---
title: "Provable Robust Watermarking for AI-Generated Text (2023)"
description: "The authors set out a formal framework that defines three properties of an LLM watermark: preserved… 48 references, cited by 83 papers here."
authors: ["Xuandong Zhao", "Prabhanjan Ananth", "Lei Li", "Yu-Xiang Wang"]
year: 2023
venue: "arXiv:2306.17439"
source: "https://arxiv.org/abs/2306.17439"
doi: "10.48550/arxiv.2306.17439"
arxiv: "2306.17439"
licence: "arXiv — non-exclusive license to distribute"
licence_url: "http://arxiv.org/licenses/nonexclusive-distrib/1.0/"
summary_licence: "Elamur Cosmic License"
canonical: "https://research.elamur.ai/free/en/papers/zhao-2023-provable-robust-watermarking-ai-generated/"
---
[Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/zhao-2023-provable-robust-watermarking-ai-generated/)

[home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2023](https://md.research.elamur.ai/free/en/papers/2023/page/8/) / Provable Robust Watermarking for AI-Generated Text

# Provable Robust Watermarking for AI-Generated Text

**Authors:** [Xuandong Zhao](https://md.research.elamur.ai/free/en/authors/xuandong-zhao/), Prabhanjan Ananth, [Lei Li](https://md.research.elamur.ai/free/en/authors/lei-li/) and Yu-Xiang Wang · **Year:** 2023 · **Venue:** arXiv:2306.17439 · **Licence:** [arXiv — non-exclusive license to distribute](http://arxiv.org/licenses/nonexclusive-distrib/1.0/)

**Links:** [Publisher's page](https://arxiv.org/abs/2306.17439) · [PDF](https://arxiv.org/pdf/2306.17439) · [DOI 10.48550/arxiv.2306.17439](https://doi.org/10.48550/arxiv.2306.17439) · [arXiv 2306.17439](https://arxiv.org/abs/2306.17439) · [OpenAlex](https://openalex.org/W4383046637)

**Citations:** 15 citations (OpenAlex, 2026-10-14) · [83](https://md.research.elamur.ai/free/en/papers/zhao-2023-provable-robust-watermarking-ai-generated/cited-by/) in our library, of the 149,439 papers whose bibliographies we read

## Summary
Detectors that try to spot machine-written text in general depend on surface statistics. They break when the input distribution shifts, they are open to adversarial attack, and they can be biased against some writers. Watermarking avoids this by planting a hidden signal during generation. Existing schemes, however, can be removed through light editing or paraphrasing. The authors set out a formal framework that defines three properties of an LLM watermark: preserved output quality, error rates on both sides of detection, and robustness to post-hoc edits measured by edit distance. They then propose Unigram-Watermark. It simplifies the K-gram scheme of Kirchenbauer et al. by using one fixed Green-Red split of the vocabulary rather than a split tied to the prefix. They prove that the watermarked model stays close to the original in every Renyi divergence. They also prove that false-positive and false-negative rates shrink exponentially as the suspect text gets longer and more diverse, and that tolerance to edits is twice that of the baseline. Tests on three LLMs and two datasets show better detection under attack at similar perplexity. This makes provenance claims both checkable and harder to evade.

## Key points
- The core design change is a single global green/red vocabulary partition (K = 1). It replaces the partition re-derived from each preceding token in KGW+23. Most guarantees also carry over to K ≥ 2, except the Type II bound.
- The paraphrase attacks used ChatGPT, DIPPER, and BART (bart-large-cnn). On OpenGen with LLaMA-7B, AUC rose from 0.949 to 0.989 against ChatGPT paraphrasing and from 0.892 to 0.949 against BART summarization. Accuracy stayed above 85% at a 10% false-positive rate.
- Edit attacks on LFQA with LLaMA-7B covered synonym replacement, deletion, and swapping. With 50% of tokens swapped, AUC was 0.978 for Unigram-Watermark versus 0.702 for KGW+23.
- On human-written TOEFL essays collected by Liang et al., z-scores stayed well under the detection threshold of z = 6.0. This avoids the misclassification of non-native writers seen in commercial detectors.
- Code is released at github.com/XuandongZhao/Unigram-Watermark.

*Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.*

📚 Shelves (4): [🖥️ Computer Science](https://md.research.elamur.ai/free/en/shelves/computer-science/) · 18,614 works · [🤖 Artificial Intelligence](https://md.research.elamur.ai/free/en/shelves/computer-science/artificial-intelligence/) · 17,965 works · [👁️ Computer Vision and Pattern Recognition](https://md.research.elamur.ai/free/en/shelves/computer-science/computer-vision-and-pattern-recognition/) · 3,486 works · [🔌 Hardware and Architecture](https://md.research.elamur.ai/free/en/shelves/computer-science/hardware-and-architecture/) · 167 works

## Cite

Cite as: Xuandong Zhao, Prabhanjan Ananth, Lei Li and Yu-Xiang Wang. 2023. Provable Robust Watermarking for AI-Generated Text. arXiv:2306.17439.

The paper itself, not this page. BibTeX from the library's record of the work.

```bibtex
@misc{zhao2023provable,
  title = {{Provable Robust Watermarking for AI-Generated Text}},
  author = {Xuandong Zhao, Prabhanjan Ananth, Lei Li and Yu-Xiang Wang},
  year = {2023},
  doi = {10.48550/arxiv.2306.17439},
  eprint = {2306.17439},
  archivePrefix = {arXiv},
  url = {https://doi.org/10.48550/arxiv.2306.17439}
}
```

- [← previous LLaVAR: Enhanced Visual Instruction Tuning for Text-Rich Image Understanding](https://md.research.elamur.ai/free/en/papers/zhang-2023-llavar-enhanced-visual-instruction-tuning/)
- [next → A Survey of Confidence Estimation and Calibration in Large Language Models](https://md.research.elamur.ai/free/en/papers/geng-2023-survey-confidence-estimation-calibration-large/)
- [↑ back to papers of 2023](https://md.research.elamur.ai/free/en/papers/2023/page/8/)

