Paper deep dive

ARB: A Matched Authorship-Rewriting Benchmark Dataset for AI-Text Detector Evaluation

Gaetano Perrone, Simon Pietro Romano

Year: 2026Venue: arXiv preprintArea: cs.CLType: PreprintEmbeddings: 123

Intelligence

Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 95%

Last extracted: 8/3/2026, 3:07:29 AM

Summary

The paper introduces the Authorship-Rewriting Benchmark (ARB), a dataset designed to evaluate AI-text detectors under matched authorship and rewriting regimes. It contrasts human-written text, direct LLM generation, LLM-rewritten human text (H2L), and LLM-rewritten LLM text (LLM2L). Results indicate that while detectors perform well on direct LLM text, their recall drops significantly when human text is rewritten by an LLM, suggesting standard benchmarks overestimate robustness to AI-mediated rewriting.

Entities (20)

ARB · benchmark · 98%BERT-Defense · detector · 95%Binoculars-falcon-7b · detector · 95%FastDetectGPT · detector · 95%FREE-LLM · regime · 95%Gaetano Perrone · author · 95%Gemma-2-9B · model · 95%H2L · regime · 95%HUMAN · regime · 95%Llama-3.2-3B · model · 95%LLM2L · regime · 95%Mistral-7B · model · 95%OpenWebText · dataset · 95%Qwen2.5-7B · model · 95%RADAR · detector · 95%RoBERTa-Defense · detector · 95%Simon Pietro Romano · author · 95%University of Napoli Federico II · organization · 95%WritingPrompts · dataset · 95%XSUM · dataset · 95%

Relation Signals (18)

Simon Pietro Romano → affiliatedwith → University of Napoli Federico II

confidence 95% · Simon Pietro Romano a ... Department of Electrical Engineering and Information Technology, University of Napoli Federico II

Gaetano Perrone → affiliatedwith → University of Napoli Federico II

confidence 95% · Gaetano Perrone a,∗ ... Department of Electrical Engineering and Information Technology, University of Napoli Federico II

ARB → definesregime → HUMAN

confidence 95% · Each source item yields four matched variants: human-written (HUMAN)...

ARB → definesregime → LLM2L

confidence 95% · Each source item yields four matched variants: ... and same-generator LLM-rewritten LLM text (LLM2L).

ARB → definesregime → H2L

confidence 95% · Each source item yields four matched variants: ... LLM-rewritten human text (H2L)...

ARB → definesregime → FREE-LLM

confidence 95% · Each source item yields four matched variants: ... direct LLM generation (Free-LLM)...

RADAR → evaluatedon → ARB

confidence 95% · We evaluated five detectors (...RADAR...) ... at a strict 1%-false-positive operating point

FastDetectGPT → evaluatedon → ARB

confidence 95% · We evaluated five detectors (FastDetectGPT...) ... at a strict 1%-false-positive operating point

Cypher Suggestions (0)

No Cypher suggestions yet.

Abstract

Abstract:Standard AI-text detection benchmarks compare human-written text against text generated directly by large language models (LLMs). While prior work has shown that rewriting and paraphrasing can degrade detector performance, it remains unclear whether performance measured on this conventional benchmark predicts detector behavior when human-authored content is rewritten by an LLM. To address this gap, we introduce Authorship-Rewriting Benchmark (ARB), built from 1,800 human source texts (600 each from XSum, WritingPrompts, and OpenWebText) and four open-weight generators (Llama-3.2-3B, Qwen2.5-7B, Mistral-7B, Gemma-2-9B). Each source item yields four matched variants: human-written (HUMAN), direct LLM generation (Free-LLM), LLM-rewritten human text (H2L), and same-generator LLM-rewritten LLM text (LLM2L). We evaluated five detectors (FastDetectGPT, Binoculars-falcon-7b, RADAR, BERT-Defense, RoBERTa-Defense) at a strict 1%-false-positive operating point (TPR@1%FPR). FastDetectGPT and Binoculars-falcon-7b detected 91.2% and 93.5\% of direct LLM text, but only 30.8% and 15.1% of human text an LLM had rewritten, a drop of 60-78 percentage points. The same detectors retained 78.3% and 83.0% recall when LLM text was rewritten by the same model, a much smaller decline of 10-13 points. RADAR followed the same pattern (66.8% to 12.2%), while BERT-Defense and RoBERTa-Defense stayed below 3% recall across all regimes. These results show that detector performance measured on the conventional human-vs-LLM benchmark does not transfer to human-authored text revised by an LLM, even though the same detectors remain largely robust to LLM-only rewriting.

PDF

Open source PDF →Open local PDF →

Trouble viewing inline? Open PDF directly →

Full Text

121,799 characters extracted from source content.

