Mgt Detector Robustness Eval

mgt-detector-robustness-eval

Stumbling Blocks: Stress Testing the Robustness of Machine-Generated Text Detectors Under Attacks — Wang et al. (2024) (arXiv:2402.11638, 2024)

What this evaluates

Evaluates the robustness of machine-generated text detectors against adversarial perturbations such as editing, paraphrasing, prompting, and co-generation. It measures how well detectors maintain binary classification performance when texts are intentionally modified to evade detection.

Datasets

• News-style MGT dataset — total 10000; splits: train (8000), val (1000), test (1000)

Metrics

• AUC ROC — range: [0, 1]
  • Area under the receiver operating characteristic curve, measuring the trade-off between true positive rate and false positive rate across all classification thresholds.
• TPR@FPR (primary) — range: [0, 1]
  • True positive rate when the false positive rate is fixed at a specific percentage (e.g., 5%). Under this evaluation setting, it is equivalent to Attack Success Rate (ASR).

Input / output format

Input: Text snippets (News-style), labeled as either human-written or machine-generated, with some instances subjected to adversarial attacks (editing, paraphrasing, prompting, co-generating).

Output: Binary detection label (human vs. machine) or a continuous detection score/probability used for threshold-independent evaluation.

Scoring recipe

def compute_tpr_at_fpr(y_true, y_score, fpr_target=0.05):
    fpr, tpr, _ = roc_curve(y_true, y_score)
    tpr_at_target = np.interp(fpr_target, fpr, tpr)
    return tpr_at_target

def compute_auc_roc(y_true, y_score):
    fpr, tpr, _ = roc_curve(y_true, y_score)
    return auc(fpr, tpr)

Common pitfalls

• Accuracy and F1-score are explicitly excluded because they depend on arbitrary threshold settings for metric-based detectors, causing biased comparisons.
• Attacked scenario metrics are reported as relative percentages compared to unattacked baseline performance, not absolute values.
• TPR@FPR functions as an Attack Success Rate (ASR) metric here, meaning higher values indicate worse detector robustness.

Evidence (verbatim from paper)

The metrics we use to evaluate detection performance are binary classification metrics AUC ROC and TPR@FPR. AUC ROC is the area under the receiver operating characteristic curve. TPR@FPR is the true positive rate when the false positive rate is at a specific percentage. Under our setting, it is equivalent to Attack Success Rate (ASR) (Tsai et al., 2019). We mainly show TPR@FPR=5%, and TPR@FPR=10% and =20% are additionally recorded in the Appendix D.2. We do not involve Accuracy and F1-score because those metrics are dependent on the setting of the threshold for metric-based detectors, which could be biased in the comparison.

Citation

@misc{wang2024stumblingblocks,
  title={Stumbling Blocks: Stress Testing the Robustness of Machine-Generated Text Detectors Under Attacks},
  author={Wang et al. (2024)},
  year={2024},
  note={arXiv:2402.11638}
}

• arXiv: 2402.11638