## References

48 references, 24 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

1. John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. [A watermark for large language models](https://md.research.elamur.ai/free/en/papers/kirchenbauer-2023-watermark-large-language-models/). International Conference on Machine Learning, 2023.
2. Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. [Language models are few-shot learners](https://md.research.elamur.ai/free/en/papers/brown-2020-language-models-few-shot-learners/). Advances in neural information processing systems, 33:1877–1901, 2020.
3. Aditya Ramesh, Prafulla Dhariwal, Alex Nichol, Casey Chu, and Mark Chen. [Hierarchical text-conditional image generation with clip latents](https://md.research.elamur.ai/free/en/papers/ramesh-2022-hierarchical-text-conditional-image-generation/). ArXiv, abs/2204.06125, 2022.
4. Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily L Denton, Kamyar Ghasemipour, Raphael Gontijo Lopes, Burcu Karagol Ayan, Tim Salimans, et al. [Photorealistic text-to-image diffusion models with deep language understanding](https://md.research.elamur.ai/free/en/papers/saharia-2022-photorealistic-text-image-diffusion-models/). Advances in Neural Information Processing Systems, 35…
5. OpenAI. [Gpt-4 technical report](https://md.research.elamur.ai/free/en/papers/openai-2023-gpt-4-technical-report/). ArXiv, abs/2303.08774, 2023a.
6. OpenAI. Chatgpt: Optimizing language models for dialogue. OpenAI blog, 2022. URL [https://openai.com/blog/chatgpt/](https://openai.com/blog/chatgpt/). [↗](https://openai.com/blog/chatgpt/)
7. Rowan Zellers, Ari Holtzman, Hannah Rashkin, Yonatan Bisk, Ali Farhadi, Franziska Roesner, and Yejin Choi. [Defending against neural fake news](https://md.research.elamur.ai/free/en/papers/zellers-2019-defending-against-neural-fake-news/). Advances in neural information processing systems, 32, 2019.
8. Laura Weidinger, John F. J. Mellor, Maribeth Rauh, Conor Griffin, Jonathan Uesato, Po-Sen Huang, Myra Cheng, Mia Glaese, Borja Balle, Atoosa Kasirzadeh, Zachary Kenton, Sande Minnich Brown, William T. Hawkins, Tom Stepleton, Courtney Biles, Abeba Birhane, Julia Haas, Laura Rimell, Lisa Anne Hendrick… — [Ethical and social risks of harm from Language Models](https://md.research.elamur.ai/free/en/papers/weidinger-2021-ethical-social-risks-harm-language/)
9. Chris Stokel-Walker. Ai bot chatgpt writes smart essays - should professors worry? Nature, 2022. [find](https://scholar.google.com/scholar?q=Chris+Stokel%2DWalker%2E+Ai+bot+chatgpt+writes+smart+essays+%2D+should+professors+worry%3F+Nature%2C+2022%2E)
10. Alec Radford, Jong Wook Kim, Tao Xu, Greg Brockman, Christine McLeavey, and Ilya Sutskever. [Robust speech recognition via large-scale weak supervision](https://md.research.elamur.ai/free/en/papers/radford-2022-robust-speech-recognition-large-scale/). ArXiv, abs/2212.04356, 2022.
11. Nicholas Carlini, Matthew Jagielski, Christopher A. Choquette-Choo, Daniel Paleka, Will Pearce, H. Anderson, A. Terzis, Kurt Thomas, and Florian Tramèr. Poisoning web-scale training datasets is practical. ArXiv, abs/2302.10149, 2023. — [arXiv:2302.10149](https://arxiv.org/abs/2302.10149) [find](https://scholar.google.com/scholar?q=Nicholas+Carlini%2C+Matthew+Jagielski%2C+Christopher+A%2E+Choquette%2DChoo%2C+Daniel+Paleka%2C+Will+Pearce%2C+H%2E+Anderson%2C+A%2E+Terzis%2C+Kurt+Thomas%2C+and+Florian+Tram%C3%A8r%2E+Poisoning+web%2Dscale+training+datasets+is+practi)