Expand or collapse full text

Highlights ARB: A Matched Authorship-Rewriting Benchmark Dataset for AI-Text Detector Evaluation Gaetano Perrone, Simon Pietro Romano • New four-regime benchmark separates AI-authorship from AI-mediated rewriting • Top detectors reach 91-94% recall on direct AI-generated text • Detector recall falls to 15-31% when human text is AI-rewritten. • Rewriting AI text with the same model keeps recall near 78-83%. • Standard human-vs-AI benchmarks overestimate robustness to AI rewriting. arXiv:2607.29539v1 [cs.CL] 31 Jul 2026 ARB: A Matched Authorship-Rewriting Benchmark Dataset for AI-Text Detector Evaluation Gaetano Perrone a,∗ , Simon Pietro Romano a a Department of Electrical Engineering and Information Technology, University of Napoli Federico I, Via Claudio 21, Naples, 80125, Italy A R T I C L E I N F O Keywords: AI-text detection quantitative benchmarking large language models authorship regimes rewriting robustness low false-positive evaluation A B S T R A C T Standard AI-text detection benchmarks compare human-written text against text generated directly by large language models (LLMs). While prior work has shown that rewriting and paraphrasing can degrade detector performance, it remains unclear whether performance mea- sured on this conventional benchmark predicts detector behavior when human-authored content is rewritten by an LLM. To address this gap, we introduce ARB: Authorship-Rewriting Benchmark, built from 1,800 human source texts (600 each from XSum, WritingPrompts, and OpenWebText) and four open-weight generators (Llama-3.2-3B, Qwen2.5-7B, Mistral-7B, Gemma-2-9B). Each source item yields four matched variants: human-written (HUMAN), direct LLM generation (FREE-LLM), LLM-rewritten human text (H2L), and same-generator LLM- rewritten LLM text (LLM2L). We evaluated five detectors (FastDetectGPT, Binoculars-falcon- 7b, RADAR, BERT-Defense, RoBERTa-Defense) at a strict 1%-false-positive operating point (TPR@1%FPR). FastDetectGPT and Binoculars-falcon-7b detected 91.2% and 93.5% of direct LLM text, but only 30.8% and 15.1% of human text an LLM had rewritten, a drop of 60–78 percentage points. The same detectors retained 78.3% and 83.0% recall when LLM text was rewritten by the same model, a much smaller decline of 10–13 points. RADAR followed the same pattern (66.8% to 12.2%), while BERT-Defense and RoBERTa-Defense stayed below 3% recall across all regimes. These results show that detector performance measured on the conventional human-vs-LLM benchmark does not transfer to human-authored text revised by an LLM, even though the same detectors remain largely robust to LLM-only rewriting. 1. Introduction Large language models (LLMs) are nowadays used in a broad range of writing workflows, including drafting, rewriting, summarization, polishing, and style transfer. Their downstream use is not limited to free-form generation but also includes assisted composition and the transformation of existing text (Yang et al., 2024). AI-text detection, however, is still often evaluated as a binary problem: distinguishing human-written text from text generated directly by a model (Gehrmann et al., 2019; Ippolito et al., 2020; Mitchell et al., 2023; Li et al., 2024). This standard benchmark is a necessary baseline, but it is incomplete as an empirical test of detector robustness. This paper therefore addresses a benchmark-validity question rather than only a paraphrase-robustness question. The core limitation is that standard HUMAN vs. LLM benchmarks conflate two factors. The first is content origin: whether the ideas, facts, discourse structure, and semantic content originate from a human author or from an LLM. The second is linguistic surface: whether the final wording is human-written, freely generated by an LLM, or mediated by an LLM through rewriting. These factors can diverge in realistic workflows. A student, journalist, analyst, or software engineer may write an initial draft and then use an LLM to improve fluency. In that case, the final text has human-origin content but an LLM-mediated surface. Conversely, an LLM-generated text may be passed again through the same LLM while remaining LLM-origin. A detector score may therefore reflect direct machine authorship, machine-mediated rewriting, domain artifacts, decoding artifacts, generator-specific cues, or interactions among these signals. Paraphrase-oriented benchmarks have shown that rewriting, humanization, and adversarial transformation can substantially degrade detector performance (Krishna et al., 2023; Sadasivan et al., 2025; Pu et al., 2023; Shi et al., 2024; Masrour et al., 2025). Benchmarks that include human paraphrases, LLM paraphrases, or mixed human–machine text confirm this pattern at scale (Lau and Zubiaga, 2025; Wang et al., 2024a; Wu et al., 2024; Zha et al., 2025). Large- scale evaluations further show that detector performance varies with generator family, domain, language, and attack ∗ Corresponding author gaetano.perrone@unina.it (G. Perrone) ORCID(s): 0000-0001-7511-2910 (G. Perrone) First Author et al.: Preprint submitted to ElsevierPage 1 of 27 ARB-Dataset type (Wang et al., 2024b; Dugan et al., 2024; Li et al., 2024; Ayoobi et al., 2025; Stowe and Patil, 2026). These works establish that paraphrasing and rewriting can break detectors, but they primarily evaluate detector degradation under transformed text. They do not directly test whether performance measured on the conventional HUMAN vs. FREE-LLM benchmark transfers uniformly across matched authorship–surface regimes. The main empirical contribution is therefore not another demonstration that rewriting degrades detectors, but evidence that performance measured under the conventional HUMAN vs. FREE-LLM benchmark does not transfer uniformly to matched LLM-mediated rewriting regimes. ARB: Authorship-Rewriting Benchmark operationally contrasts content-origin and LLM-mediated surface regimes under a matched benchmark-transfer design. It does not estimate a pure causal effect of source origin. Each matched source item anchors a HUMAN reference, a direct FREE-LLM generation, a human-origin LLM-mediated rewrite (H2L), and a same-generator second-pass rewrite of the corresponding LLM output (LLM2L). This design turns rewriting from a generic attack condition into a diagnostic comparison: if H2L degrades while LLM2L remains close to FREE-LLM, then the conventional direct-generation benchmark is not a reliable proxy for human-origin LLM- mediated writing. We evaluate performance primarily at a conservative low-false-positive operating point, with global ranking separability as a secondary view, since false positives on human-authored or human-origin text can be costly in educational, scientific, and organizational settings (Liang et al., 2023; Kirchner et al., 2023). The remainder of the paper is organized as follows. Section 2 states the research objectives and contributions. Section 3 reviews prior work on AI-text detection, rewriting robustness, benchmark confounding, and low-false- positive evaluation, and situates the objectives relative to the closest existing benchmarks. Section 4 describes the matched four-regime benchmark design. Section 5 defines the evaluated detector families, metrics, block-level estimation procedure, paired deltas, and uncertainty analysis. Section 6 reports the empirical results across regimes, detectors, datasets, and generators, addressing the research objectives directly. Section 7 discusses the implications for detector robustness and benchmark design, including threats to validity and ethical considerations. The paper then concludes with the main findings and recommendations. 2. Research Objectives The basic objective of this work is to test whether detector performance measured under the conventional HUMAN vs. FREE-LLM benchmark is a valid proxy for detector performance under LLM-mediated rewriting, and to do so with a design that separates content origin (human- or LLM-authored) from linguistic surface (direct generation or LLM- mediated rewriting) rather than conflating them into a single “rewritten” class. The objectives are stated as follows: • Determine whether performance estimated under direct-generation (HUMAN vs. FREE-LLM) benchmarking trans- fers to matched LLM-mediated rewriting regimes, or whether it overestimates robustness. • Design a matched four-regime benchmark, anchored to shared source items within dataset–generator blocks, that isolates human-origin LLM-mediated rewriting (H2L) from same-generator LLM-origin second-pass rewriting (LLM2L). • Quantify the operational H2L–LLM2L gap at a fixed, conservative low-false-positive operating point, alongside global ranking separability, and establish whether the gap is attributable to source origin, transformation strength, or both. • Characterize how detector robustness varies across detector families, dataset domains, and generator models, so that conclusions are reported as stratified, block-level estimates rather than single aggregate scores. ARB: Authorship-Rewriting Benchmark is the benchmark developed to meet these objectives. It operationally contrasts content-origin and LLM-mediated surface regimes under a matched benchmark-transfer design; it does not estimate a pure causal effect of source origin. Each matched source item anchors a HUMAN reference, a direct FREE- LLM generation, a human-origin LLM-mediated rewrite (H2L), and a same-generator second-pass rewrite of the corresponding LLM output (LLM2L). This design turns rewriting from a generic attack condition into a diagnostic comparison: if H2L degrades while LLM2L remains close to FREE-LLM, then the conventional direct-generation benchmark is not a reliable proxy for human-origin LLM-mediated writing. Performance is evaluated primarily at a conservative low-false-positive operating point, with global ranking separability as a secondary view, since First Author et al.: Preprint submitted to ElsevierPage 2 of 27 ARB-Dataset false positives on human-authored or human-origin text can be costly in educational, scientific, and organizational settings (Liang et al., 2023; Kirchner et al., 2023). The main contributions of this work are as follows: • Conceptual contribution: a benchmark-transfer framing for AI-text detector evaluation, separating content origin from linguistic surface instead of pooling all LLM-involved text into one class. • Design contribution: a matched four-regime authorship–surface design with HUMAN, FREE-LLM, H2L, and same- generator LLM2L across XSum, WritingPrompts, and OpenWebText. • Evaluation contribution: block-level paired deltas, macro-averaging, bootstrap confidence intervals, and TPR@1%FPR as the primary operating endpoint, alongside AUROC. • Empirical contribution: evidence that strong detectors retain high low-FPR recall on LLM2L but degrade sharply on H2L, showing that the standard HUMAN vs. FREE-LLM benchmark overestimates robustness for human-origin LLM-mediated writing. • Diagnostic contribution: textual transformation analysis and detector-, dataset-, and generator-level heterogeneity results showing that the operational H2L–LLM2L gap is associated with both source origin and transformation strength, and is not uniform across detector families. ARB is designed to advance current AI-text detection benchmarking by jointly combining matched source items across four regimes, a same-generator LLM2L control, paired block-level deltas, a shared HUMAN reference, and a benchmark-transfer framing evaluated under a strict low-FPR endpoint; Section 3.4 positions this design against the closest prior benchmarks once they have been reviewed. Unlike paraphrase-robustness and humanization studies that report detector degradation under a single rewriting attack, ARB treats rewriting as two distinct, matched authorship– surface conditions and asks whether a benchmark built on one condition (FREE-LLM) predicts performance on the other (H2L, LLM2L). This contributes toward a more precise account of when, and for whom, AI-text detectors remain reliable. Section 6 addresses these objectives directly: it first establishes baseline detectability under HUMAN vs. FREE- LLM, then quantifies degradation under H2L and under same-generator LLM2L, then compares the two LLM- mediated regimes to isolate the operational H2L–LLM2L gap, and finally characterizes heterogeneity across detector families, dataset domains, and generator models. Section 7 interprets the resulting evidence in light of the objectives stated above. 3. Related Work This section positions the study within prior work on AI-text detection, rewriting robustness, benchmark design, and low-false-positive evaluation. The goal is not to survey all detector variants exhaustively, but to identify the empirical limitations of standard human-versus-LLM benchmarks and motivate the need for a matched four-regime evaluation. 3.1. AI-text detection families AI-text detection has been studied through several detector families. A recent survey organizes this space along a passive/active axis: passive detectors infer authorship post hoc from a text alone, whereas active approaches, principally watermarking and generation-log retrieval, require cooperation from the generation pipeline itself (Xiang et al., 2026). ARB is restricted to passive, post-hoc detectors; watermarking is out of scope, as it targets a different deployment setting in which the detector controls or has privileged access to the generator. Within passive detection, statistical detectors such as GLTR expose token-rank irregularities (Gehrmann et al., 2019); supervised detectors fine- tune encoders such as BERT or RoBERTa (Ippolito et al., 2020; Zhuang et al., 2021; Li et al., 2024); likelihood- and curvature-based zero-shot detectors use probability structure from a reference model, as in DetectGPT and FastDetectGPT (Mitchell et al., 2023; Bao et al., 2024); contrastive zero-shot detectors such as Binoculars compare paired observer/performer likelihoods (Hans et al., 2024); and robustness-oriented supervised detectors such as RADAR train against adversarial paraphrasing (Hu et al., 2023). A newer rewriting-as-probe family instead uses an LLM’s own rewrite or correction of a candidate text as the detection signal, exploiting the finding that LLMs edit already-LLM-generated text less than human-written text: RAIDAR measures the edit distance induced by an LLM rewrite of the input (Mao et al., 2024); MAGRET instead uses rewrite similarity to detect and attribute authorship First Author et al.: Preprint submitted to ElsevierPage 3 of 27 ARB-Dataset without log-probability access (Huang et al., 2025b); L2R fine-tunes the rewriter to amplify the RAIDAR edit-distance gap, improving cross-domain AUROC (Hao et al., 2025); and GECScore scores similarity to a grammar-corrected version of the text, reporting robustness to cross-domain and paraphrase attacks (Wu et al., 2025). Recent work also explores more specialized zero-shot, interpretable, or domain-adaptive detectors, including inverse-prompt and distribution-alignment approaches (Chen et al., 2025a,b). These detector families are not interchangeable: supervised encoders may learn dataset- or generator-specific cues and degrade under distribution shift; likelihood-based detectors depend on the fit between the reference model and the evaluated distribution; contrastive methods can be strong on direct generation but behave differently under rewriting; and robustness-oriented supervised detectors still need evaluation across domains, generators, and operating points. Two recent large-scale comparisons confirm this heterogeneity directly: one spanning classical, neural, fusion, and prompting-based detectors under domain and generator shift, with every family losing 5–30 AUROC points (Baidya et al., 2026); the other fusing stylometric features with transformer representations, which improves cross-domain transfer but leaves backbone-specific failure modes (Mady et al., 2026). For this reason, a benchmark should treat detectors as the objects of evaluation and report family-level patterns rather than only a single aggregate score. 