How many detector queries does an imitator need to evade a human-vs-machine text detector it cannot read?
research/mimic-blackbox
How many detector queries does an imitator need to evade a word n-gram human-vs-machine detector it cannot read? About 100 score queries per text, deleting the 20 best word types, take held-out AUROC from 0.948 to 0.520 (white-box 0.487); blind deletion does nothing. Stylised, no fluency check.
What it found
The word 1-2 gram detector of mimic-whitebox (held-out AUROC 0.948) is attacked by an imitator that sees only the score of each text it submits. It deletes each of Q candidate word types in turn, reads the score drop and removes the k largest. With k=20, 25 queries per text give AUROC 0.873, 50 give 0.722 and about 95 give 0.520, against 0.487 for the white-box attack that reads the weights; blind deletion (0 queries) changes nothing. Stylised and preliminary: a linear detector, one seed, no fluency check on the edited text, and no retraining of the detector against the attack.
A figure from its own output
Paper, code and results
More in Adversarial human imitation
- Does refitting a human-vs-machine text detector on attacked text stop a black-box evader?Does refitting a text detector on attacked text stop a black-box evader? It settles after one refit: fresh-attack AUROC stays near 0.81 (from 0.719) while clean AUROC falls from 0.948 to about 0.90. Stylised, no fluency check.
- Does a prompt-free human-vs-machine detector carry over to a generator or decoding it never saw?Does a prompt-free detector carry over to a generator or decoding it never saw? The
mimic-contextsn-gram detector loses 0.01 to 0.02 AUROC on a chat model left out of the fit (0.96 to 0.98 left out) and 0.025 to 0.05 on a left-out decoding (sampling 0.936); averaging over four same-source texts lifts AUROC to 0.999. Preliminary, plain-prompt RAID text only. - Does adding a zero-shot perplexity score to the n-gram detector help it catch machine text in families it never saw?Does adding a zero-shot perplexity score to the n-gram detector help on unseen families? The two scores are uncorrelated within class, but averaging them lifts held-out AUROC only from 0.926 to 0.935 (paired gain +0.009, interval −0.010 to +0.026); fitted stacks do no better. Preliminary, 720 held-out texts, small scorer, no LLM run.
- How much text does a prompt-free human-vs-machine detector need, and what does it key on?How much text does a prompt-free detector need, and what does it key on? The
mimic-contextsn-gram detector on held-out families: AUROC 0.65 at 50 characters, 0.84 at 400, 0.93 at 1500; stripping punctuation or shuffling words costs at most 0.014. Preliminary, plain-prompt RAID text only. - If a human-vs-machine detector's threshold is set for a 5% false-positive rate, does that rate hold on a kind of text it never saw?If a detector's threshold is set for a 5% false-positive rate, does it hold on an unseen text type? Leave-one-family-out with the
mimic-contextsn-gram detector: realised rate 0.00 to 0.54 (abstracts 0.54, books 0.18), and recipes catch 1.7% of machine text. Preliminary, plain-prompt RAID text only. - How many human texts does it take to re-set a detector's threshold for a 5% false-positive rate on a new kind of text?How many human texts does it take to re-set a detector's threshold for a 5% false-positive rate on a new kind of text? About 80: with the plain 95th percentile k = 20 gives a mean false-positive rate of 9% (36% chance above 10%), k = 80 gives 6.1%; a conformal rule holds 4.9% but costs recall and needs 19+ texts. Stylised, RAID text, one n-gram detector.
All 41 Adversarial human imitation projects →
Other research topics
Proper scoring & elicitation28Effort & peer prediction9Verification games & slashing19Detection & tolerances14Markets as routers13Prediction-market design9Paying contributors8Decentralised training systems23Digital twins & sim-to-real164LLM chip design loops40Robot manufacturing loops53Ambient AI assistant46Self-replicating manufacturing34Simulation-first design64Engineered clothing45Task-specific AI accelerators40Algorithmic chip-design loops42Open-source purpose-built robots44The software-engineering loop43Adversarial human imitation41Open-source residential construction41Autonomous multi-angle capture34Sensing, imaging and 3D31Energy supply and dense energy storage39Robot societies among people31Agentic co-design of low-cost robots27Laundry-hanging robots25Machine learning on qualitative data23Robots on the building site27Civilizations & group psychology1History & human sciences1
Produced with AI assistance (Claude). Results are from the code in this repository and are simulated or stylised unless the abstract says otherwise; nothing here implies affiliation with or endorsement by any lab, researcher or company cited. MIT licensed.