12. Alan M Turing. Computing machinery and intelligence. 1950. [find](https://scholar.google.com/scholar?q=Alan+M+Turing%2E+Computing+machinery+and+intelligence%2E+1950%2E)
13. Sebastian Gehrmann, Hendrik Strobelt, and Alexander M. Rush. [Gltr: Statistical detection and visualization of generated text](https://md.research.elamur.ai/free/en/papers/gehrmann-2019-gltr-statistical-detection-visualization-generated/). In Annual Meeting of the Association for Computational Linguistics, 2019.
14. Eric Mitchell, Yoonho Lee, Alexander Khazatsky, Christopher D. Manning, and Chelsea Finn. [Detectgpt: Zero-shot machine-generated text detection using probability curvature](https://md.research.elamur.ai/free/en/papers/mitchell-2023-detectgpt-zero-shot-machine-generated/). ArXiv, abs/2301.11305, 2023.
15. Dirk Hovy. The enemy in your own camp: How well can we detect statistically-generated fake reviews – an adversarial study. In Annual Meeting of the Association for Computational Linguistics, 2016. [find](https://scholar.google.com/scholar?q=Dirk+Hovy%2E+The+enemy+in+your+own+camp%3A+How+well+can+we+detect+statistically%2Dgenerated+fake+reviews+%E2%80%93+an+adversarial+study%2E+In+Annual+Meeting+of+the+Association+for+Computational+Linguistics%2C+2016%2E)
16. OpenAI. New ai classifier for indicating ai-written text. OpenAI blog, 2023b. URL [https://openai.com/blog/new-ai-classifier-for-indicating-ai-written-text](https://openai.com/blog/new-ai-classifier-for-indicating-ai-written-text). [↗](https://openai.com/blog/new-ai-classifier-for-indicating-ai-written-text)
17. Weixin Liang, Mert Yuksekgonul, Yining Mao, Eric Wu, and James Y. Zou. [Gpt detectors are biased against non-native english writers](https://md.research.elamur.ai/free/en/papers/liang-2023-gpt-detectors-biased-against-non/). ArXiv, abs/2304.02819, 2023.
18. Xuandong Zhao, Yu xiang Wang, and Lei Li. Protecting language generation models via invisible watermarking. ArXiv, abs/2302.03162, 2023. — [arXiv:2302.03162](https://arxiv.org/abs/2302.03162) [find](https://scholar.google.com/scholar?q=Xuandong+Zhao%2C+Yu+xiang+Wang%2C+and+Lei+Li%2E+Protecting+language+generation+models+via+invisible+watermarking%2E+ArXiv%2C+abs%2F2302%2E03162%2C+2023%2E+%E2%80%94+%5BarXiv%3A2302%2E03162%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F2302%2E03162%29)
19. Scott Aaronson. Simons institute talk on watermarking of large language models, 2023. URL [https://simons.berkeley.edu/talks/scott-aaronson-ut-austin-openai-2023-08-17](https://simons.berkeley.edu/talks/scott-aaronson-ut-austin-openai-2023-08-17). [↗](https://simons.berkeley.edu/talks/scott-aaronson-ut-austin-openai-2023-08-17)
20. Miranda Christ, Sam Gunn, and Or Zamir. Undetectable watermarks for language models. arXiv preprint arXiv:2306.09194, 2023. — [arXiv:2306.09194](https://arxiv.org/abs/2306.09194) [find](https://scholar.google.com/scholar?q=Miranda+Christ%2C+Sam+Gunn%2C+and+Or+Zamir%2E+Undetectable+watermarks+for+language+models%2E+arXiv+preprint+arXiv%3A2306%2E09194%2C+2023%2E+%E2%80%94+%5BarXiv%3A2306%2E09194%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F2306%2E09194%29)
21. Mélisande Albert. Concentration inequalities for randomly permuted sums. In High Dimensional Probability VIII: The Oaxaca Volume, pages 341–383. Springer, 2019. [find](https://scholar.google.com/scholar?q=M%C3%A9lisande+Albert%2E+Concentration+inequalities+for+randomly+permuted+sums%2E+In+High+Dimensional+Probability+VIII%3A+The+Oaxaca+Volume%2C+pages+341%E2%80%93383%2E+Springer%2C+2019%2E)