3.2. Paraphrase and humanization robustness Paraphrasing and humanization are established challenges for AI-text detection. Krishna et al. (2023) showed that paraphrasing LLM-generated text can evade detectors while preserving semantics, and proposed retrieval as a defense; Sadasivan et al. (2025) argued that reliable detection is difficult under realistic attacks and transformations. Red-teaming studies show that LLM-assisted word substitution, style-changing prompts, or learned paraphrase policies can compromise detector performance (Shi et al., 2024; Weichert and Dimobi, 2024; Ranganath and Ramesh, 2026), and security-oriented evaluations of deepfake text detection find that defenses degrade under adaptive settings (Pu et al., 2023). Three recent systems push this threat model further: TempParaphraser simulates high-temperature sampling through repeated normal-temperature rewrites (Huang et al., 2025a); GradEscape trains a lightweight paraphraser against detector gradients or a query-extracted surrogate, evading deployed commercial detectors (Meng et al., 2025); and HUMPA applies a decoding-time logit shift from a preference-tuned proxy model that transfers across writing disciplines and languages (Wang et al., 2025). Weber-Wulff et al. (2023) evaluate detection tools under machine translation and content obfuscation, showing that text transformations strongly affect tool reliability, and DAMAGE reports that many detectors struggle when processed by humanizer or paraphrasing systems (Masrour et al., 2025). Even without an adversarial framing, meaning-preserving transformation of AI-generated text alone weakens detection: on the semantic-invariant split of HC3 PLUS, where ChatGPT answers are translated, summarized, or paraphrased while their content is held fixed, fine-tuned encoders that reach near-ceiling balanced accuracy on untransformed text drop by roughly 12–13 points (Mady et al., 2026). These studies establish that rewriting and humanization can break detector-visible signals. They primarily frame the problem as detector degradation under adversarial or transformed input. Unlike attack-centered paraphrase benchmarks, H2L is not treated only as adversarial evasion. It is modeled as a plausible assisted-writing workflow in which human-origin content receives an LLM-mediated surface through polishing, rewriting, or assisted composition. 3.3. Mixed authorship and paraphrase-origin benchmarks A complementary line of work constructs benchmarks that go beyond binary direct-generation detection: M4 evaluates multi-generator, multi-domain, multilingual settings (Wang et al., 2024b); RAID targets robust evaluation under diverse attacks (Dugan et al., 2024); MAGE studies detection in the wild (Li et al., 2024); M4GT-Bench adds mixed human–machine detection and boundary localization (Wang et al., 2024a); and DetectRL introduces real-world stressors including human revisions, writing errors, and mixing (Wu et al., 2024). Model rankings and apparent detector quality vary substantially across datasets, metrics, and protocols (Pröhl et al., 2024; Stowe and Patil, 2026), a pattern echoed by two further large-scale benchmarks: a multi-family, cross-domain, cross-generator evaluation whose humanization protocol, like the paraphrase-attack studies above, rewrites only already-LLM-generated text rather than a human-origin condition comparable to H2L (Baidya et al., 2026); and CUDRT, which pursues operational rather than authorship-origin diversity across a bilingual Create/Update/Delete/Rewrite/Translate taxonomy, finer-grained than ARB’s four regimes but not anchored to matched source items sharing a common HUMAN baseline (Tao et al., 2026). Two recent benchmarks are particularly close to the present study. Lau and Zubiaga (2025) introduce the Human & LLM Paraphrase Collection (HLPC), which explicitly combines human-written texts, LLM-generated texts, and First Author et al.: Preprint submitted to ElsevierPage 4 of 27 ARB-Dataset Table 1 Structural comparison of the closest benchmark designs. “Partial” indicates that a feature is present only for part of a benchmark or not used as the central evaluation design. FeatureM4/RAID/MAGE HLPC PADBen ARB Matched source itemNoPartial PartialYes Four-regime quartetNoNoNoYes Human baseline reused across tasksNoPartial PartialYes Same-generator LLM2L controlNoNoNoYes Paired target-minus-baseline deltasNoNoNoYes Low-FPR endpoint as primary metricPartialYesPartialYes Benchmark-transfer framingNoNoNoYes Transformation diagnosticsPartialPartial PartialYes their paraphrases, and reports performance at the 1% FPR operating point for both types. PADBen distinguishes paraphrasing of human-authored content (authorship obfuscation) from paraphrasing of LLM-generated content (plagiarism evasion) and reports a performance asymmetry between the two cases (Zha et al., 2025). These works are the closest prior studies to ARB, and Table 1 positions them explicitly against the present design. HLPC and PADBen ask whether paraphrased or source-aware transformed texts remain detectable. ARB asks a different evaluation-validity question: whether detector performance estimated on direct LLM generation transfers to matched LLM-mediated regimes under a shared human reference distribution. The distinction is in the benchmark structure and estimand, rather than in the presence of paraphrased text alone. A related line of work audits the assumptions encoded in mixed-authorship datasets themselves, rather than detector robustness to a fixed set of transformations. Dycke et al. (2026) formalize AI-text detection tasks, or “notions,” along three axes—the normative standard for acceptable AI use, the granularity of the human–AI genesis (document-, boundary-, or sentence-level), and the attacker model—and show, via AITDNA, a dataset of naturally logged human– LLM co-writing sessions, that synthetic benchmarks such as DetectRL, Mixset, SenDetEx, and BD misrepresent natural co-creation in AI-token proportion, boundary count, and human–AI linguistic gap. Their document-level notion is governed by an explicit parameter휏, the minimum AI-token share for a document-level AI label; leaving휏 implicit, as direct-generation datasets effectively do by labeling any AI involvement as positive, produces incompatible evaluation targets. This formalizes, at the dataset-construction level, the same concern that motivates ARB’s regime design: collapsing content origin and linguistic surface into one label obscures what a detector is asked to recognize. The two studies are complementary in what they hold fixed: Dycke et al. vary the notion applied to a fixed corpus of natural writing to expose hidden dataset assumptions, while ARB fixes a single notion (content origin vs. LLM-mediated surface) and varies the rewriting regime under matched source items to test benchmark transfer; their analysis does not include a same-generator second-pass control or paired block-level deltas. Overall, prior benchmarks cover important dimensions such as domain diversity, mixed authorship, paraphrase robustness, humanization, and—in the case of AITDNA—the realism of human–AI co-writing traces underlying dataset construction. To the best of our knowledge, existing benchmarks do not jointly combine matched source items across four regimes, a same-generator LLM2L control, paired block-level deltas, a shared HUMAN reference, and a benchmark-transfer framing evaluated under a strict low-FPR endpoint. Prior work also shows that aggregate ranking metrics are not sufficient for evaluating AI-text detectors in settings where false positives are costly. Several studies therefore report detector performance at fixed low false-positive rates, including 1% FPR or stricter operating points (Krishna et al., 2023; Lau and Zubiaga, 2025; Masrour et al., 2025; Ayoobi et al., 2025; Chen et al., 2025b; Ranganath and Ramesh, 2026). This motivates our use of TPR@1%FPR alongside AUROC in the evaluation protocol. First Author et al.: Preprint submitted to ElsevierPage 5 of 27 ARB-Dataset 3.4. Remaining gap: matched benchmark transfer The comparison in Table 1 shows that existing benchmarks address several adjacent problems: detector robustness, mixed-authorship detection, paraphrase effects, and humanization attacks. The remaining gap is narrower but impor- tant: whether performance measured on the conventional HUMAN vs. FREE-LLM benchmark transfers to matched LLM-mediated rewriting regimes under a shared human reference distribution. ARB addresses this gap by anchoring all regimes to matched source items and by using the same-generator LLM2L as a controlled second-pass condition rather than another paraphrase attack. This design enables paired comparisons among direct LLM generation, human-origin LLM rewriting, and LLM-origin second-pass rewriting within the same dataset–generator blocks, rather than treating rewritten samples as unrelated pooled positives, and thereby tests whether detectors that perform well under conventional HUMAN vs. FREE-LLM evaluation retain low-FPR recall under matched H2L and LLM2L regimes. 4. ARB Benchmark Design This section describes the end-to-end construction of ARB. Figure 1 summarizes the transformation flow used to generate the benchmark dataset: each sampled human source item anchors the HUMAN condition, provides the topic basis for FREE-LLM generation, is rewritten to produce H2L, and links the corresponding FREE-LLM output to the same-generator LLM2L rewrite. The pipeline starts from the training splits of three Hugging Face datasets (XSum, WritingPrompts, and OpenWebText) applies source preprocessing, and draws a seeded stratified random sample of 600 human texts from each dataset. Each sampled text is assigned a stable matched-source identity and then follows three paths: the original text is retained as HUMAN; a dataset-specific topic is passed to a generation prompt to create FREE-LLM; and the original human text is passed to a rewrite prompt to create H2L. The resulting FREE-LLM text is subsequently rewritten by the same generator to create LLM2L. Detectors are then applied to every regime variant, after which detection metrics are computed. Source datasets Filtering and length-stratified sampling Matched source item Human Topic extraction H2L rewrite prompt Free-LLM generation prompt H2L Free-LLM LLM2L rewrite prompt same generator LLM2L Valid matched block Detector scoring Figure 1: End-to-end ARB construction and evaluation workflow. A filtered, length-stratified human source item anchors four matched regimes. Human retains the source text; Free-LLM is generated from a dataset-specific topic; H2L rewrites the human source; and LLM2L rewrites the corresponding Free-LLM output with the same generator. Only complete validated quartets proceed to detector scoring and paired block-level analysis. First Author et al.: Preprint submitted to ElsevierPage 6 of 27 ARB-Dataset Table 2 Four-regime benchmark design. RegimeContent originLinguistic surface Humanhumanhuman-written Free-LLMLLMLLM-generated H2LhumanLLM-mediated rewrite LLM2LLLMLLM-mediated rewrite Table 3 Dataset-specific source fields and topic extraction for Free-LLM generation. DatasetHugging Face identifierHuman-text field Topic for Free-LLM XSum EdinburghNLP/xsum document summary WritingPrompts euclaise/writingprompts story prompt OpenWebText Skylion007/openwebtext textfirst two cleaned sentences, at most 40 words 4.1. Four-regime design The benchmark operationally contrasts content-origin and LLM-mediated surface regimes under a matched benchmark-transfer design. Table 2 defines the four regimes. HUMAN is the reference human condition. FREE-LLM is the baseline machine-generation condition. H2L and LLM2L are experimental conditions in which an LLM mediates the final surface through rewriting. For each source sample, HUMAN is the original human text. FREE-LLM is generated from a topic derived from the same source item. H2L is produced by rewriting the human source text. LLM2L is produced by applying the same rewriting protocol to the corresponding FREE-LLM text. FREE-LLM is not intended to be a semantic paraphrase of the HUMAN source; it represents the conventional topic-conditioned direct-generation baseline. H2L and LLM2L instead instantiate rewriting regimes. Comparisons are therefore interpreted as benchmark-transfer contrasts rather than semantic-equivalence contrasts across all four regimes. In the main experiment, LLM2L is generated by the same model that produced the corresponding FREE-LLM text. This same-generator design avoids adding a crossed generator–rewriter factor and makes LLM2L a controlled second-pass condition. It tests whether a second LLM- mediated surface pass, by itself, makes LLM-origin text resemble the harder H2L condition. 4.2. Datasets and domains We used three English datasets selected to represent distinct textual domains: XSum for news and factual writing (Narayan et al., 2018), WritingPrompts for creative and narrative writing (Fan et al., 2018), and OpenWebText for web/general writing (Gokaslan et al., 2019). XSum is a dataset for evaluating summarization models. Each dataset entry has a “document” component that provides detailed narrative information and a “summary” component that captures the key points. WritingPrompts is a large FAIR dataset containing human-written stories paired with prompts from an online forum. OpenWebText is an open-source replication of the WebText dataset from OpenAI provided by Aaron Gokaslan. The dataset has been created by extracting URL links from the “Reddit submission dataset” and parsing the HTML pages of related Reddit posts. The topic used in the prompt template to generate the FREE-LLM texts was dataset-dependent (Table 3): the summary field for XSum, the prompt for WritingPrompts, and the first two cleaned sentences from the text column, with a maximum of 40 words for OpenWebText. For exact replication, the sources were loaded with the Hugging Face datasets library using the train split in all three cases. Dataset-specific identifiers and fields are reported in Table 3. The use of multiple domains is a validity control against conclusions driven by a single genre or source distribution. 4.3. Source preprocessing and stratified random sampling Detector performance can depend on the amount of available text. We therefore restricted the eligible source pool to texts of 150–500 whitespace-delimited words and removed source items rejected by the implemented structural-artifact and content-suitability preprocessing. Each eligible human text was assigned to one of three length strata: short texts First Author et al.: Preprint submitted to ElsevierPage 7 of 27 ARB-Dataset Table 4 Generator models and exact Hugging Face identifiers. AliasHugging Face model identifierParameters llama32_3b meta-llama/Llama-3.2-3B-Instruct3B qwen25_7b Qwen/Qwen2.5-7B-Instruct7B mistral7b mistralai/Mistral-7B-Instruct-v0.37B gemma2_9b google/gemma-2-9b-it9B contained 150–220 words, medium texts 221–350 words, and long texts 351–500 words. For each dataset, we then used stratified random sampling with seed 42 to draw 200 rows from each stratum. The resulting sample contains exactly 600 rows per dataset, i.e., 1,800 human source rows in total. 4.4. Generator models The benchmark uses four open-weight instruction-tuned generator families. We focus on open-weight generators to ensure reproducibility and release-compatible benchmarking. The resulting estimates should not be generalized to closed-source proprietary systems without additional evaluation. For each source-item–generator pair, the selected model creates the FREE-LLM text, rewrites the human source as H2L, and performs the same-generator second pass from FREE-LLM to LLM2L. All four models were loaded in bfloat16 precision and received the same fixed system prompt and the same fixed regime-specific user templates. No model-specific prompt wording or prompt tuning was used. For each source item, only the prompt template variables were instantiated (Section 4.5): the topic and stratum bounds for FREE-LLM, the human source text for H2L, and the corresponding FREE-LLM output for LLM2L. Table 4 therefore reports only model-specific information. Model-family references are provided where a stable technical report or model paper is available (Grattafiori et al., 2024; Mesnard et al., 2024; Jiang et al., 2023; Qwen Team et al., 2024). The decoding configuration was specified before detector evaluation and was not tuned post hoc to maximize detector degradation. The design objective was methodological rather than adversarial: to construct benchmark texts that were sufficiently diverse to avoid trivially templatic outputs, while remaining coherent, semantically faithful, and comparable across generator families. This choice follows prior work showing that sampling decisions mediate a quality–diversity trade-off in generated text and can materially affect downstream evaluation conclusions (Ippolito et al., 2020; Chung et al., 2023; Zhou et al., 2025). Accordingly, we adopted a moderate stochastic decoding regime rather than deterministic decoding or aggressively high-temperature sampling, together with the fixed task and output constraints described above. To ensure transparent and reproducible generation, we fix the decoding settings across models and regimes. Generation uses the Hugging Face Transformers backend with do_sample=True, temperature=0.7, top_p=0.9, top_k=40, and max_new_tokens=512. The global random seed is fixed to 42 for sampling and bootstrap evaluation. Prompts are rendered through the model chat template before decoding. For Gemma-family models, which did not use the same system-role template in our implementation, the system instruction is merged into the user prompt to preserve a consistent output-only generation policy. 