-Detectors/blob/HEAD/DetectGPT/llama_adapters.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"BSD-3-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"3e92d9232d362c91"}},{"code_sha256_prefix":"dcf5648ead0be9bd","entry":"load_data","repo":"shizhouxing/Attack-LM-Detectors","repo_kind":"official","path":"utils.py","file_url":"https://github.com/shizhouxing/Attack-LM-Detectors/blob/HEAD/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"BSD-3-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"dcf5648ead0be9bd"}},{"code_sha256_prefix":"14beed14f0519675","entry":"load_pubmed","repo":"shizhouxing/LLM-Detector-Robustness","repo_kind":"named_in_paper","path":"DetectGPT/custom_datasets.py","file_url":"https://github.com/shizhouxing/LLM-Detector-Robustness/blob/HEAD/DetectGPT/custom_datasets.py","link_basis":"plan_row","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"BSD-3-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"14beed14f0519675"}},{"code_sha256_prefix":"61878b201ba3201c","entry":"openai_ai_text_detect","repo":"shizhouxing/Attack-LM-Detectors","repo_kind":"official","path":"openai_adapters.py","file_url":"https://github.com/shizhouxing/Attack-LM-Detectors/blob/HEAD/openai_adapters.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"BSD-3-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"61878b201ba3201c"}},{"code_sha256_prefix":"2617eae32424f5e1","entry":"parse_mapping","repo":"shizhouxing/Attack-LM-Detectors","repo_kind":"official","path":"DetectGPT/openai_perturbations.py","file_url":"https://github.com/shizhouxing/Attack-LM-Detectors/blob/HEAD/DetectGPT/openai_perturbations.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"BSD-3-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"2617eae32424f5e1"}},{"code_sha256_prefix":"0c125fa85591bb34","entry":"parse_response","repo":"shizhouxing/Attack-LM-Detectors","repo_kind":"official","path":"DetectGPT/openai_perturbations.py","file_url":"https://github.com/shizhouxing/Attack-LM-Detectors/blob/HEAD/DetectGPT/openai_perturbations.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"BSD-3-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"0c125fa85591bb34"}},{"code_sha256_prefix":"a9123b58146ec27b","entry":"process_prompt","repo":"shizhouxing/Attack-LM-Detectors","repo_kind":"official","path":"DetectGPT/custom_datasets.py","file_url":"https://github.com/shizhouxing/Attack-LM-Detectors/blob/HEAD/DetectGPT/custom_datasets.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"BSD-3-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"a9123b58146ec27b"}},{"code_sha256_prefix":"2b3a1c3191857159","entry":"process_spaces","repo":"shizhouxing/Attack-LM-Detectors","repo_kind":"official","path":"DetectGPT/custom_datasets.py","file_url":"https://github.com/shizhouxing/Attack-LM-Detectors/blob/HEAD/DetectGPT/custom_datasets.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"BSD-3-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"2b3a1c3191857159"}},{"code_sha256_prefix":"c3a40e446ef9f89c","entry":"read_text","repo":"shizhouxing/Attack-LM-Detectors","repo_kind":"official","path":"utils.py","file_url":"https://github.com/shizhouxing/Attack-LM-Detectors/blob/HEAD/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"BSD-3-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"c3a40e446ef9f89c"}},{"code_sha256_prefix":"11e5b3fc9bdba4a4","entry":"replace_masks","repo":"shizhouxing/LLM-Detector-Robustness","repo_kind":"named_in_paper","path":"DetectGPT/run_attack.py","file_url":"https://github.com/shizhouxing/LLM-Detector-Robustness/blob/HEAD/DetectGPT/run_attack.py","link_basis":"plan_row","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"BSD-3-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"11e5b3fc9bdba4a4"}},{"code_sha256_prefix":"374e995ebc355414","entry":"tokenize_and_mask","repo":"shizhouxing/LLM-Detector-Robustness","repo_kind":"named_in_paper","path":"DetectGPT/run_attack.py","file_url":"https://github.com/shizhouxing/LLM-Detector-Robustness/blob/HEAD/DetectGPT/run_attack.py","link_basis":"plan_row","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"BSD-3-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"374e995ebc355414"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}