22. Alec Radford, Jeff Wu, Rewon Child, David Luan, Dario Amodei, and Ilya Sutskever. Language models are unsupervised multitask learners. OpenAI blog, 2019. [find](https://scholar.google.com/scholar?q=Alec+Radford%2C+Jeff+Wu%2C+Rewon+Child%2C+David+Luan%2C+Dario+Amodei%2C+and+Ilya+Sutskever%2E+Language+models+are+unsupervised+multitask+learners%2E+OpenAI+blog%2C+2019%2E)
23. Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Łukasz Kaiser, and Illia Polosukhin. [Attention is all you need](https://md.research.elamur.ai/free/en/papers/vaswani-2017-attention-all-need/). Advances in neural information processing systems, 30, 2017.
24. Yinhan Liu, Myle Ott, Naman Goyal, Jingfei Du, Mandar Joshi, Danqi Chen, Omer Levy, Mike Lewis, Luke Zettlemoyer, and Veselin Stoyanov. [Roberta: A robustly optimized bert pretraining approach](https://md.research.elamur.ai/free/en/papers/liu-2019-roberta-robustly-optimized-bert-pretraining/). ArXiv, abs/1907.11692, 2019.
25. Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. Calibrating noise to sensitivity in private data analysis. In Theory of cryptography, pages 265–284. Springer, 2006. [find](https://scholar.google.com/scholar?q=Cynthia+Dwork%2C+Frank+McSherry%2C+Kobbi+Nissim%2C+and+Adam+Smith%2E+Calibrating+noise+to+sensitivity+in+private+data+analysis%2E+In+Theory+of+cryptography%2C+pages+265%E2%80%93284%2E+Springer%2C+2006%2E)
26. Jinshuo Dong, David Durfee, and Ryan Rogers. Optimal differential privacy composition for exponential mechanisms. In International Conference on Machine Learning, pages 2597–2606. PMLR, 2020. [find](https://scholar.google.com/scholar?q=Jinshuo+Dong%2C+David+Durfee%2C+and+Ryan+Rogers%2E+Optimal+differential+privacy+composition+for+exponential+mechanisms%2E+In+International+Conference+on+Machine+Learning%2C+pages+2597%E2%80%932606%2E+PMLR%2C+2020%2E)
27. Kalpesh Krishna, Yixiao Song, Marzena Karpinska, John Wieting, and Mohit Iyyer. [Paraphrasing evades detectors of ai-generated text, but retrieval is an effective defense](https://md.research.elamur.ai/free/en/papers/krishna-2023-paraphrasing-evades-detectors-ai-generated/). ArXiv, abs/2303.13408, 2023.
28. Stephen Merity, Caiming Xiong, James Bradbury, and Richard Socher. [Pointer sentinel mixture models](https://md.research.elamur.ai/free/en/papers/merity-2016-pointer-sentinel-mixture-models/). In International Conference on Learning Representations, 2017.
29. Susan Zhang, Stephen Roller, Naman Goyal, Mikel Artetxe, Moya Chen, Shuohui Chen, Christopher Dewan, Mona Diab, Xian Li, Xi Victoria Lin, Todor Mihaylov, Myle Ott, Sam Shleifer, Kurt Shuster, Daniel Simig, Punit Singh Koura, Anjali Sridhar, Tianlu Wang, and Luke Zettlemoyer. Opt: Open pre-trained tr… — [OPT: Open Pre-trained Transformer Language Models](https://md.research.elamur.ai/free/en/papers/zhang-2022-opt-open-pre-trained-transformer/)
30. Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Anne Lachaux, Timothée Lacroix, Baptiste Rozière, Naman Goyal, Eric Hambro, Faisal Azhar, Aur’elien Rodriguez, Armand Joulin, Edouard Grave, and Guillaume Lample. [Llama: Open and efficient foundation language models](https://md.research.elamur.ai/free/en/papers/touvron-2023-llama-open-efficient-foundation-language/). ArXiv, abs/23…
31. Ari Holtzman, Jan Buys, Maxwell Forbes, and Yejin Choi. [The curious case of neural text degeneration](https://md.research.elamur.ai/free/en/papers/holtzman-2019-curious-case-neural-text-degeneration/). In International Conference on Learning Representations, 2020.