4.5. Prompt design This section explains the rationale behind the prompt design, while Appendix A reports the prompt templates verbatim. After sampling, the human text, its source-dataset identifier, its original source index, and its length band defined the matched source item. Each source item was used to generate texts using the generator models described in Section 4.4. Prompt wording can materially affect model behavior. We therefore treated it as a controlled component of the benchmark rather than tuning it separately by dataset or model (Zhou et al., 2022; Sahoo et al., 2024; Schulhoff et al., 2024). Prompts are composed of two parts: a fixed system prompt and a parametrized task-dependent prompt. They are designed to be short, explicit, neutral in style, and aligned with the three operations being studied. We deliberately avoided instructions such as “humanize,” named stylistic personas, or detector-evasion objectives, because these would introduce a separate adversarial or stylistic manipulation. First Author et al.: Preprint submitted to ElsevierPage 8 of 27 ARB-Dataset The minimal system prompt aims to reduce prompt-induced formatting artifacts. It asks every model to return only the requested text and suppresses prefaces, explanations, headings, and Markdown. This reduces output-format artifacts that are unrelated to the authorship regime. FREE-LLM template. For each matched source item and generator model, the FREE-LLM template requests fluent, self-contained English text on the extracted topic, requires original wording and structure, and prohibits references to the source text, headings, and bullet points. Topic extraction is dataset-specific and deterministic: XSum uses the dataset’s summary field, WritingPrompts uses its prompt field, and OpenWebText uses the first two cleaned sentences, falling back to the first sentence and truncating it to 40 words when necessary. The topic is an input only to the FREE-LLM branch, while the complete human text is the input to the H2L branch. min_words and max_words variables are also set to the boundaries of the sampled source’s length stratum (150–220, 221–350, or 351–500 words). Thus, length is controlled from the pre-generation stratum without supplying the human article itself as generation content. H2L template. Independently, the H2L template supplies the complete human source and requests a fluent rewrite that (i) preserves meaning, factual claims, entities, and relationships, (i) adds no new information, (i) removes no important information, (iv) changes wording and sentence structure where possible, (v) and remains approximately the same length. LLM2L template. The LLM2L template applies an analogous meaning-preserving rewrite instruction to the corresponding FREE-LLM output. The same model that created FREE-LLM performs this second pass, so HUMAN→ H2L and FREE-LLM→ LLM2L differ in input-content origin while retaining a closely parallel rewriting operation. Across all datasets and generator families, the templates remain fixed: only the topic, source text, generated text, and the stratum-derived length variables are instantiated. 4.6. Matched blocks and comparison readiness A matched unit is defined at the level of sample_id × generator_model. It contains the unchanged HUMAN text and the FREE-LLM, H2L, and LLM2L outputs associated with the same one of the 1,800 sampled source items and generator model. Source rows are not replaced or resampled after generation; the fixed stratified sample is the basis for all three prompt applications. Balance by dataset and human-source length stratum therefore originates in the initial sampling step rather than in post-generation selection. Each generation call was allotted up to three retry attempts, but no call exhausted this budget: every one of the 7,200 attempted source-item–generator combinations (1,800 source items× 4 generators) produced a complete quartet, so all 7,200 quartets (23,400 individual texts; Table 5) entered detector scoring and paired analysis. Beyond the prompt-level constraints described in Section 4.5 (the stratum-derived target length for FREE-LLM, and the meaning-preservation and approximate-length instructions for H2L and LLM2L), no post-hoc semantic, length, or language filtering was applied to the released benchmark. Retention was therefore not conditioned on output quality, and a small fraction of generated texts deviate from the intended target profile: automated checks on the released dataset identify 0.64% of generated texts shorter than 50 words, 0.08% matching a refusal or policy-disclaimer pattern (e.g., “I can’t fulfill this request.”), 0.03% flagged as non-English by automatic language identification, and 0.01% exact duplicates; these categories overlap, and their union covers 0.67% (145/21,600) of generated texts. These cases are retained in the released dataset rather than silently dropped, and can be identified and excluded using the released text and word-count metadata. Section 7.5 discusses the resulting limitation. The retained identifiers provide the joins required for replication: sample_id links the four regime variants, the source index traces the item to the sampled dataset, and the generator identifier records the model used for all generated variants in that block. The resolved experiment configuration fixes dataset names and splits, preprocessing settings, length bands, random seed, prompt templates, decoding parameters, and output paths. These artifacts separate benchmark construction from detector evaluation and permit the complete quartet to be reconstructed before any detector score is inspected. Matched comparisons are subsequently computed within the same dataset × generator block. For example, ΔTPR@1%FPR for H2L compares HUMAN vs. H2L with HUMAN vs. FREE-LLM under matched block conditions, before the paired deltas are macro-averaged across blocks. The same alignment is used for LLM2L and for the direct LLM2L–H2L source-origin comparison. This avoids comparisons between unrelated pooled samples and carries the First Author et al.: Preprint submitted to ElsevierPage 9 of 27 ARB-Dataset Table 5 Final composition of ARB by source dataset and regime. Each cell reports the number of texts and, in parentheses, the mean ± standard deviation word count. Within every dataset × regime cell, texts are balanced exactly across the four generator models (Table 4); Human texts are shared across generator blocks and are therefore not multiplied by generator. DatasetHumanFree-LLMH2LLLM2L XSum600 (295±102)2400 (234±105)2400 (232±72)2400 (204±96) WritingPrompts600 (298±104)2400 (254±107)2400 (240±76)2400 (229±99) OpenWebText600 (297±103)2400 (224±107)2400 (209±72)2400 (196±97) Total1800 (297±103)7200 (237±107)7200 (227±75)7200 (210±99) construction-stage matching into statistical estimation. The matched blocks then enter the detector-scoring procedure defined in Section 5. 4.7. Dataset description and final statistics ARB is an English-language text collection of 23,400 samples: 1,800 HUMAN source texts (600 per dataset; Section 4.3) and, for each of the four generator models in Table 4, one FREE-LLM, H2L, and LLM2L text per source item, i.e., 7,200 texts per generated regime (1,800 source items × 4 generators). As reported in Section 4.6, every attempted source-item–generator combination is complete, so these figures also describe the exact set of matched quartets used in the paired analyses of Sections 6 and 7. Table 5 reports the final composition by source dataset and regime, together with word-count statistics computed on whitespace-delimited tokens. HUMAN texts are length-stratified by construction and therefore fall within 150– 500 words in every dataset. FREE-LLM, H2L, and LLM2L texts are only softly constrained by the generation and rewriting prompts (a target stratum for FREE-LLM, an approximate-length instruction for the rewrites; Section 4.5) and consequently show a wider spread around a lower mean, with LLM2L texts on average the shortest as a result of two successive LLM-mediated passes. Licensing. XSum source articles are BBC news text; the canonical Hugging Face release (EdinburghNLP/xsum) does not declare an explicit dataset license and is distributed by its authors for research use (Narayan et al., 2018). WritingPrompts originates from user-submitted posts on Reddit’s r/WritingPrompts, compiled by Fan et al. (2018); the Hugging Face mirror used for sourcing (euclaise/writingprompts) is tagged with the MIT license. OpenWebText packaging is released under a C0 dedication by its curators, who do not claim ownership of the underlying scraped web text and provide a notice-and-takedown mechanism for copyright holders (Gokaslan et al., 2019). ARB itself is released under the Apache License 2.0 (Section 8); as stated there, downstream users remain responsible for the licensing terms of the three source corpora summarized above. 5. Evaluation Protocol This section defines how detectors are evaluated on the benchmark. We describe the detector families, primary metrics, aggregation and bootstrapping sampling strategies, and textual transformation diagnostics. 5.1. Detectors The objects of evaluation are AI-text detectors representing complementary detector families. We include supervised encoder baselines, a paraphrase-robust supervised detector, a zero-shot likelihood/curvature detector, and a zero-shot contrastive likelihood detector. ARB is not intended to rank detectors exhaustively. Its purpose is to test whether detector families preserve performance ordering and low-FPR recall when moving from direct-generation evaluation to matched rewriting regimes. Detector configurations followed the released implementations or paper-recommended settings whenever available. Hardware-driven adjustments were applied only when needed to run the experiments on the available workstation, for example, through precision, quantization, or maximum observed sequence length. These choices were made for execution feasibility and were not tuned on ARB labels or on regime-specific performance. Each detector configuration was kept fixed across all datasets, generator models, and regimes, avoiding detector retuning as a confounding factor in the comparison among FREE-LLM, H2L, and LLM2L. First Author et al.: Preprint submitted to ElsevierPage 10 of 27 ARB-Dataset Table 6 Detector families included in the benchmark and rationale for inclusion. DetectorFamilySettingRole BERT-DefenseSupervised encoder TrainedEncoder baseline (Pu et al., 2023) RoBERTa-DefenseSupervised encoder TrainedRoBERTa encoder baseline (Pu et al., 2023; Zhuang et al., 2021) RADARRobust supervised TrainedParaphrase-robust detector (Hu et al., 2023) Binoculars-falcon-7b Contrastive likelihood Zero-shotLikelihood-ratio detector (Hans et al., 2024) FastDetectGPTLikelihood/curvature Zero-shotDetectGPT-style detector (Mitchell et al., 2023; Bao et al., 2024) For BERT-Defense and RoBERTa-Defense, we used the pretrained checkpoints from the experimental setup of Pu et al. (2023). These encoder baselines are not included as state-of-the-art competitors but as representative supervised detectors whose behavior under distribution shift provides a lower-bound comparison against zero-shot and robustness- oriented methods. RADAR was included as a supervised detector explicitly designed for robustness to adversarial paraphrasing. We used the released checkpoint without additional training or task-specific adaptation. Since RADAR follows a detector-specific score convention in its released implementation, its output orientation was standardized before metric computation. For Binoculars-falcon-7b, we used the Falcon-7B observer and Falcon-7B-Instruct performer configuration following the released Binoculars setup. Since the released Binoculars decision rule assigns AI-generated labels to scores below its threshold, its raw score has a lower-is-more-AI orientation. We retained the raw scores for reproducibility but used a sign-reversed score for AUROC and TPR@1%FPR computation, so that larger standardized scores always correspond to stronger evidence for the positive class. No detector-specific threshold was tuned on ARB. For FastDetectGPT, we used a fixed sampling/scoring model pair for all evaluated generators. We did not change the detector backbone according to the generator model, because doing so would introduce a confounding factor between generator identity and detector configuration. Following the updated recommendation of the official FastDetectGPT repository, we used Llama3-8B as the sampling model and Llama3-8B-Instruct as the scoring model. To make the paired zero-shot detector feasible on the available 32 GB GPU setup, inference was run with 8-bit quantization. This was an execution constraint, not a detector calibration step; no FastDetectGPT component was fine-tuned or threshold- tuned on ARB. For every detector, raw scores and standardized scores were stored. AUROC and TPR@1%FPR were computed from standardized continuous scores, not from detector-specific default labels. Detector-specific default thresholds were retained only for reproducibility and auxiliary inspection. This standardization ensures that all pairwise comparisons use a common score orientation, with HUMAN as the negative class and the target regime as the positive class. 5.2. Experimental setup All experiments were conducted on a Linux workstation running Ubuntu 24.04.4 LTS with kernel 6.8.0-124- generic. The machine was equipped with an Intel Core Ultra 9 285K CPU, 62 GiB of RAM, and a 1.9 TB Samsung NVMe SSD formatted with ext4. GPU-based experiments were executed on a single NVIDIA GeForce RTX 5090 with 32 GB of VRAM, using NVIDIA driver 590.48.01. The software environment used Python 3.12.3 and PyTorch 2.11.0+cu128. CUDA was available through PyTorch 12.8 with cuDNN 9.1.9, while the NVIDIA-SMI interface reported CUDA compatibility version 13.1. Detector configurations were therefore selected to be executable under this single-GPU setup while remaining fixed across regimes, datasets, and generator models. 5.3. Primary metrics We use TPR@1%FPR as the primary operating metric. It is defined as the fraction of positive examples detected when the false-positive rate on the human class is constrained to 1%. This conservative endpoint is important because false accusations of AI authorship can create fairness and accountability concerns, including biases against non-native English writers (Liang et al., 2023). First Author et al.: Preprint submitted to ElsevierPage 11 of 27 ARB-Dataset We report AUROC as a complementary secondary metric. AUROC measures global ranking separability: the probability that a randomly selected positive example receives a higher machine-likeness score than a randomly selected human example. It is threshold-independent and useful across the full score range, but it does not indicate whether a detector retains useful recall under the prespecified low-FPR constraint. For each detector, dataset, and generator, we evaluated three matched binary detection tasks: HUMAN vs. FREE- LLM, HUMAN vs. H2L, and HUMAN vs. LLM2L. In each task, HUMAN texts are the negative class and the target- regime texts are the positive class. The same HUMAN set is reused across the three tasks within each block to keep the human reference distribution fixed. This prevents changes in the human negative class from confounding comparisons among FREE-LLM, H2L, and LLM2L. In the interpretation of results, we therefore lead with TPR@1%FPR and use AUROC as a secondary view of global separability. This distinction is essential because detectors can retain non-trivial AUROC while having near-zero low-FPR recall. 5.4. Block-level estimation, aggregation, and uncertainty All performance estimates were first computed within each dataset × generator block. For each detector and block, we computed TPR@1%FPR and AUROC for three binary comparisons: HUMAN vs. FREE-LLM, HUMAN vs. H2L, and HUMAN vs. LLM2L. To quantify transfer from the conventional direct-generation benchmark, we computed paired target-minus-FREE- LLM deltas within each block. A negative delta means that the detector performed worse in the target regime than in the FREE-LLM baseline under the same dataset and generator. These deltas were computed separately for H2L and LLM2L. To compare the two LLM-mediated regimes directly, we computed an operational H2L–LLM2L gap as LLM2L minus H2L within the same block. A positive gap means that LLM2L was more detectable than H2L under the same dataset and generator. Detector-level results were then obtained by macro-averaging across dataset × generator blocks. This gave each block equal weight and prevented larger or easier blocks from dominating the aggregate estimate. Deltas and operational gaps were computed within blocks before macro-averaging, rather than as differences between pooled averages. We reported 95% confidence intervals using a block-structured bootstrap with 5,000 resamples and random seed 42. Within each dataset × generator block, rows were resampled with replacement, and TPR@1%FPR and AUROC were recomputed for each replicate. For deltas and operational gaps, the aligned rows across matched regimes were resampled jointly, preserving the pairing between regimes. Confidence intervals were reported as percentile intervals over the resulting bootstrap distribution. These intervals quantify uncertainty in the aggregate estimates, and heterogeneity across domains and generators is reported separately using heatmaps and stratified diagnostics. 