这篇论文告诉你，现在AI检测器遇到‘人类写、AI改’就失灵，直接生成能抓到九成，改写后只剩三成，做防御的得看看。
ARB基准由1,800篇人类源文本构建，覆盖XSum、WritingPrompts和OpenWebText三个数据集，并使用Llama-3.2-3B、Qwen2.5-7B、Mistral-7B和Gemma-2-9B四个开源模型生成重写变体。在1%假阳性率下，FastDetectGPT和Binoculars-falcon-7b对直接生成文本的召回率分别为91.2%和93.5%，但对人类文本经LLM改写后的召回率骤降至30.8%和15.1%。RADAR同样从66.8%跌至12.2%，而BERT-Defense和RoBERTa-Defense在所有场景下召回率均低于3%。结果表明，传统基准上的检测性能无法迁移到LLM改写的人类文本场景。
ARB: A Matched Authorship-Rewriting Benchmark Dataset for AI-Text Detector Evaluation
Standard AI-text detection benchmarks compare human-written text against text generated directly by large language models (LLMs). While prior work has shown that rewriting and paraphrasing can degrade detector performance, it remains unclear whether performance measured on this conventional benchmark predicts detector behavior when human-authored content is rewritten by an LLM. To address this gap, we introduce Authorship-Rewriting Benchmark (ARB), built from 1,800 human source texts (600 each from XSum, WritingPrompts, and OpenWebText) and four open-weight generators (Llama-3.2-3B, Qwen2.5-7B, Mistral-7B, Gemma-2-9B). Each source item yields four matched variants: human-written (HUMAN), direct LLM generation (Free-LLM), LLM-rewritten human text (H2L), and same-generator LLM-rewritten LLM text (LLM2L). We evaluated five detectors (FastDetectGPT, Binoculars-falcon-7b, RADAR, BERT-Defense, RoBERTa-Defense) at a strict 1%-false-positive operating point (TPR@1%FPR). FastDetectGPT and Binoculars-falcon-7b detected 91.2% and 93.5\% of direct LLM text, but only 30.8% and 15.1% of human text an LLM had rewritten, a drop of 60-78 percentage points. The same detectors retained 78.3% and 83.0% recall when LLM text was rewritten by the same model, a much smaller decline of 10-13 points. RADAR followed the same pattern (66.8% to 12.2%), while BERT-Defense and RoBERTa-Defense stayed below 3% recall across all regimes. These results show that detector performance measured on the conventional human-vs-LLM benchmark does not transfer to human-authored text revised by an LLM, even though the same detectors remain largely robust to LLM-only rewriting.