# Attacking Only Half the Data: Two-Sided Evaluation of AI-Text Detector Robustness

arXiv: https://arxiv.org/abs/2610.18151 · HTML: https://mlsanity.com/paper/2610.18151/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 22 of its 25 references that are in the map.
- First posted on arXiv 13 Oct 2026.

## Builds on (most cited first, 22 of 22)

- [DetectGPT: Zero-Shot Machine-Generated Text Detection using Probability Curvature](https://mlsanity.com/paper/2301.11305/) (2023)
- [GLTR: Statistical Detection and Visualization of Generated Text](https://mlsanity.com/paper/1906.04043/) (2019)
- [How Close is ChatGPT to Human Experts? Comparison Corpus, Evaluation, and Detection](https://mlsanity.com/paper/2301.07597/) (2023)
- [Paraphrasing evades detectors of AI-generated text, but retrieval is an effective defense](https://mlsanity.com/paper/2303.13408/) (2023)
- [Fast-DetectGPT: Efficient Zero-Shot Detection of Machine-Generated Text via Conditional Probability Curvature](https://mlsanity.com/paper/2310.05130/) (2023)
- [Spotting LLMs With Binoculars: Zero-Shot Detection of Machine-Generated Text](https://mlsanity.com/paper/2401.12070/) (2024)
- [RADAR: Robust AI-Text Detection via Adversarial Learning](https://mlsanity.com/paper/2307.03838/) (2023)
- [GPT detectors are biased against non-native English writers](https://mlsanity.com/paper/2304.02819/) (2023)
- [RAID: A Shared Benchmark for Robust Evaluation of Machine-Generated Text Detectors](https://mlsanity.com/paper/2405.07940/) (2024)
- [Training-free LLM-generated Text Detection by Mining Token Probability Sequences](https://mlsanity.com/paper/2410.06072/) (2024)
- [Your Large Language Models Are Leaving Fingerprints](https://mlsanity.com/paper/2405.14057/) (2024)
- [Almost AI, Almost Human: The Challenge of Detecting AI-Polished Writing](https://mlsanity.com/paper/2502.15666/) (2025)
- [SilverSpeak: Evading AI-Generated Text Detectors using Homoglyphs](https://mlsanity.com/paper/2406.11239/) (2024)
- [Iron Sharpens Iron: Defending Against Attacks in Machine-Generated Text Detection with Adversarial Training](https://mlsanity.com/paper/2502.12734/) (2025)
- [RAFT: Realistic Attacks to Fool Text Detectors](https://mlsanity.com/paper/2410.03658/) (2024)
- [Mitigating Paraphrase Attacks on Machine-Text Detectors via Paraphrase Inversion](https://mlsanity.com/paper/2410.21637/) (2024)
- [StealthRL: Reinforcement Learning Paraphrase Attacks for Multi-Detector Evasion of AI-Text Detectors](https://mlsanity.com/paper/2602.08934/) (2026)
- [PADBen: A Comprehensive Benchmark for Evaluating AI Text Detectors Against Paraphrase Attacks](https://mlsanity.com/paper/2511.00416/) (2025)
- [Modeling the Attack: Detecting AI-Generated Text by Quantifying Adversarial Perturbations](https://mlsanity.com/paper/2510.02319/) (2025)
- [Attacks on Machine-Text Detectors Retain Stylistic Fingerprints](https://mlsanity.com/paper/2505.14608/) (2025)
- [Luminol-AIDetect: Fast Zero-shot Machine-Generated Text Detection based on Perplexity under Text Shuffling](https://mlsanity.com/paper/2604.25860/) (2026)
- [Paraphrasing Attack Resilience of Various AI-Generated Text Detection Methods](https://mlsanity.com/paper/2605.14240/) (2026)

## Abstract (arXiv)

We investigate the robustness of widely used AI text detectors under attacks applied to both human and machine text. Prior evaluations typically attack only machine text, overlooking that human text is routinely modified through grammar correction, formatting, or invisible character insertion. We introduce a two-sided protocol that applies attacks to both classes. Across two corpora and nine detectors, reported AUROC gains vanish under two-sided evaluation, with attacked human text misclassified at rates up to 100%. While simple preprocessing reverses character-level attacks, word-level synonym substitution remains effective meaning-preserving, and irreversible.