5.5. Textual transformation diagnostics We computed textual transformation diagnostics for the two rewriting paths. For H2L, the source text was the original HUMAN text and the target text was its LLM-mediated rewrite. For LLM2L, the source text was the corresponding FREE-LLM output, and the target text was the same-generator second-pass rewrite. For each source–target pair, we measured word ratio, token-level normalized edit distance (NED), lexical overlap using Jaccard similarity, and semantic similarity. These diagnostics were not used as detector inputs. They were used only to characterize how much each rewriting path changed its source text. 6. Results This section reports the benchmark results in order of the research objectives. We first establish baseline detectability under the conventional HUMAN vs. FREE-LLM condition, then quantify degradation under H2L and LLM2L, compare the two LLM-mediated regimes, and finally analyze heterogeneity across detectors, datasets, generators, and textual transformation features. 6.1. Baseline detectability under HUMAN vs. FREE-LLM This first analysis evaluates the standard detector benchmark: distinguishing HUMAN texts from directly generated FREE-LLM texts. Table 7 reports TPR@1%FPR and AUROC for all regimes; the FREE-LLM rows are the baseline control. At the primary operating point, FastDetectGPT and Binoculars-falcon-7b obtain the strongest baseline TPR@1%FPR values, 0.912 and 0.935, respectively; RADAR reaches 0.668. Their secondary AUROC values are also high (0.990, First Author et al.: Preprint submitted to ElsevierPage 12 of 27 ARB-Dataset Table 7 Pairwise detection performance across regimes, with the primary low-FPR endpoint reported first. Values are macro- averaged block-level estimates with 95% confidence intervals across dataset × generator blocks. Bold values indicate the best score for each comparison and metric. DetectorComparisonTPR@1%FPRAUROC BERT-DefenseHuman vs. Free-LLM 0.001 [0.000, 0.003]0.210 [0.203, 0.217] BERT-DefenseHuman vs. H2L0.012 [0.008, 0.015]0.453 [0.444, 0.463] BERT-DefenseHuman vs. LLM2L0.002 [0.001, 0.004]0.233 [0.226, 0.240] RoBERTa-Defense Human vs. Free-LLM 0.019 [0.011, 0.030]0.569 [0.560, 0.578] RoBERTa-Defense Human vs. H2L0.025 [0.016, 0.038]0.586 [0.577, 0.595] RoBERTa-Defense Human vs. LLM2L0.016 [0.009, 0.025]0.538 [0.528, 0.547] FastDetectGPTHuman vs. Free-LLM 0.912 [0.892, 0.929]0.990 [0.989, 0.992] FastDetectGPTHuman vs. H2L0.308 [0.264, 0.347]0.874 [0.868, 0.879] FastDetectGPTHuman vs. LLM2L0.783 [0.754, 0.808]0.971 [0.968, 0.973] Binoculars-falcon-7b Human vs. Free-LLM 0.935 [0.924, 0.942]0.983 [0.980, 0.985] Binoculars-falcon-7b Human vs. H2L0.151 [0.135, 0.166]0.666 [0.658, 0.674] Binoculars-falcon-7b Human vs. LLM2L0.830 [0.816, 0.842]0.952 [0.948, 0.955] RADARHuman vs. Free-LLM 0.668 [0.636, 0.694]0.913 [0.909, 0.918] RADARHuman vs. H2L0.122 [0.101, 0.141]0.596 [0.588, 0.604] RADARHuman vs. LLM2L0.646 [0.617, 0.670]0.903 [0.899, 0.908] 0.983, and 0.913). In contrast, RoBERTa-Defense has near-zero TPR@1%FPR (0.019) despite moderate AUROC (0.569), while BERT-Defense has negligible TPR@1%FPR (0.001) and very low AUROC (0.210). These results establish that direct LLM generation is detectable by the strongest zero-shot detectors and by RADAR, but not by all detector families at a strict low-FPR operating point. The baseline therefore provides a necessary control for interpreting subsequent robustness losses. 6.2. Robustness under H2L rewriting This analysis measures transfer from the FREE-LLM baseline to the H2L regime. Table 8 reports paired target- minus-FREE-LLM deltas for both rewriting regimes; this subsection focuses on the H2L columns. Negative values indicate degradation relative to direct LLM generation. Figure 2 shows how mean ΔTPR@1%FPR varies across detectors and datasets after averaging the paired block-level deltas across generators. The strongest baseline detectors experience the largest H2L losses. FastDetectGPT decreases from TPR@1%FPR 0.912 in FREE-LLM to 0.308 in H2L, corresponding to ΔTPR@1%FPR = −0.605. Binoculars-falcon-7b decreases from 0.935 to 0.151, corresponding to ΔTPR@1%FPR = −0.784. RADAR decreases from 0.668 to 0.122, corre- sponding to ΔTPR@1%FPR = −0.546. Figure 2 shows that these losses are not uniform across datasets: Binoculars- falcon-7b and RADAR show particularly large degradation on XSum and OpenWebText, whereas WritingPrompts is comparatively less severe for some detectors. The AUROC losses are also visible but less operationally severe than the low-FPR losses. FastDetectGPT drops by −0.117 AUROC, while Binoculars-falcon-7b and RADAR drop by −0.316 and −0.318, respectively. BERT-Defense and RoBERTa-Defense show small or positive deltas, but these values should not be interpreted as robustness: both detectors have near-zero TPR@1%FPR in the baseline and remain near zero under H2L. Thus, H2L substantially weakens detector performance for detectors that are effective in the standard baseline condition. The effect is strongest at the low false-positive operating point. 6.3. Robustness under same-generator LLM2L second pass This analysis evaluates whether a second pass through the same generator weakens detector signals in already LLM- origin text. The LLM2L deltas in Table 8 are substantially smaller than the corresponding H2L deltas for detectors with strong baselines. Figure 3 reports the mean ΔTPR@1%FPR under LLM2L for each detector and dataset after averaging the paired block-level deltas across generators. First Author et al.: Preprint submitted to ElsevierPage 13 of 27 ARB-Dataset Table 8 Regime deltas relative to Free-LLM. Deltas are computed as paired target-minus-Free-LLM differences within dataset × generator blocks and then macro-averaged. Negative values indicate degradation. DetectorΔTPR@1%FPR H2LΔAUROC H2LΔTPR@1%FPR LLM2L ΔAUROC LLM2L BERT-Defense0.010 [0.007, 0.014]0.243 [0.235, 0.251]0.001 [-0.001, 0.002]0.023 [0.020, 0.025] RoBERTa-Defense0.006 [-0.002, 0.014]0.017 [0.008, 0.025]-0.003 [-0.008, 0.001]-0.032 [-0.036, -0.027] FastDetectGPT-0.605 [-0.645, -0.569] -0.117 [-0.122, -0.111] -0.130 [-0.146, -0.115] -0.020 [-0.021, -0.018] Binoculars-falcon-7b -0.784 [-0.802, -0.767] -0.316 [-0.325, -0.308] -0.104 [-0.114, -0.096] -0.031 [-0.034, -0.028] RADAR-0.546 [-0.575, -0.514] -0.318 [-0.326, -0.310] -0.023 [-0.030, -0.015] -0.010 [-0.012, -0.008] XSum WritingPromptsOpenWebText Dataset BERT-Defense RoBERTa-Defense FastDetectGPT Binoculars-falcon-7b RADAR Detector 0.0070.0140.007 -0.0060.0190.004 -0.689-0.538-0.554 -0.884-0.662-0.793 -0.710-0.193-0.730 −0.8 −0.6 −0.4 −0.2 0.0 0.2 0.4 0.6 0.8 Mean ΔTPR@1%FPR (H2L − FREE-LLM) Figure 2: Mean ΔTPR@1%FPR under H2L by detector and dataset. Each cell is the mean across generators of the paired block-level difference between H2L and Free-LLM (H2L minus Free-LLM). Negative values indicate degradation relative to direct LLM generation. FastDetectGPT decreases from TPR@1%FPR 0.912 in FREE-LLM to 0.783 in LLM2L, with ΔTPR@1%FPR = −0.130. Binoculars-falcon-7b decreases from 0.935 to 0.830, with ΔTPR@1%FPR = −0.104. RADAR is nearly stable, decreasing from 0.668 to 0.646, with ΔTPR@1%FPR = −0.023. The corresponding AUROC deltas are also small: −0.020 for FastDetectGPT, −0.031 for Binoculars-falcon-7b, and −0.010 for RADAR. The dataset-level pattern in Figure 3 confirms that LLM2L degradation is weaker than the H2L degradation reported in Figure 2. Same-generator second-pass rewriting therefore does not erase machine-origin signals to the same degree as human-origin LLM rewriting. For detectors that are informative in the baseline benchmark, LLM2L remains much closer to FREE-LLM than to H2L. 6.4. Operational H2L–LLM2L gap under LLM-mediated surface This analysis compares H2L and LLM2L directly. Both regimes have an LLM-mediated final surface, but they differ in source origin and in observed transformation strength: H2L starts from human-authored content and undergoes a stronger measured transformation, whereas LLM2L starts from LLM-origin content. Table 9 reports the operational LLM2L minus H2L gap with bootstrap uncertainty. Gaps are computed as paired LLM2L-minus-H2L differences within dataset × generator blocks and macro-averaged across blocks. Figure 4 provides the complementary absolute-performance view, comparing mean TPR@1%FPR across FREE- LLM, LLM2L, and H2L for every detector. It shows that the large negative H2L deltas in Figure 2 arise from a sharp reduction relative to the direct-generation baseline, whereas LLM2L generally remains much closer to FREE-LLM. For the strongest baseline detectors, LLM2L is much more detectable than H2L. Binoculars-falcon-7b has a TPR@1%FPR gap of 0.680 (95% CI [0.661,0.698]), RADAR has a gap of 0.524 ([0.493,0.551]), and FastDetectGPT First Author et al.: Preprint submitted to ElsevierPage 14 of 27 ARB-Dataset XSum WritingPromptsOpenWebText Dataset BERT-Defense RoBERTa-Defense FastDetectGPT Binoculars-falcon-7b RADAR Detector 0.000-0.0010.003 -0.004-0.001-0.002 -0.181-0.065-0.137 -0.143-0.041-0.119 -0.005-0.008-0.055 −0.8 −0.6 −0.4 −0.2 0.0 0.2 0.4 0.6 0.8 Mean ΔTPR@1%FPR (LLM2L − FREE-LLM) Figure 3: Mean ΔTPR@1%FPR under LLM2L by detector and dataset. Each cell is the mean across generators of the paired block-level difference between LLM2L and Free-LLM (LLM2L minus Free-LLM). Negative values indicate degradation relative to direct LLM generation. BERT-Defense RoBERTa-Defense FastDetectGPT binoculars-falcon-7b radar Detector 0.0 0.2 0.4 0.6 0.8 1.0 Mean TPR@1% FPR FreeLLMLLM2LH2L Figure 4: Detection performance across generation regimes. Bars show the detector-level mean TPR@1%FPR for Free- LLM, LLM2L, and H2L, macro-averaged across dataset × generator blocks. Error bars denote block-structured bootstrap 95% confidence intervals. The contrast between H2L and LLM2L visualizes the source-origin gap under LLM-mediated surface. has a gap of 0.475 ([0.444,0.511]). All three intervals exclude zero. These gaps show that the presence of an LLM- mediated final surface is not sufficient to explain detector performance: H2L and LLM2L remain substantially different at the low-FPR operating point. However, the textual diagnostics in Section 6.6 show that H2L also applies stronger surface transformation than LLM2L (NED 0.602 vs. 0.348; Jaccard 0.463 vs. 0.587). The gap between the two regimes therefore reflects some combination of source origin and transformation strength; the two factors are partially confounded in the current design. For this reason, we interpret the result as an operational source-origin-associated gap rather than as a causal estimate of source origin alone. First Author et al.: Preprint submitted to ElsevierPage 15 of 27 ARB-Dataset Table 9 Paired operational gap between LLM2L and H2L. Positive values indicate that LLM2L is more detectable than H2L. Values are macro-averaged across dataset × generator blocks; brackets report block-structured bootstrap 95% confidence intervals. DetectorTPR@1%FPR gap [95% CI]AUROC gap [95% CI] BERT-Defense-0.010 [-0.013, -0.007]-0.220 [-0.228, -0.213] RoBERTa-Defense-0.009 [-0.017, -0.002]-0.048 [-0.057, -0.040] FastDetectGPT0.475 [0.444, 0.511]0.097 [0.092, 0.102] Binoculars-falcon-7b0.680 [0.661, 0.698]0.285 [0.277, 0.294] RADAR0.524 [0.493, 0.551]0.308 [0.300, 0.315] For BERT-Defense and RoBERTa-Defense, the operational gaps are not diagnostically useful because both detectors have near-zero TPR@1%FPR in all regimes. Their small or negative gaps reflect poor operating-point performance rather than evidence of robustness. 6.5. Detector-family, dataset, and generator heterogeneity This analysis examines whether the H2L degradation is uniform across detectors, datasets, and generator models. The full AUROC and TPR@1%FPR heatmaps for the H2L regime are reported in Appendix B; each panel corresponds to one detector, and each cell represents a generator × dataset block. The largest differences are observed across detector families. FastDetectGPT is the most robust detector under H2L, although it still loses substantial TPR@1%FPR. Binoculars-falcon-7b and RADAR are strong in FREE-LLM and LLM2L but degrade sharply in H2L. BERT-Defense and RoBERTa-Defense remain weak at the low-FPR operating point across regimes. Dataset effects are also visible. Under H2L, Binoculars-falcon-7b is comparatively stronger on WritingPrompts but degrades on OpenWebText and XSum. RADAR shows a different pattern: it can obtain strong AUROC on XSum while retaining only moderate TPR@1%FPR, illustrating that ranking quality and conservative-threshold recall can diverge. Generator-level variation is present but less uniform than dataset-level variation. No generator is uniformly easy or difficult across all detectors. However, qwen25_7b appears more challenging for selected detectors, especially in low- FPR recall, while llama32_3b is often easier to detect for FastDetectGPT and Binoculars-falcon-7b. These observations should be interpreted as block-level heterogeneity rather than as causal properties of individual generators. Overall, this heterogeneity analysis shows that robustness is driven primarily by the detector family, with additional variation in datasets and generators that would be hidden by pooled benchmark-level averages. 6.6. Textual transformation analysis As a supporting diagnostic analysis, we compare source and target texts using target-to-source word ratio, token- level normalized edit distance, lexical overlap, and semantic similarity. For H2L, the source is the original HUMAN text and the target is its LLM-mediated rewrite. For LLM2L, the source is the corresponding FREE-LLM output and the target is the same-generator second-pass output. Table 10 compares the textual change induced by the two rewriting paths, while Figure 5 provides a compact visual summary. H2L produces shorter outputs than LLM2L, with a word ratio of 0.798 compared with 0.887. It also introduces stronger token-level changes, with normalized edit distance 0.602 compared with 0.348 for LLM2L. Lexical overlap is lower in H2L (0.463) than in LLM2L (0.587). Both paths retain high semantic similarity, although LLM2L is more conservative: semantic similarity is 0.886 for H2L and 0.949 for LLM2L. These diagnostics characterize H2L as a broadly meaning-preserving but more surface-altering rewrite than LLM2L. This pattern is consistent with the larger detection loss under H2L, but it does not establish that any single textual feature causes the loss. First Author et al.: Preprint submitted to ElsevierPage 16 of 27 ARB-Dataset Table 10 Textual change induced by the two rewriting paths. H2L measures the transformation from Human to H2L, whereas LLM2L measures the transformation from Free-LLM to LLM2L. Values report mean estimates with 95% confidence intervals. AspectHuman→ H2L Free-LLM→ LLM2L Interpretation Word ratio0.798 [0.746, 0.845]0.887 [0.857, 0.916]More compression in H2L Token NED0.602 [0.575, 0.628]0.348 [0.301, 0.395]Greater surface change in H2L Jaccard overlap0.463 [0.436, 0.489]0.587 [0.534, 0.648]Less vocabulary overlap in H2L Semantic similarity 0.886 [0.866, 0.904]0.949 [0.939, 0.958]LLM2L is more conservative Word ratioNED tokenJaccardSemantic similarity Metric 0.0 0.2 0.4 0.6 0.8 1.0 Mean metric value 0.798 0.602 0.463 0.886 0.887 0.348 0.587 0.949 HUMAN → H2LFREE-LLM → LLM2L Figure 5: Textual change induced by the two rewriting paths. H2L corresponds to Human→ H2L, whereas LLM2L corresponds to Free-LLM→ LLM2L. The figure shows that H2L introduces stronger surface changes, while LLM2L is a more conservative second-pass rewrite. Error bars denote block-structured bootstrap 95% confidence intervals. 7. Discussion The results have implications for detector robustness, benchmark validity, and deployment under LLM-mediated rewriting. Section 7.3 makes explicit how these results advance theory relative to prior paraphrase-robustness and benchmark-transfer work, and what they imply for detector selection and deployment in practice. 7.1. Interpretation The main empirical finding is a benchmark-transfer failure: standard HUMAN vs. FREE-LLM evaluation overesti- mates robustness when the target includes human-origin LLM-mediated rewriting. FastDetectGPT, Binoculars-falcon- 7b, and RADAR remain comparatively stable under same-generator LLM2L but degrade sharply under H2L, so an additional LLM pass does not by itself make LLM-origin text resemble the harder H2L condition. This is a benchmark- transfer failure across matched regimes, however, not a pure causal effect of source origin. H2L also changes its source more extensively than LLM2L (Section 6.6), so the H2L–LLM2L gap should be read as an operational source-origin-associated gap under LLM-mediated surface, rather than as evidence that source origin alone causes degradation; isolating source origin would require rewriting conditions explicitly matched on transformation strength (see Section 7.5 for how this bears on interpretation). Two independent detection-method literatures corroborate the direction of this asymmetry through an entirely different mechanism, rewrite-induced similarity or edit distance rather than classifier scoring. Huang et al. (2025b) show that a model’s own rewrite of its output stays measurably closer to that model’s typical generations than any human text, stable across generator families, decoding temperatures, and top-푝 values. RAIDAR (Mao et al., 2024) and its generalization L2R (Hao et al., 2025) build on the complementary premise, that human-origin text is edited more than LLM-origin text under LLM rewriting, to construct a detector directly from that edit distance, validating the asymmetry across 21 domains and four generator families. Where we treat this asymmetry as a source of benchmark-transfer failure for existing classifier-based detectors, these works treat it as an exploitable detection signal in its own right; together, First Author et al.: Preprint submitted to ElsevierPage 17 of 27 ARB-Dataset the two perspectives suggest that content-origin sensitivity under LLM-mediated rewriting is a structural property of current LLMs rather than an artifact of any one detector or dataset. 