  The unregulated use of LLMs can potentially lead to malicious consequences
such as plagiarism, generating fake news, spamming, etc. Therefore, reliable
detection of AI-generated text can be critical to ensure the responsible use of
LLMs. Recent works attempt to tackle this problem either using certain model
signatures present in the generated text outputs or by applying watermarking
techniques that imprint specific patterns onto them. In this paper, we show
that these detectors are not reliable in practical scenarios. In particular, we
develop a recursive paraphrasing attack to apply on AI text, which can break a
whole range of detectors, including the ones using the watermarking schemes as
well as neural network-based detectors, zero-shot classifiers, and
retrieval-based detectors. Our experiments include passages around 300 tokens
in length, showing the sensitivity of the detectors even in the case of
relatively long passages. We also observe that our recursive paraphrasing only
degrades text quality slightly, measured via human studies, and metrics such as
perplexity scores and accuracy on text benchmarks. Additionally, we show that
even LLMs protected by watermarking schemes can be vulnerable against spoofing
attacks aimed to mislead detectors to classify human-written text as
AI-generated, potentially causing reputational damages to the developers. In
particular, we show that an adversary can infer hidden AI text signatures of
the LLM outputs without having white-box access to the detection method.
Finally, we provide a theoretical connection between the AUROC of the best
possible detector and the Total Variation distance between human and AI text
distributions that can be used to study the fundamental hardness of the
reliable detection problem for advanced language models. Our code is publicly
available at https://github.com/vinusankars/Reliability-of-AI-text-detectors.
