Evaluating Robustness of AI-Generated Text Detectors Under Simulated Iterative Obfuscation

Abstract

AI text generators are usually evaluated with their output being fed directly into detectors, while in actuality, users tend to paraphrase or back-translate texts before submitting them to be graded. In the following study, four detectors are tested at each of five increasing levels of attacks based on HC3, RAID, and MAGE datasets, with AURC, accuracy, and F1-score utilized as evaluation metrics. As it turns out, good performance on clean text does not correlate with resilience as, during the most extreme attack, detectors perform 0.4 AUROC or more differently from one another; the perplexity baseline becomes equivalent to random guesses; DeBERTa-v3 sees severe drops in performance, while RoBERTa+stylometry is most resistant $(\mathbf{A U R O C}=\mathbf{0. 9 3 2})$. During the strongest attack, the error rate for false negatives can rise up to 82%. Most crucially, simple substitution of synonyms causes more harm than back-translation, suggesting that lexical manipulations play a key role in undermining the detectors’ performance and are a more realistic scenario compared to benchmarking on clean text.