7.2. Comparison with prior benchmarks Prior work shows that detector performance is sensitive to paraphrasing, rewriting, adversarial prompting, and benchmark construction (Krishna et al., 2023; Sadasivan et al., 2025; Shi et al., 2024; Dugan et al., 2024). PADBen studies paraphrase attack trajectories for human- and LLM-authored content, while HLPC measures the effects of human and LLM paraphrases at a 1% FPR operating point (Zha et al., 2025; Lau and Zubiaga, 2025). ARB complements these studies by treating the problem as benchmark transfer: whether performance under conventional direct generation predicts performance across matched LLM-mediated authorship–surface regimes under a shared human reference distribution. The same-generator LLM2L control makes this a matched comparison of two LLM- mediated regimes within each dataset–generator block, revealing an asymmetry consistent with PADBen’s distinction between authorship obfuscation and plagiarism evasion while avoiding a pooled “rewritten” class that would conceal differences between human- and LLM-origin inputs (Zha et al., 2025); the contribution is therefore not another demonstration that rewriting reduces detection performance, but evidence that direct-generation benchmarks transfer differently to two distinct rewriting paths. The content-origin/linguistic-surface distinction underlying Table 2 echoes the genesis-based notion taxonomy of Dycke et al. (2026), who likewise separate what a text’s tokens objectively are from the normative target a detector is asked to recognize, and who recommend that notion parameters, such as the minimum AI-token ratio required to call a document AI-generated, be stated explicitly rather than left implicit in the data-generation procedure. Our four-regime design can be read as instantiating their document-level notion twice, once with a human genesis and once with an LLM genesis, specifically to isolate the transfer gap between the two; our regime labels play the same explicitness role for the content-origin/surface-mediation split as their 휏 plays for genesis granularity. A related asymmetry appears in Baidya et al. (2026)’s humanization study: rewriting already-LLM-generated text with a separate instruction-tuned model leaves AUROC unchanged or higher at light intensity for every detector, and even their heaviest setting keeps every detector above AUROC 0.857, consistent with our own LLM2L results, where an LLM-mediated second pass over LLM-origin text produces only a small ΔTPR@1%FPR relative to FREE-LLM (Section 6.3). Because their rewriting is applied exclusively to LLM-origin text, their result cannot indicate whether the same pipeline applied to human-origin text would reproduce the much sharper H2L-style degradation we observe; ARB’s matched design is what makes that comparison possible. 7.3. Theoretical and Practical Implications Theoretical implications. The core theoretical contribution is reframing paraphrase robustness as a benchmark- transfer problem rather than a single robustness scalar. Prior paraphrase-robustness studies typically report one degradation curve per detector under an increasingly aggressive rewriter (Krishna et al., 2023; Sadasivan et al., 2025; Shi et al., 2024), which conflates two logically independent quantities: how much a rewriting step changes the surface form, and whether the content being rewritten originated from a human or a machine. ARB’s matched four-regime design separates these quantities by holding the rewriting instruction and generator fixed while varying only the origin of the input text (H2L vs. LLM2L). This isolates a previously under-specified property of current detectors and LLMs: detector scores are sensitive to content origin under LLM-mediated surface, not only to surface distance from the training distribution of direct machine text. This complements the rewrite-similarity and edit-distance mechanisms proposed by Huang et al. (2025b), Mao et al. (2024), and Hao et al. (2025) (Section 7.1) with a classifier-level demonstration of the same asymmetry, suggesting that content-origin sensitivity is a structural property of the human- LLM rewriting relationship rather than an artifact specific to one detection paradigm (statistical, watermark-based, or edit-distance-based). It also refines the genesis-based notion framework of Dycke et al. (2026): our results show empirically, rather than only conceptually, why a fixed genesis label and a fixed detection notion need to be crossed explicitly, since the same nominal “LLM-involved” text can sit far apart in detectability depending on which side of the human/LLM boundary supplied the original content. Practical implications. These findings have direct consequences for how detectors are selected, evaluated, and deployed. First, procurement and audit decisions that rely on HUMAN vs. FREE-LLM benchmarks alone (the current de facto standard reported by most detector papers) risk substantially overestimating robustness for the increasingly common case of human drafts revised by an LLM, a workflow now standard in academic, journalistic, and professional First Author et al.: Preprint submitted to ElsevierPage 18 of 27 ARB-Dataset writing. A detector that looks strong under direct-generation testing, such as FastDetectGPT or Binoculars-falcon- 7b, can lose most of its low-FPR recall under H2L without any change in its published AUROC on the vendor’s own benchmark. Second, the H2L–LLM2L gap gives practitioners a concrete pre-deployment test: before trusting a detector in a setting where human-authored, LLM-polished text is in scope (e.g., plagiarism review, academic integrity, or content-provenance pipelines), the detector should be evaluated on an H2L-style condition specifically, not inferred from FREE-LLM or LLM2L results. Third, because degradation is uneven across detector families (RADAR and Binoculars degrade more under H2L than under adversarial LLM2L-style rewriting; BERT/RoBERTa baselines are weak throughout), a single aggregate leaderboard score is an unreliable basis for tool selection; deployers need regime- , domain-, and generator-stratified numbers of the kind ARB reports. We detail the operating-point and reporting practices that follow from this in Section 7.4. 7.4. Validity and deployment implications AUROC and TPR@1%FPR capture different aspects of robustness. A detector may retain some global ranking ability while recovering few positives at a threshold constrained to misclassify only 1% of human texts, a distinction that matters where false accusations carry fairness costs, including documented bias against non-native English writers (Liang et al., 2023), and that supports recent calls to assess low-FPR recall or threshold stability rather than treat detector scores as conclusive evidence (Kirchner et al., 2023; Lau and Zubiaga, 2025; Ayoobi et al., 2025; Chen et al., 2025b; Masrour et al., 2025). At this operating point, detector families separate clearly, and not always in the direction a paraphrase-robustness label would suggest. RADAR, although designed for paraphrase robustness (Hu et al., 2023), remains reliable under LLM2L but degrades under H2L; this stability under LLM2L should be read against its attacker model, since our FREE-LLM→LLM2L rewrite is a plain, meaning-preserving instruction with no detector-evasion objective, whereas a detector-in-the-loop attack that explicitly selects paraphrase candidates to minimize a target detector’s score drives RADAR’s accuracy from 90.0% to 45.4% on the same class of LLM-generated text (Huang et al., 2025a). The two results isolate different factors, content origin in our matched design and an explicit adversarial objective in theirs, and together suggest that RADAR’s paraphrase robustness holds for non-adversarial LLM-mediated rewriting but not for rewriting optimized against it. The supervised BERT/RoBERTa baselines provide little utility across regimes, consistent with concerns about distribution shift and benchmark transfer (Pu et al., 2023; Li et al., 2024; Schaaff et al., 2024) and with a broader pattern in which the same backbones reach near-ceiling in-domain scores yet degrade sharply once the evaluation distribution shifts (Mady et al., 2026); here the shift is content origin under a fixed low-FPR bar, which BERT-Defense and RoBERTa-Defense fail to clear even in the FREE-LLM baseline. Robustness cannot be reduced to detector family alone: the block-level analyses show substantial dataset effects and less uniform generator effects, in line with evidence that rankings change with domain, generator, task, and metric (Dugan et al., 2024; Wu et al., 2024; Pröhl et al., 2024; Stowe and Patil, 2026; Baidya et al., 2026; Mady et al., 2026), so aggregate results should be accompanied by stratified diagnostics rather than interpreted as regime- or domain-invariant properties. These patterns motivate concrete evaluation and deployment practice. Benchmarks should define the positive class explicitly, reporting FREE-LLM, H2L, and LLM2L separately rather than collapsing them into one LLM-involved class, and should preserve the matched structure of the data: compute regime deltas within dataset × generator blocks, distinguish macro-averages from pooled estimates, report uncertainty that respects the hierarchy, and retain domain- and generator-level diagnostics, aligning with emerging benchmarks centered on robustness, domain shift, and mixed authorship (Wang et al., 2024a; Ayoobi et al., 2025; Zha et al., 2025). Holding TPR@1%FPR at a single, fixed 1% threshold across all regimes, datasets, and generators mirrors an independently converging recommendation to calibrate a decision threshold once on held-out data and keep it fixed rather than re-tuned per target distribution, since re-tuning at test time can otherwise mask the operating-point trade-offs that matter for deployment (Mady et al., 2026). The same distinctions apply in deployment: detector scores are not regime-invariant evidence of machine authorship, so validation data should reflect the intended use case and include human-origin revised text whenever it is in scope, and reports should present performance at a prespecified false-positive constraint, false-positive behavior on relevant human populations, domain-specific estimates, and uncertainty. Given the residual error and distribution sensitivity observed here, detector output is better treated as one uncertain signal than as a stand-alone basis for high-stakes authorship judgments. First Author et al.: Preprint submitted to ElsevierPage 19 of 27 ARB-Dataset 7.5. Threats to Validity and Limitations Construct validity. The benchmark evaluates score separability between HUMAN texts and texts produced or mediated by LLMs. It does not establish that a detector identifies a single construct such as authorship, intent, originality, plagiarism, or amount of AI assistance. We mitigate this risk by defining four explicit regimes in terms of content origin and linguistic surface, and by interpreting detector scores as regime-specific separability estimates rather than as direct authorship judgments. This distinction is especially important for H2L, where the content is human-origin but the final linguistic surface is LLM-mediated. Internal validity. Prompt wording, decoding settings, source preprocessing, and sampling can affect the final text distribution. We mitigate these risks through fixed prompts, fixed decoding settings, matched source items, generator- specific blocks, seeded length-stratified sampling, and a single preprocessing pipeline applied before sampling. Nevertheless, different rewriting prompts, temperatures, decoding strategies, or preprocessing choices could produce different surface properties. Residual formatting artifacts or source-specific cues cannot be ruled out completely. The same-generator LLM2L condition controls the second pass within each generator family, but it does not cover cross- model rewriting, multi-step rewriting, or human-edited rewriting. Because no post-hoc semantic or length filtering was applied to the released generated texts (Section 4.7), a small union of 0.67% of generated texts are atypically short, refusal-like, or non-English; at the sample sizes used for block-level and macro-averaged estimation, this is expected to contribute negligible additional noise, but it remains a residual source of measurement error at the level of individual scored items. Transformation-strength confounding. A central limitation is that H2L induces stronger surface change than same-generator LLM2L (Token NED 0.602 vs. 0.348; Jaccard overlap 0.463 vs. 0.587). We mitigate this issue by reporting textual transformation diagnostics and by avoiding a causal claim that source origin alone explains the H2L– LLM2L gap. The current design supports a source-origin-associated interpretation, but it does not fully disentangle source origin from transformation intensity. A stronger design would include same-intensity rewriting conditions or additional controls that explicitly match transformation strength across H2L and LLM2L. Implementation validity. Detectors were evaluated using released implementations or paper-recommended configurations whenever available, with hardware-driven adjustments only for execution feasibility. We mitigate imple- mentation bias by keeping each detector configuration fixed across all regimes, datasets, and generator models, so that detector retuning does not confound comparisons among FREE-LLM, H2L, and LLM2L. However, implementation details such as maximum observed sequence length, numerical precision, quantization, tokenizer behavior, and library versions can affect detector scores. The reported results should therefore be interpreted as estimates for the evaluated implementations, not as universal properties of the underlying detector families. External validity. The benchmark uses English texts from XSum, WritingPrompts, and OpenWebText; four open- weight generator families; and the detector implementations listed in Table 6. We mitigate over-specialization by using multiple domains, multiple generator families, and complementary detector families. However, the results should not be generalized without further evaluation to other languages, longer documents, specialized professional domains, closed-source generators, multimodal content, or detectors trained specifically on H2L examples. Bilingual evidence from CUDRT indicates that language and operation type are both first-order factors for detector generalization (Tao et al., 2026), so the English-only scope here is a substantive limitation rather than a minor one. The dataset choices provide domain diversity, but they are not exhaustive. Statistical conclusion validity. The data are matched at the dataset × generator block level, and regime compar- isons share source material within each block. Treating pooled texts as independent would understate uncertainty and obscure the paired design. We mitigate this risk by using block-level estimates, paired deltas within blocks, macro- averages across blocks, and a block-structured bootstrap with 5,000 resamples for confidence intervals. These intervals quantify uncertainty in aggregate estimates, but they do not replace block-level heterogeneity analysis. Because multiple detector-regime comparisons are reported, results should be interpreted as benchmark estimates rather than as isolated null-hypothesis tests. Benchmark realism and deployment representativeness. H2L and LLM2L approximate controlled rewriting workflows, but real users may interact with LLMs iteratively, manually edit outputs, combine multiple models, use different instructions, or mix generated and human-written passages within a single document. We mitigate this limitation by operationally varying authorship and surface regimes in a matched design, which is more realistic than direct-generation-only evaluation. However, the benchmark remains a controlled approximation of human–LLM writing workflows rather than an observational study of real-world writing behavior. First Author et al.: Preprint submitted to ElsevierPage 20 of 27 ARB-Dataset 7.6. Ethical Considerations This work is intended to improve the evaluation of AI-text detectors and to reduce overconfident deployment under distribution shift. The benchmark involves generation and rewriting procedures that could also be interpreted as evasion-relevant. We mitigate this dual-use risk by framing rewriting as an evaluation condition, reporting detector-side implications, and avoiding operational guidance for bypassing deployed systems. ARB’s scope is therefore narrower than dedicated evasion research: unlike gradient-based evaders explicitly optimized against a victim detector and demonstrated against deployed commercial systems (Meng et al., 2025), our H2L and LLM2L rewrites use a single fixed, non-adversarial instruction with no detector in the loop, and we do not target or report evasion rates against any specific product. The study uses existing public datasets and locally generated text variants; no human subjects or user studies are involved. The released ARB assets are intended for scientific benchmarking, auditing, and robustness evaluation rather than for high-stakes authorship accusations or operational bypassing of deployed systems. Dataset licenses and provenance are documented in the released artifacts. 