What happens when AI detectors face a real benchmark? RAID and M4, read closely

What this review covers

A vendor can make a detector look arbitrarily good by choosing the test. Use AI text generated by one model, in one genre, at default settings, with no edits — and publish the resulting accuracy. The corrective is a shared benchmark: a large, fixed, public dataset that every detector faces on equal terms, built by people with no detector to sell.

Two benchmarks dominate this space. RAID (Dugan, Hwang, Trhlik, Ludan, Zhu, Xu, Ippolito, Callison-Burch — ACL 2024) is the largest robustness evaluation: over six million generations at publication, spanning models, domains, decoding settings, and deliberate evasion attacks. M4 (Wang, Mansurov, and thirteen co-authors including Gurevych and Nakov) tests the dimension RAID does not: generalization across languages and across generators the detector never saw in training.

This review reads both closely — the papers, plus RAID's living project documentation, which now describes a larger dataset than the paper did (the discrepancy is documented below). Every quotation is verbatim from the linked source, checked on the asOf date.

Why benchmarks exist: the 99% problem

RAID's abstract opens with the problem it was built to solve:

"Many commercial and open-source models claim to detect machine-generated text with extremely high accuracy (99% or more). However, very few of these detectors are evaluated on shared benchmark datasets and even when they are, the datasets used for evaluation are insufficiently challenging..."

This is the quiet methodological scandal of the detection market. The headline numbers in marketing pages are mostly self-evaluations on self-chosen data. A benchmark removes both choices, which is why the numbers below look nothing like the numbers in the brochures. (For how the vendor claims compare with independent measurements tool by tool, see our accuracy review.)

RAID: the design

From the abstract, verbatim:

"RAID includes over 6 million generations spanning 11 models, 8 domains, 11 adversarial attacks and 4 decoding strategies."

Each dimension closes a loophole in prior evaluations:

• 11 models — a detector tuned to one model family's quirks has to face ten others.
• 8 domains — news, fiction, recipes, code and more; a detector that learned "essay-flavored AI text" meets everything else.
• 4 decoding strategies — the same model produces statistically different text depending on sampling temperature and penalties; prior evaluations mostly tested one default.
• 11 adversarial attacks — the cheap evasions a motivated student actually uses: paraphrase, synonym swaps, homoglyphs, whitespace games.

Against this, the team ran "8 open- and 4 closed-source detectors" — twelve systems, including commercial products. The summary finding:

"current detectors are easily fooled by adversarial attacks, variations in sampling strategies, repetition penalties, and unseen generative models."

Note what is in that list besides attacks: sampling strategies and repetition penalties. These are ordinary generation settings, not evasion. A user who changes a temperature slider defeats detectors by accident.

RAID: the three findings

The paper organizes its results under blunt headers. All three verbatim:

"Finding 1: Default False Positive Rates (FPRs) of open-source detectors are dangerously high." From the full text:

"We see that open-source detectors, especially metric-based detectors, exhibit dangerously high false positive rates when using these naive thresholds."

A detector's threshold — the score above which text gets called AI — is a dial, and the dial ships at a setting that flags far too many humans.

"Finding 2: Detector accuracy varies substantially depending on target False Positive Rate." To make comparison fair, the authors standardized the dial: "In our work, we select a threshold for each model such that the resulting false positive rate of the detector is 5%." Re-thresholded this way, rankings reshuffled and several detectors became, in the paper's word, "nearly inoperable." This is the benchmark's most transferable lesson: an accuracy number without its false-positive rate is not information. The same tool can report 98% or 60% depending on where the dial sits, and a vendor choosing the flattering setting is not lying — just not saying anything checkable.

"Finding 3: Repetition penalty drastically hurts accuracy for all detectors." The repetition penalty is a standard generation setting that discourages a model from reusing tokens. Turning it on changes the output's statistics enough to break every detector tested — all eleven attacks aside.

RAID: the conclusion, and the bright spots

The authors' overall verdict, verbatim:

"Detectors are not yet robust enough for widespread deployment or high-stakes use: many detectors we tested are nearly inoperable at low false positive rates, fail to generalize to alternative decoding strategies or repetition penalties, show clear bias towards certain models and domains, and quickly degrade with simple black-box adversarial attacks."

RAID is a careful paper, and it credits what worked:

"Binoculars, for example, performed impressively well across models even at extremely low false positive rates, Originality achieved high precision in some constrained scenarios, and GPTZero was unusually robust to adversarial attacks."

But none of the bright spots overturn the verdict; on false positives specifically, "Our results also support this and suggest that the problem of false positives remains unsolved."