32. Thomas Wolf, Lysandre Debut, Victor Sanh, Julien Chaumond, Clement Delangue, Anthony Moi, Pierric Cistac, Tim Rault, Rémi Louf, Morgan Funtowicz, and Jamie Brew. Huggingface’s transformers: State-ofthe-art natural language processing. ArXiv, abs/1910.[03771, 2019](https://md.research.elamur.ai/free/en/papers/wolf-2020-transformers-state-art-natural-language/).
33. Long Ouyang, Jeff Wu, Xu Jiang, Diogo Almeida, Carroll L. Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, John Schulman, Jacob Hilton, Fraser Kelton, Luke E. Miller, Maddie Simens, Amanda Askell, Peter Welinder, Paul Francis Christiano, Jan Leike, and Ryan J. Low… — [Training language models to follow instructions with human feedback](https://md.research.elamur.ai/free/en/papers/ouyang-2022-training-language-models-follow-instructions/)
34. Mike Lewis, Yinhan Liu, Naman Goyal, Marjan Ghazvininejad, Abdel rahman Mohamed, Omer Levy, Veselin Stoyanov, and Luke Zettlemoyer. [Bart: Denoising sequence-to-sequence pre-training for natural language generation, translation, and comprehension](https://md.research.elamur.ai/free/en/papers/lewis-2020-bart-denoising-sequence-sequence-pre/). In Annual Meeting of the Association for Computationa…
35. Karl Moritz Hermann, Tomas Kocisky, Edward Grefenstette, Lasse Espeholt, Will Kay, Mustafa Suleyman, and Phil Blunsom. [Teaching machines to read and comprehend](https://md.research.elamur.ai/free/en/papers/hermann-2015-teaching-machines-read-comprehend/). Advances in neural information processing systems, 28, 2015.
36. Katzenbeisser Stefan, AP Fabien, et al. Information hiding techniques for steganography and digital watermarking, 2000. [find](https://scholar.google.com/scholar?q=Katzenbeisser+Stefan%2C+AP+Fabien%2C+et+al%2E+Information+hiding+techniques+for+steganography+and+digital+watermarking%2C+2000%2E)
37. Umut Topkara, Mercan Topkara, and Mikhail J. Atallah. The hiding virtues of ambiguity: quantifiably resilient watermarking of natural language text through synonym substitutions. In Workshop on Multimedia & Security, 2006. [find](https://scholar.google.com/scholar?q=Umut+Topkara%2C+Mercan+Topkara%2C+and+Mikhail+J%2E+Atallah%2E+The+hiding+virtues+of+ambiguity%3A+quantifiably+resilient+watermarking+of+natural+language+text+through+synonym+substitutions%2E+In+Workshop+on+Multim)
38. Mikhail J. Atallah, Victor Raskin, Michael Crogan, Christian F. Hempelmann, Florian Kerschbaum, Dina Mohamed, and Sanket Naik. Natural language watermarking: Design, analysis, and a proof-of-concept implementation. In Information Hiding, 2001. [find](https://scholar.google.com/scholar?q=Mikhail+J%2E+Atallah%2C+Victor+Raskin%2C+Michael+Crogan%2C+Christian+F%2E+Hempelmann%2C+Florian+Kerschbaum%2C+Dina+Mohamed%2C+and+Sanket+Naik%2E+Natural+language+watermarking%3A+Design%2C+analysis%2C+and+a+proof%2Dof%2Dconcept+i)
39. Mikhail J. Atallah, Victor Raskin, Christian F. Hempelmann, Mercan Topkara, Radu Sion, Umut Topkara, and Katrina E. Triezenberg. Natural language watermarking and tamperproofing. In Information Hiding, 2002. [find](https://scholar.google.com/scholar?q=Mikhail+J%2E+Atallah%2C+Victor+Raskin%2C+Christian+F%2E+Hempelmann%2C+Mercan+Topkara%2C+Radu+Sion%2C+Umut+Topkara%2C+and+Katrina+E%2E+Triezenberg%2E+Natural+language+watermarking+and+tamperproofing%2E+In+Information+Hiding)