8. Conclusion This paper presented a matched quantitative benchmark of AI-text detectors across authorship and rewriting regimes. ARB operationally contrasts HUMAN, FREE-LLM, H2L, and same-generator LLM2L under a benchmark- transfer design. The study evaluates existing detectors as objects of benchmarking and reports TPR@1%FPR, AUROC, paired deltas, and operational H2L–LLM2L gaps over dataset × generator blocks. The results show that performance estimated under the standard HUMAN vs. FREE-LLM condition does not necessarily transfer to H2L. FastDetectGPT, Binoculars-falcon-7b, and RADAR perform well on direct LLM generation and remain substantially closer to that baseline under LLM2L, but lose much more low-FPR recall under H2L. BERT-Defense and RoBERTa-Defense remain weak at TPR@1%FPR across regimes. The comparison between H2L and LLM2L suggests that rewriting alone does not fully explain the degradation; source origin and transformation strength both plausibly contribute to the gap (Section 7.1). These findings support detector evaluations that include human-origin rewriting, same-generator second-pass controls, block-level paired deltas, domain and generator breakdowns, and low false-positive operating points in addition to AUROC. This recommendation is consistent with recent benchmark work emphasizing mixed-authorship text, humanization, detector stability, and metric sensitivity (Wang et al., 2024a; Masrour et al., 2025; Ayoobi et al., 2025; Stowe and Patil, 2026). The results also support a more precise deployment vocabulary: direct machine generation and LLM-mediated rewriting are not equivalent detection targets. Future work should extend ARB along three main directions. First, stronger causal isolation of source origin requires same-intensity rewriting controls, in which H2L and LLM2L are matched not only by the source item and the generator block but also by the transformation strength. Second, broader external validation should include additional languages, longer documents, specialized professional domains, closed-source generators, cross-model rewriting, and mixed-authorship documents with paragraph- or sentence-level attribution. Third, future detector evaluations should test whether detectors trained or calibrated on H2L examples generalize to unseen rewriting styles, domains, and generators, rather than only improving on the specific benchmark distribution. Declaration of Generative AI and AI-assisted Technologies in the Writing Process During the preparation of this work, the authors used generative AI and AI-assisted writing tools to support language editing, improve readability, and refine the manuscript’s academic presentation. These tools were used for wording, grammar, stylistic revision, and organizing explanatory text. Generative AI tools were also used to assist with non-substantive drafting support, such as improving section transitions, clarifying methodological descriptions, and formatting parts of the manuscript. They were not used to generate the experimental results, detector scores, statistical estimates, tables, or figures reported in the study. The benchmark construction, detector evaluation, metric computation, bootstrap analysis, and interpretation of results were conducted and verified by the authors. All AI-assisted content was reviewed, edited, and validated by the authors to ensure accuracy, consistency with the experimental evidence, and alignment with the paper’s claims. The authors take full responsibility for the content of the manuscript. First Author et al.: Preprint submitted to ElsevierPage 21 of 27 ARB-Dataset Data Availability The text dataset underlying ARB is publicly released on Hugging Face 1 The public release contains all four regimes used in the benchmark (HUMAN, FREE-LLM, H2L, and LLM2L) and is distributed as a Hugging Face-compatible Parquet dataset that can be loaded directly with the datasets library. Each released row corresponds to one text sample and includes stable identifiers, the text, regime labels, content-origin and surface-origin labels, source-dataset provenance, generator-model metadata, source and pairing indices, a normalized-text SHA-256 hash, and word-count metadata. The release exposes the fields id, text, label, label_id, regime, source_dataset, source_dataset_short, generator_model, source_index, pair_id, text_sha256, and word_count. The released ARB text collection is derived from XSum, WritingPrompts, and OpenWebText, and includes rewrites produced by Gemma 2 9B, Llama 3.2 3B, Mistral 7B, and Qwen2.5 7B. The source code for data processing, evaluation, and figure/table reproduction is released separately in the Git repository (https://anonymous.4open.science/r/ arb-0E1C/). The public dataset and repository jointly provide the text samples, pairing metadata, detector scores, block-level metrics, configuration files, and reproduction scripts required to reproduce the analyses reported in this paper. The configuration files are fixed using the Hydra Python configuration framework (Yadan, 2019). The framework ensures reproducible, explicit settings for the dataset, generator, detector, decoding, and bootstrap. The dataset is released under the Apache License 2.0, with the caveat that users remain responsible for respecting the licenses and usage terms of the original source datasets (XSum, WritingPrompts, and OpenWebText; licensing details for each are reported in Section 4.7). References Ayoobi, N., Shahriar, S., Mukherjee, A. (2025). Beyond Easy Wins: A Text Hardness-Aware Benchmark for LLM-generated Text Detection. [Preprint]. arXiv. https://doi.org/10.48550/arXiv.2507.15286. Baidya, M.S., Baidya, S.S., Chawla, C. (2026). Detecting the Machine: A Comprehensive Benchmark of AI-Generated Text Detectors Across Architectures, Domains, and Adversarial Conditions. [Preprint]. arXiv. https://doi.org/10.48550/arXiv.2603.17522. Bao, G., Zhao, Y., Teng, Z., Yang, L., Zhang, Y. (2024). Fast-DetectGPT: Efficient Zero-Shot Detection of Machine-Generated Text via Conditional Probability Curvature, in: The Twelfth International Conference on Learning Representations. Chen, Z., Feng, Y., He, C., Deng, Y., Pu, H., Li, B. (2025a). IPAD: Inverse Prompt for AI Detection – A Robust and Explainable LLM-Generated Text Detector. [Preprint]. arXiv. https://doi.org/10.48550/arXiv.2502.15902. Chen, Z., He, K., Huang, Y., Zhu, Y., Feng, M. (2025b). DivScore: Zero-Shot Detection of LLM-Generated Text in Specialized Domains, in: Christodoulopoulos, C., Chakraborty, T., Rose, C., Peng, V. (Eds.), Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing, Association for Computational Linguistics, Suzhou, China. p. 19231–19253. https://doi.org/10.18653/v1/2025. emnlp-main.971. Chung, J., Kamar, E., Amershi, S. (2023). Increasing Diversity While Maintaining Accuracy: Text Data Generation with Large Language Models and Human Interventions, in: Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), Association for Computational Linguistics, Toronto, Canada. p. 575–593. https://doi.org/10.18653/v1/2023.acl-long.34. Dugan, L., Hwang, A., Trhlik, F., Ludan, J.M., Zhu, A., Xu, H., Ippolito, D., Callison-Burch, C. (2024). RAID: A Shared Benchmark for Robust Evaluation of Machine-Generated Text Detectors, in: Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), Association for Computational Linguistics, Bangkok, Thailand. p. 12463–12492. https://doi.org/10.18653/ v1/2024.acl-long.674. Dycke, N., Sakharova, M., Daheim, N., Gurevych, I. (2026). ’Your AI Text is not Mine’: Redefining and Evaluating AI-generated Text Detection under Realistic Assumptions. [Preprint]. arXiv. https://doi.org/10.48550/arXiv.2606.04906. Fan, A., Lewis, M., Dauphin, Y. (2018). Hierarchical Neural Story Generation, in: Gurevych, I., Miyao, Y. (Eds.), Proceedings of the 56th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), Association for Computational Linguistics, Melbourne, Australia. p. 889–898. https://doi.org/10.18653/v1/P18-1082. Gehrmann, S., Strobelt, H., Rush, A.M. (2019). GLTR: Statistical Detection and Visualization of Generated Text, in: Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics: System Demonstrations, Association for Computational Linguistics, Florence, Italy. p. 111–116. https://doi.org/10.18653/v1/P19-3019. Gokaslan, A., Cohen, V., Pavlick, E., Tellex, S. (2019). OpenWebText Corpus. http://Skylion007.github.io/OpenWebTextCorpus. Grattafiori, A., Dubey, A., Jauhri, A., Pandey, A., Kadian, A., Al-Dahle, A., Letman, A., Mathur, A., Schelten, A., Vaughan, A., Yang, A., Fan, A., Goyal, A., Hartshorn, A., Yang, A., Mitra, A., Sravankumar, A., Korenev, A., Hinsvark, A., Rao, A., Zhang, A., Rodriguez, A., Gregerson, A., Spataru, A., Roziere, B., Biron, B., Tang, B., Chern, B., Caucheteux, C., Nayak, C., Bi, C., Marra, C., McConnell, C., Keller, C., Touret, C., Wu, C., Wong, C., Ferrer, C.C., Nikolaidis, C., Allonsius, D., Song, D., Pintz, D., Livshits, D., Wyatt, D., Esiobu, D., Choudhary, D., Mahajan, D., Garcia-Olano, D., Perino, D., Hupkes, D., Lakomkin, E., AlBadawy, E., Lobanova, E., Dinan, E., Smith, E.M., Radenovic, F., Guzmán, F., Zhang, F., Synnaeve, G., Lee, G., Anderson, G.L., Thattai, G., Nail, G., Mialon, G., Pang, G., Cucurell, G., Nguyen, H., Korevaar, H., Xu, H., Touvron, H., Zarov, I., Ibarra, I.A., Kloumann, I., Misra, I., Evtimov, I., Zhang, J., Copet, J., Lee, J., Geffert, J., Vranes, J., Park, J., Mahadeokar, 1 The url will be inserted after the anonymized review process First Author et al.: Preprint submitted to ElsevierPage 22 of 27 ARB-Dataset J., Shah, J., van der Linde, J., Billock, J., Hong, J., Lee, J., Fu, J., Chi, J., Huang, J., Liu, J., Wang, J., Yu, J., Bitton, J., Spisak, J., Park, J., Rocca, J., Johnstun, J., Saxe, J., Jia, J., Alwala, K.V., Prasad, K., Upasani, K., Plawiak, K., Li, K., Heafield, K., Stone, K., El-Arini, K., Iyer, K., Malik, K., Chiu, K., Bhalla, K., Lakhotia, K., Rantala-Yeary, L., van der Maaten, L., Chen, L., Tan, L., Jenkins, L., Martin, L., Madaan, L., Malo, L., Blecher, L., Landzaat, L., de Oliveira, L., Muzzi, M., Pasupuleti, M., Singh, M., Paluri, M., Kardas, M., Tsimpoukelli, M., Oldham, M., Rita, M., Pavlova, M., Kambadur, M., Lewis, M., Si, M., Singh, M.K., Hassan, M., Goyal, N., Torabi, N., Bashlykov, N., Bogoychev, N., Chatterji, N., Zhang, N., Duchenne, O., Çelebi, O., Alrassy, P., Zhang, P., Li, P., Vasic, P., Weng, P., Bhargava, P., Dubal, P., Krishnan, P., Koura, P.S., Xu, P., He, Q., Dong, Q., Srinivasan, R., Ganapathy, R., Calderer, R., Cabral, R.S., Stojnic, R., Raileanu, R., Maheswari, R., Girdhar, R., Patel, R., Sauvestre, R., Polidoro, R., Sumbaly, R., Taylor, R., Silva, R., Hou, R., Wang, R., Hosseini, S., Chennabasappa, S., Singh, S., Bell, S., Kim, S.S., Edunov, S., Nie, S., Narang, S., Raparthy, S., Shen, S., Wan, S., Bhosale, S., Zhang, S., Vandenhende, S., Batra, S., Whitman, S., Sootla, S., Collot, S., Gururangan, S., Borodinsky, S., Herman, T., Fowler, T., Sheasha, T., Georgiou, T., Scialom, T., Speckbacher, T., Mihaylov, T., Xiao, T., Karn, U., Goswami, V., Gupta, V., Ramanathan, V., Kerkez, V., Gonguet, V., Do, V., Vogeti, V., Albiero, V., Petrovic, V., Chu, W., Xiong, W., Fu, W., Meers, W., Martinet, X., Wang, X., Wang, X., Tan, X.E., Xia, X., Xie, X., Jia, X., Wang, X., Goldschlag, Y., Gaur, Y., Babaei, Y., Wen, Y., Song, Y., Zhang, Y., Li, Y., Mao, Y., Coudert, Z.D., Yan, Z., Chen, Z., Papakipos, Z., Singh, A., Srivastava, A., Jain, A., Kelsey, A., Shajnfeld, A., Gangidi, A., Victoria, A., Goldstand, A., Menon, A., Sharma, A., Boesenberg, A., Baevski, A., Feinstein, A., Kallet, A., Sangani, A., Teo, A., Yunus, A., Lupu, A., Alvarado, A., Caples, A., Gu, A., Ho, A., Poulton, A., Ryan, A., Ramchandani, A., Dong, A., Franco, A., Goyal, A., Saraf, A., Chowdhury, A., Gabriel, A., Bharambe, A., Eisenman, A., Yazdan, A., James, B., Maurer, B., Leonhardi, B., Huang, B., Loyd, B., Paola, B.D., Paranjape, B., Liu, B., Wu, B., Ni, B., Hancock, B., Wasti, B., Spence, B., Stojkovic, B., Gamido, B., Montalvo, B., Parker, C., Burton, C., Mejia, C., Liu, C., Wang, C., Kim, C., Zhou, C., Hu, C., Chu, C.H., Cai, C., Tindal, C., Feichtenhofer, C., Gao, C., Civin, D., Beaty, D., Kreymer, D., Li, D., Adkins, D., Xu, D., Testuggine, D., David, D., Parikh, D., Liskovich, D., Foss, D., Wang, D., Le, D., Holland, D., Dowling, E., Jamil, E., Montgomery, E., Presani, E., Hahn, E., Wood, E., Le, E.T., Brinkman, E., Arcaute, E., Dunbar, E., Smothers, E., Sun, F., Kreuk, F., Tian, F., Kokkinos, F., Ozgenel, F., Caggioni, F., Kanayet, F., Seide, F., Florez, G.M., Schwarz, G., Badeer, G., Swee, G., Halpern, G., Herman, G., Sizov, G., Guangyi, Zhang, Lakshminarayanan, G., Inan, H., Shojanazeri, H., Zou, H., Wang, H., Zha, H., Habeeb, H., Rudolph, H., Suk, H., Aspegren, H., Goldman, H., Zhan, H., Damlaj, I., Molybog, I., Tufanov, I., Leontiadis, I., Veliche, I.E., Gat, I., Weissman, J., Geboski, J., Kohli, J., Lam, J., Asher, J., Gaya, J.B., Marcus, J., Tang, J., Chan, J., Zhen, J., Reizenstein, J., Teboul, J., Zhong, J., Jin, J., Yang, J., Cummings, J., Carvill, J., Shepard, J., McPhie, J., Torres, J., Ginsburg, J., Wang, J., Wu, K., U, K.H., Saxena, K., Khandelwal, K., Zand, K., Matosich, K., Veeraraghavan, K., Michelena, K., Li, K., Jagadeesh, K., Huang, K., Chawla, K., Huang, K., Chen, L., Garg, L., A, L., Silva, L., Bell, L., Zhang, L., Guo, L., Yu, L., Moshkovich, L., Wehrstedt, L., Khabsa, M., Avalani, M., Bhatt, M., Mankus, M., Hasson, M., Lennie, M., Reso, M., Groshev, M., Naumov, M., Lathi, M., Keneally, M., Liu, M., Seltzer, M.L., Valko, M., Restrepo, M., Patel, M., Vyatskov, M., Samvelyan, M., Clark, M., Macey, M., Wang, M., Hermoso, M.J., Metanat, M., Rastegari, M., Bansal, M., Santhanam, N., Parks, N., White, N., Bawa, N., Singhal, N., Egebo, N., Usunier, N., Mehta, N., Laptev, N.P., Dong, N., Cheng, N., Chernoguz, O., Hart, O., Salpekar, O., Kalinli, O., Kent, P., Parekh, P., Saab, P., Balaji, P., Rittner, P., Bontrager, P., Roux, P., Dollar, P., Zvyagina, P., Ratanchandani, P., Yuvraj, P., Liang, Q., Alao, R., Rodriguez, R., Ayub, R., Murthy, R., Nayani, R., Mitra, R., Parthasarathy, R., Li, R., Hogan, R., Battey, R., Wang, R., Howes, R., Rinott, R., Mehta, S., Siby, S., Bondu, S.J., Datta, S., Chugh, S., Hunt, S., Dhillon, S., Sidorov, S., Pan, S., Mahajan, S., Verma, S., Yamamoto, S., Ramaswamy, S., Lindsay, S., Lindsay, S., Feng, S., Lin, S., Zha, S.C., Patil, S., Shankar, S., Zhang, S., Zhang, S., Wang, S., Agarwal, S., Sajuyigbe, S., Chintala, S., Max, S., Chen, S., Kehoe, S., Satterfield, S., Govindaprasad, S., Gupta, S., Deng, S., Cho, S., Virk, S., Subramanian, S., Choudhury, S., Goldman, S., Remez, T., Glaser, T., Best, T., Koehler, T., Robinson, T., Li, T., Zhang, T., Matthews, T., Chou, T., Shaked, T., Vontimitta, V., Ajayi, V., Montanez, V., Mohan, V., Kumar, V.S., Mangla, V., Ionescu, V., Poenaru, V., Mihailescu, V.T., Ivanov, V., Li, W., Wang, W., Jiang, W., Bouaziz, W., Constable, W., Tang, X., Wu, X., Wang, X., Wu, X., Gao, X., Kleinman, Y., Chen, Y., Hu, Y., Jia, Y., Qi, Y., Li, Y., Zhang, Y., Zhang, Y., Adi, Y., Nam, Y., Yu, Wang, Zhao, Y., Hao, Y., Qian, Y., Li, Y., He, Y., Rait, Z., DeVito, Z., Rosnbrick, Z., Wen, Z., Yang, Z., Zhao, Z., Ma, Z. (2024). The Llama 3 Herd of Models. [Preprint]. arXiv. https://doi.org/10.48550/arXiv.2407.21783. Hans, A., Schwarzschild, A., Cherepanova, V., Kazemi, H., Saha, A., Goldblum, M., Geiping, J., Goldstein, T. (2024). Spotting LLMs with Binoculars: Zero-Shot Detection of Machine-Generated Text, in: Proceedings of the 41st International Conference on Machine Learning, PMLR. p. 17519–17537. https://proceedings.mlr.press/v235/hans24a.html. Hao, W., Li, R., Zhao, W., Yang, J., Mao, C. (2025). Learning to Rewrite: Generalized LLM-Generated Text Detection, in: Che, W., Nabende, J., Shutova, E., Pilehvar, M.T. (Eds.), Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), Association for Computational Linguistics, Vienna, Austria. p. 6421–6434. https://doi.org/10.18653/v1/2025.acl-long. 322. Hu, X., Chen, P.Y., Ho, T.Y. (2023). RADAR: Robust AI-text Detection via Adversarial Learning, in: Proceedings of the 37th International Conference on Neural Information Processing Systems, Curran Associates Inc., Red Hook, NY, USA. p. 15077–15095. Huang, J., Zhang, R., Su, J., Chen, Y. (2025a). TempParaphraser: “Heating Up” Text to Evade AI-Text Detection through Paraphrasing, in: Christodoulopoulos, C., Chakraborty, T., Rose, C., Peng, V. (Eds.), Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing, Association