The paper versus the project

RAID is maintained as a live leaderboard, and the dataset has grown past the paper. The project README (tagline: "Open Leaderboards. Trustworthy Evaluation. Robust AI Detection.") currently states:

"RAID is the largest & most comprehensive dataset for evaluating AI-generated text detectors. It contains over 10 million documents spanning 11 LLMs, 11 genres, 4 decoding strategies, and 12 adversarial attacks."

So: 6M+ generations / 8 domains / 11 attacks in the 2024 paper; 10M+ documents / 11 genres / 12 attacks in the project today. When citing RAID, the paper's numbers belong to the paper's experiments; the README's numbers describe the current dataset. We quote both and keep them apart.

M4: the generalization benchmark

Where RAID stresses robustness, M4 — "Multi-generator, Multi-domain, and Multi-lingual Black-Box Machine-Generated Text Detection" (Wang et al., first released May 2023, revised March 2024) — stresses transfer: what happens when a detector meets text from a domain or a generator it was not trained on. This is the deployed reality of every classroom detector: students do not restrict themselves to the models and genres in the vendor's training set.

The headline finding, verbatim from the abstract:

"Through an extensive empirical study of this dataset, we show that it is challenging for detectors to generalize well on instances from unseen domains or LLMs. In such cases, detectors tend to misclassify machine-generated text as human-written."

Two things to extract. First, the failure direction: under distribution shift, detectors default to "human." A new model's output — precisely the text a detector has never seen — is the text most likely to pass. Every time a new frontier model ships, deployed detectors are at their weakest against it, silently, until retrained. Second, the multilingual dimension: M4's corpus spans multiple languages, extending the evaluation beyond the English-only setting of most detector marketing (and connecting to the non-native-speaker findings on the false-positive side).

The authors' own summary of the state of the art:

"These results show that the problem is far from solved and that there is a lot of room for improvement."

The two benchmarks, side by side

	RAID (Dugan et al., ACL 2024)	M4 (Wang et al.)
Scale	6M+ generations (paper); 10M+ documents (project today)	multi-generator, multi-domain, multilingual corpus
Stress axis	robustness: attacks, decoding settings, thresholds	generalization: unseen domains and unseen LLMs
Detectors tested	8 open + 4 closed source	multiple, per-experiment
Key finding	"easily fooled by adversarial attacks, variations in sampling strategies, repetition penalties, and unseen generative models"; default FPRs "dangerously high"	"detectors tend to misclassify machine-generated text as human-written" on unseen domains/LLMs
Verdict	"not yet robust enough for widespread deployment or high-stakes use"	"the problem is far from solved"

What the literature does and does not establish

Established:

• On the largest shared benchmark, no detector family survived the full matrix of models, domains, decoding settings, and cheap attacks; the authors conclude detectors are "not yet robust enough for widespread deployment or high-stakes use" (RAID).
• Default thresholds of open-source detectors produce "dangerously high" false-positive rates, and reported accuracy is not interpretable without the false-positive rate it was measured at (RAID, Findings 1–2).
• Ordinary generation settings — not just deliberate evasion — break detection: "Repetition penalty drastically hurts accuracy for all detectors" (RAID, Finding 3).
• Under domain or model shift, detectors fail toward "human," meaning new models are hardest to detect exactly when they are newest (M4).
• Some detectors are meaningfully better than others on specific axes (RAID's notes on Binoculars, Originality, GPTZero) — the field is not uniform, and shared leaderboards make the differences visible.

Not established:

• Today's leaderboard standings. Both benchmarks are living projects; RAID's dataset has already grown past its paper. Any specific ranking is a snapshot — the durable findings are structural (threshold sensitivity, shift fragility, the failure directions).
• Classroom base rates. Benchmarks measure corpus-level discrimination, not how often a given honest student is flagged across a semester.
• That benchmark performance transfers to text types outside the corpora — very short answers, code, and heavily collaborative documents are not the bulk of either dataset.

Why this matters for provenance

Benchmarks are the detection field grading its own homework honestly — and the grade, from its two largest shared evaluations, is that output-side detection cannot carry high-stakes decisions. Both papers locate the failure in the same place: the finished text is the only evidence, and the finished text is cheap to move out of distribution. Evidence about the process — created while the writing happened, not inferred from the artifact afterward — does not share that failure mode. See what writing provenance is and how AI detectors work — and why they break.

Related reading: how accurate are AI text detectors? · paraphrase attacks on AI detectors · LLM watermarking — where the research stands