40. Xi Yang, Jie Zhang, Kejiang Chen, Weiming Zhang, Zehua Ma, Feng Wang, and Nenghai Yu. Tracing text provenance via context-aware lexical substitution. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 36, pages 11613–11621, 2022. [find](https://scholar.google.com/scholar?q=Xi+Yang%2C+Jie+Zhang%2C+Kejiang+Chen%2C+Weiming+Zhang%2C+Zehua+Ma%2C+Feng+Wang%2C+and+Nenghai+Yu%2E+Tracing+text+provenance+via+context%2Daware+lexical+substitution%2E+In+Proceedings+of+the+AAAI+Conference+on+Artificia)
41. Honai Ueoka, Yugo Murawaki, and Sadao Kurohashi. Frustratingly easy edit-based linguistic steganography with a masked language model. In Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, 2021. [find](https://scholar.google.com/scholar?q=Honai+Ueoka%2C+Yugo+Murawaki%2C+and+Sadao+Kurohashi%2E+Frustratingly+easy+edit%2Dbased+linguistic+steganography+with+a+masked+language+model%2E+In+Proceedings+of+the+2021+Conference+of+the+North+American+Chapte)
42. Margherita Gambini, Tiziano Fagni, F. Falchi, and Maurizio Tesconi. On pushing deepfake tweet detection capabilities to the limits. Proceedings of the 14th ACM Web Science Conference 2022, 2022. [find](https://scholar.google.com/scholar?q=Margherita+Gambini%2C+Tiziano+Fagni%2C+F%2E+Falchi%2C+and+Maurizio+Tesconi%2E+On+pushing+deepfake+tweet+detection+capabilities+to+the+limits%2E+Proceedings+of+the+14th+ACM+Web+Science+Conference+2022%2C+2022%2E)
43. Max Wolff. Attacking neural text detectors. ArXiv, abs/2002.11768, 2020. — [arXiv:2002.11768](https://arxiv.org/abs/2002.11768) [find](https://scholar.google.com/scholar?q=Max+Wolff%2E+Attacking+neural+text+detectors%2E+ArXiv%2C+abs%2F2002%2E11768%2C+2020%2E+%E2%80%94+%5BarXiv%3A2002%2E11768%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F2002%2E11768%29)
44. Vinu Sankar Sadasivan, Aounon Kumar, S. Balasubramanian, Wenxiao Wang, and Soheil Feizi. [Can ai-generated text be reliably detected?](https://md.research.elamur.ai/free/en/papers/sadasivan-2023-ai-generated-text-reliably-detected/) ArXiv, abs/2303.11156, 2023.
45. Souradip Chakraborty, Amrit Singh Bedi, Sicheng Zhu, Bang An, Dinesh Manocha, and Furong Huang. On the possibilities of ai-generated text detection. arXiv preprint arXiv:2304.04736, 2023. — [arXiv:2304.04736](https://arxiv.org/abs/2304.04736) [find](https://scholar.google.com/scholar?q=Souradip+Chakraborty%2C+Amrit+Singh+Bedi%2C+Sicheng+Zhu%2C+Bang+An%2C+Dinesh+Manocha%2C+and+Furong+Huang%2E+On+the+possibilities+of+ai%2Dgenerated+text+detection%2E+arXiv+preprint+arXiv%3A2304%2E04736%2C+2023%2E+%E2%80%94+%5BarXiv%3A230)
46. Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, and Peter J Liu. [Exploring the limits of transfer learning with a unified text-to-text transformer](https://md.research.elamur.ai/free/en/papers/raffel-2019-exploring-limits-transfer-learning-unified/). The Journal of Machine Learning Research, 21(1):5485–5551, 2020.
47. Frank McSherry and Kunal Talwar. Mechanism design via differential privacy. In Symposium on Foundations of Computer Science (FOCS’07), pages 94–103. IEEE, 2007. [find](https://scholar.google.com/scholar?q=Frank+McSherry+and+Kunal+Talwar%2E+Mechanism+design+via+differential+privacy%2E+In+Symposium+on+Foundations+of+Computer+Science+%28FOCS%E2%80%9907%29%2C+pages+94%E2%80%93103%2E+IEEE%2C+2007%2E)
48. Mark Cesar and Ryan Rogers. Bounding, concentrating, and truncating: Unifying privacy loss composition for data analytics. In Algorithmic Learning Theory, pages 421–457. PMLR, 2021. [find](https://scholar.google.com/scholar?q=Mark+Cesar+and+Ryan+Rogers%2E+Bounding%2C+concentrating%2C+and+truncating%3A+Unifying+privacy+loss+composition+for+data+analytics%2E+In+Algorithmic+Learning+Theory%2C+pages+421%E2%80%93457%2E+PMLR%2C+2021%2E)

*Updated 2 November 2026*