for Computational Linguistics, Suzhou, China. p. 31554–31573. https://doi.org/10.18653/v1/2025. emnlp-main.1607. Huang, Y., Cao, J., Luo, H., Guan, X., Liu, B. (2025b). MAGRET: Machine-generated Text Detection with Rewritten Texts, in: Rambow, O., Wanner, L., Apidianaki, M., Al-Khalifa, H., Eugenio, B.D., Schockaert, S. (Eds.), Proceedings of the 31st International Conference on Computational Linguistics, Association for Computational Linguistics, Abu Dhabi, UAE. p. 8336–8346. https://aclanthology.org/ 2025.coling-main.557/. Ippolito, D., Duckworth, D., Callison-Burch, C., Eck, D. (2020). Automatic Detection of Generated Text is Easiest when Humans are Fooled, in: Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, Association for Computational Linguistics, Online. p. 1808–1822. https://doi.org/10.18653/v1/2020.acl-main.164. Jiang, A.Q., Sablayrolles, A., Mensch, A., Bamford, C., Chaplot, D.S., de las Casas, D., Bressand, F., Lengyel, G., Lample, G., Saulnier, L., Lavaud, L.R., Lachaux, M.A., Stock, P., Le Scao, T., Lavril, T., Wang, T., Lacroix, T., El Sayed, W. (2023). Mistral 7B. [Preprint]. arXiv. https://doi.org/10.48550/arXiv.2310.06825. First Author et al.: Preprint submitted to ElsevierPage 23 of 27 ARB-Dataset Kirchner, J.H., Ahmad, L., Aaronson, S., Leike, J. (2023). New AI classifier for indicating AI-written text. https://openai.com/index/ new-ai-classifier-for-indicating-ai-written-text/. Accessed: 16-Apr-2025. Krishna, K., Song, Y., Karpinska, M., Wieting, J., Iyyer, M. (2023). Paraphrasing evades detectors of AI-generated text, but retrieval is an effective defense, in: Proceedings of the 37th International Conference on Neural Information Processing Systems, Curran Associates Inc., Red Hook, NY, USA. p. 27469–27500. Lau, H.T., Zubiaga, A. (2025). Understanding the effects of human-written paraphrases in LLM-generated text detection. Natural Language Processing Journal 11, 100151. https://doi.org/https://doi.org/10.1016/j.nlp.2025.100151. Li, Y., Li, Q., Cui, L., Bi, W., Wang, Z., Wang, L., Yang, L., Shi, S., Zhang, Y. (2024). MAGE: Machine-generated Text Detection in the Wild, in: Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), Association for Computational Linguistics, Bangkok, Thailand. p. 36–53. https://doi.org/10.18653/v1/2024.acl-long.3. Liang, W., Yuksekgonul, M., Mao, Y., Wu, E., Zou, J. (2023). GPT detectors are biased against non-native English writers. Patterns 4, 100779. https://doi.org/https://doi.org/10.1016/j.patter.2023.100779. Mady, M., Reschke, J., Schuller, B. (2026). Feature-Augmented Transformers for Robust AI-Text Detection Across Domains and Generators. [Preprint]. arXiv. https://doi.org/10.48550/arXiv.2605.03969. Mao, C., Vondrick, C., Wang, H., Yang, J. (2024). RAIDAR: generative AI detection via rewriting. [Preprint]. arXiv. https://doi.org/10. 48550/arXiv.2401.12970. Masrour, E., Emi, B.N., Spero, M. (2025). DAMAGE: Detecting Adversarially Modified AI Generated Text, in: Alam, F., Nakov, P., Habash, N., Gurevych, I., Chowdhury, S., Shelmanov, A., Wang, Y., Artemova, E., Kutlu, M., Mikros, G. (Eds.), Proceedings of the 1st Workshop on GenAI Content Detection (GenAIDetect), International Conference on Computational Linguistics, Abu Dhabi, UAE. p. 120–133. https: //aclanthology.org/2025.genaidetect-1.9/. Meng, W., Fan, S., Wei, C., Chen, M., Li, Y., Zhang, Y., Zhang, Z., Chen, W. (2025). GradEscape: A Gradient-Based Evader Against AI- Generated Text Detectors, in: 34th USENIX Security Symposium (USENIX Security 25), USENIX Association, Seattle, WA. p. 181–200. https://w.usenix.org/conference/usenixsecurity25/presentation/meng. Mesnard, T., Hardin, C., Dadashi, R., Bhupatiraju, S., Pathak, S., Sifre, L., Rivière, M., Kale, M.S., Love, J., Tafti, P., Hussenot, L., Sessa, P.G., Chowdhery, A., Roberts, A., Barua, A., Botev, A., Castro-Ros, A., Slone, A., Héliou, A., Tacchetti, A., Bulanova, A., Paterson, A., Tsai, B., Shahriari, B., Lan, C.L., Choquette-Choo, C.A., Crepy, C., Cer, D., Ippolito, D., Reid, D., Buchatskaya, E., Ni, E., Noland, E., Yan, G., Tucker, G., Muraru, G.C., Rozhdestvenskiy, G., Michalewski, H., Tenney, I., Grishchenko, I., Austin, J., Keeling, J., Labanowski, J., Lespiau, J.B., Stanway, J., Brennan, J., Chen, J., Ferret, J., Chiu, J., Mao-Jones, J., Lee, K., Yu, K., Millican, K., Sjoesund, L.L., Lee, L., Dixon, L., Reid, M., Mikuła, M., Wirth, M., Sharman, M., Chinaev, N., Thain, N., Bachem, O., Chang, O., Wahltinez, O., Bailey, P., Michel, P., Yotov, P., Chaabouni, R., Comanescu, R., Jana, R., Anil, R., McIlroy, R., Liu, R., Mullins, R., Smith, S.L., Borgeaud, S., Girgin, S., Douglas, S., Pandya, S., Shakeri, S., De, S., Klimenko, T., Hennigan, T., Feinberg, V., Stokowiec, W., hui Chen, Y., Ahmed, Z., Gong, Z., Warkentin, T., Peran, L., Giang, M., Farabet, C., Vinyals, O., Dean, J., Kavukcuoglu, K., Hassabis, D., Ghahramani, Z., Eck, D., Barral, J., Pereira, F., Collins, E., Joulin, A., Fiedel, N., Senter, E., Andreev, A., Kenealy, K. (2024). Gemma: Open Models Based on Gemini Research and Technology. [Preprint]. arXiv. https://doi.org/10.48550/arXiv.2403.08295. Mitchell, E., Lee, Y., Khazatsky, A., Manning, C.D., Finn, C. (2023). DetectGPT: Zero-Shot Machine-Generated Text Detection Using Probability Curvature, in: Proceedings of the 40th International Conference on Machine Learning, PMLR. p. 24950–24962. https://proceedings. mlr.press/v202/mitchell23a.html. Narayan, S., Cohen, S.B., Lapata, M. (2018). Don’t Give Me the Details, Just the Summary! Topic-Aware Convolutional Neural Networks for Extreme Summarization, in: Riloff, E., Chiang, D., Hockenmaier, J., Tsujii, J. (Eds.), Proceedings of the 2018 Conference on Empirical Methods in Natural Language Processing, Association for Computational Linguistics, Brussels, Belgium. p. 1797–1807. https://doi.org/10.18653/ v1/D18-1206. Pröhl, T., Putzier, E., Zarnekow, R. (2024). Benchmarking of LLM Detection: Comparing Two Competing Approaches. [Preprint]. arXiv. https://doi.org/10.48550/arXiv.2406.11670. Pu, J., Sarwar, Z., Abdullah, S.M., Rehman, A., Kim, Y., Bhattacharya, P., Javed, M., Viswanath, B. (2023). Deepfake Text Detection: Limitations and Opportunities , in: 2023 IEEE Symposium on Security and Privacy (SP), IEEE Computer Society, Los Alamitos, CA, USA. p. 1613–1630. https://doi.org/10.1109/SP46215.2023.10179387. Qwen Team, Yang, A., Yang, B., Zhang, B., Hui, B., Zheng, B., Yu, B., Liu, D., Huang, F., Wei, H., Lin, H., Zhou, J. (2024). Qwen2.5 Technical Report. [Preprint]. arXiv. https://doi.org/10.48550/arXiv.2412.15115. Ranganath, S., Ramesh, A. (2026). StealthRL: Reinforcement Learning Paraphrase Attacks for Multi-Detector Evasion of AI-Text Detectors. [Preprint]. arXiv. https://doi.org/10.48550/arXiv.2602.08934. Sadasivan, V.S., Kumar, A., Balasubramanian, S., Wang, W., Feizi, S. (2025). Can AI-Generated Text be Reliably Detected? Stress Testing AI Text Detectors Under Various Attacks. [Preprint]. arXiv. https://doi.org/10.48550/arXiv.2303.11156. Sahoo, P., Singh, A.K., Saha, S., Jain, V., Mondal, S., Chadha, A. (2024). A Systematic Survey of Prompt Engineering in Large Language Models: Techniques and Applications. [Preprint]. arXiv. https://doi.org/10.48550/arXiv.2402.07927. Schaaff, K., Schlippe, T., Mindner, L. (2024). Classification of human- and AI-generated texts for different languages and domains. International Journal of Speech Technology 27, 935–956. https://doi.org/10.1007/s10772-024-10143-3. Schulhoff, S., Ilie, M., Balepur, N., Kahadze, K., Liu, A., Si, C., Li, Y., Gupta, A., Han, H., Schulhoff, S., Dulepet, P.S., Vidyadhara, S., Ki, D., Agrawal, S., Pham, C., Kroiz, G., Li, F., Tao, H., Srivastava, A., Da Costa, H., Gupta, S., Rogers, M.L., Goncearenco, I., Sarli, G., Galynker, I., Peskoff, D., Carpuat, M., White, J., Anadkat, S., Hoyle, A., Resnik, P. (2024). The Prompt Report: A Systematic Survey of Prompting Techniques. [Preprint]. arXiv. https://doi.org/10.48550/arXiv.2406.06608. Shi, Z., Wang, Y., Yin, F., Chen, X., Chang, K.W., Hsieh, C.J. (2024). Red Teaming Language Model Detectors with Language Models. Transactions of the Association for Computational Linguistics 12, 174–189. https://doi.org/10.1162/tacl_a_00639. First Author et al.: Preprint submitted to ElsevierPage 24 of 27 ARB-Dataset Stowe, K., Patil, K. (2026). Spotlights and Blindspots: Evaluating Machine-Generated Text Detection. [Preprint]. arXiv. https://doi.org/10. 48550/arXiv.2604.16607. Tao, Z., Chen, Y., Xi, D., Li, Z., Xu, W. (2026). Toward Reliable Detection of LLM-Generated Texts: A Comprehensive Evaluation Framework with CUDRT. ACM Trans. Intell. Syst. Technol. 17. https://doi.org/10.1145/3779427. Wang, T., Chen, Y., Liu, Z., Chen, Z., Chen, H., Zhang, X., Cheng, W. (2025). Humanizing the Machine: Proxy Attacks to Mislead LLM Detectors. [Preprint]. arXiv. https://doi.org/10.48550/arXiv.2410.19230. Wang, Y., Mansurov, J., Ivanov, P., Su, J., Shelmanov, A., Tsvigun, A., Mohammed Afzal, O., Mahmoud, T., Puccetti, G., Arnold, T., Aji, A., Habash, N., Gurevych, I., Nakov, P. (2024a). M4GT-Bench: Evaluation Benchmark for Black-Box Machine-Generated Text Detection, in: Ku, L.W., Martins, A., Srikumar, V. (Eds.), Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), Association for Computational Linguistics, Bangkok, Thailand. p. 3964–3992. https://doi.org/10.18653/v1/2024. acl-long.218. Wang, Y., Mansurov, J., Ivanov, P., Su, J., Shelmanov, A., Tsvigun, A., Whitehouse, C., Afzal, O.M., Mahmoud, T., Sasaki, T., Arnold, T., Aji, A.F., Habash, N., Gurevych, I., Nakov, P. (2024b). M4: Multi-generator, Multi-domain, and Multi-lingual Black-Box Machine-Generated Text Detection, in: Proceedings of the 18th Conference of the European Chapter of the Association for Computational Linguistics (Volume 1: Long Papers), Association for Computational Linguistics, St. Julian’s, Malta. p. 1369–1407. https://doi.org/10.18653/v1/2024.eacl-long. 83. Weber-Wulff, D., Anohina-Naumeca, A., Bjelobaba, S., Foltýnek, T., Guerrero-Dib, J., Popoola, O., Šigut, P., Waddington, L. (2023). Testing of De- tection Tools for AI-Generated Text. International Journal for Educational Integrity 19. https://doi.org/10.1007/s40979-023-00146-z. Weichert, J., Dimobi, C. (2024). DUPE: Detection Undermining via Prompt Engineering for Deepfake Text. [Preprint]. arXiv. https: //doi.org/10.48550/arXiv.2404.11408. Wu, J., Zhan, R., Wong, D., Yang, S., Yang, X., Yuan, Y., Chao, L.S. (2024). DetectRL: Benchmarking LLM-Generated Text Detection in Real- World Scenarios, in: Globerson, A., Mackey, L., Belgrave, D., Fan, A., Paquet, U., Tomczak, J., Zhang, C. (Eds.), Advances in Neural Information Processing Systems, Curran Associates, Inc.. p. 100369–100401. https://doi.org/10.52202/079017-3186. Wu, J., Zhan, R., Wong, D.F., Yang, S., Liu, X., Chao, L.S., Zhang, M. (2025). Who Wrote This? The Key to Zero-Shot LLM-Generated Text Detection Is GECScore, in: Rambow, O., Wanner, L., Apidianaki, M., Al-Khalifa, H., Eugenio, B.D., Schockaert, S. (Eds.), Proceedings of the 31st International Conference on Computational Linguistics, Association for Computational Linguistics, Abu Dhabi, UAE. p. 10275–10292. https://aclanthology.org/2025.coling-main.684/. Xiang, L., Li, N., Liu, Y., Hu, J. (2026). AI-Generated Text Detection: A Comprehensive Review of Active and Passive Approaches. Computers, Materials and Continua 86. https://doi.org/https://doi.org/10.32604/cmc.2025.073347. Yadan, O. (2019). Hydra - A framework for elegantly configuring complex applications. Github. https://github.com/facebookresearch/ hydra. Yang, J., Jin, H., Tang, R., Han, X., Feng, Q., Jiang, H., Zhong, S., Yin, B., Hu, X. (2024). Harnessing the Power of LLMs in Practice: A Survey on ChatGPT and Beyond. ACM Trans. Knowl. Discov. Data 18. https://doi.org/10.1145/3649506. Zha, Y., Min, R., Sushmita, S. (2025). PADBen: A Comprehensive Benchmark for Evaluating AI Text Detectors Against Paraphrase Attacks. [Preprint]. arXiv. https://doi.org/10.48550/arXiv.2511.00416. Zhou, Y., Keuper, M., Fritz, M. (2025). Balancing Diversity and Risk in LLM Sampling: How to Select Your Method and Parameter for Open-Ended Text Generation, in: Che, W., Nabende, J., Shutova, E., Pilehvar, M.T. (Eds.), Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), Association for Computational Linguistics, Vienna, Austria. p. 26352– 26365. https://doi.org/10.18653/v1/2025.acl-long.1278. Zhou, Y., Muresanu, A.I., Han, Z., Paster, K., Pitis, S., Chan, H., Ba, J. (2022). Large Language Models Are Human-Level Prompt Engineers, in: NeurIPS 2022 Workshop on Foundation Models for Decision Making. [Oral presentation]. Zhuang, L., Wayne, L., Ya, S., Jun, Z. (2021). A Robustly Optimized BERT Pre-training Approach with Post-training, in: Li, S., Sun, M., Liu, Y., Wu, H., Liu, K., Che, W., He, S., Rao, G. (Eds.), Proceedings of the 20th Chinese National Conference on Computational Linguistics, Chinese Information Processing Society of China, Huhhot, China. p. 1218–1227. https://aclanthology.org/2021.ccl-1.108/. A. Prompt Templates The following appendix describes the prompt templates used to generate the ARB-Dataset texts. Each prompt contains specific parameters: FREE-LLM topic depends on the source dataset, while source_text and free_llm_text are, respectively, the human text of the source dataset and the LLM-generated text produced using the FREE-LLM prompt (see Figure 1). The design details of the prompts are reported in Section 4.5. A.1. System prompt You are a text rewriting and generation engine for a scientific benchmark. Return only the requested text. Do not add explanations, comments, markdown, headings, or prefaces. A.2. FREE-LLM prompt Write a fluent, self-contained English text about the following topic. First Author et al.: Preprint submitted to ElsevierPage 25 of 27 ARB-Dataset Constraints: Use your own wording and structure. Do not refer to the existence of a source text. Do not include headings or bullet points. Keep the length between min_words and max_words words. Return only the generated text. Topic: topic A.3. H2L prompt Rewrite the following text in fluent natural English. Constraints: Preserve the original meaning. Preserve factual claims, entities, and relationships. Do not add new information. Do not remove important information. Change wording and sentence structure where possible. Keep approximately the same length. Return only the rewritten text. Text: source_text A.4. LLM2L prompt Rewrite the following text in fluent natural English. Constraints: Preserve the original meaning. Do not add new information. Do not remove important information. Change wording and sentence structure where possible. Keep approximately the same length. Return only the rewritten text. Text: free_llm_text First Author et al.: Preprint submitted to ElsevierPage 26 of 27 ARB-Dataset B. H2L block-level heterogeneity heatmaps Figures 6 and 7 report the full block-level heterogeneity analysis for the H2L regime. Each panel corresponds to one detector, and each cell represents a generator × dataset block. XSum WritingPromptsOpenWebText Llama Gemma mistral7b qwen25_7b Generator 0.3580.4720.463 0.3380.4340.454 0.4230.4630.495 0.4840.5050.550 BERT-Defense XSum WritingPromptsOpenWebText Llama Gemma mistral7b qwen25_7b 0.5930.7890.735 0.4500.6680.617 0.4940.6600.602 0.3540.5300.538 RoBERTa-Defense XSum WritingPromptsOpenWebText Llama Gemma mistral7b qwen25_7b Generator 0.9280.9800.951 0.8370.8850.874 0.8290.9310.880 0.7410.8630.785 FastDetectGPT XSum WritingPromptsOpenWebText Dataset Llama Gemma mistral7b qwen25_7b 0.6980.9560.837 0.5030.7900.665 0.5330.8560.682 0.3110.7040.460 Binoculars-falcon-7b XSum WritingPromptsOpenWebText Dataset Llama Gemma mistral7b qwen25_7b Generator 0.9070.3440.668 0.8910.2350.611 0.9000.2800.599 0.8660.2600.587 RADAR 0.0 0.2 0.4 0.6 0.8 1.0 AUROC Figure 6: AUROC heatmaps for the H2L regime. Each panel corresponds to one detector; rows are generator models, and columns are datasets. Values are averaged within each generator × dataset cell. All panels share the same 0–1 color scale. First Author et al.: Preprint submitted to ElsevierPage 27 of 27 ARB-Dataset XSum WritingPromptsOpenWebText Llama Gemma mistral7b qwen25_7b Generator 0.0070.0130.005 0.0020.0130.005 0.0120.0080.015 0.0080.0300.012 BERT-Defense XSum WritingPromptsOpenWebText Llama Gemma mistral7b qwen25_7b 0.0200.0630.020 0.0130.0280.008 0.0170.0220.012 0.0130.0150.007 RoBERTa-Defense XSum WritingPromptsOpenWebText Llama Gemma mistral7b qwen25_7b Generator 0.3900.7900.610 0.1630.3180.277 0.1250.4480.303 0.0870.2000.138 FastDetectGPT XSum WritingPromptsOpenWebText Dataset Llama Gemma mistral7b qwen25_7b 0.1030.6800.253 0.0330.2300.073 0.0200.3080.070 0.0070.0970.015 Binoculars-falcon-7b XSum WritingPromptsOpenWebText Dataset Llama Gemma mistral7b qwen25_7b Generator 0.3570.0320.088 0.2970.0220.127 0.2600.0170.057 0.2450.0180.097 RADAR 0.0 0.2 0.4 0.6 0.8 1.0 TPR@1% FPR Figure 7: TPR@1%FPR heatmaps for the H2L regime. Each panel corresponds to one detector; rows are generator models and columns are datasets. Values are averaged within each generator × dataset cell. All panels share the same 0–1 color scale. First Author et al.: Preprint submitted to ElsevierPage 28 of 27

Instant research discovery