Paraphrase attacks on AI-text detectors: a close reading of the evasion literature

What this review covers

Every AI-text detector, whatever its architecture, makes one wager: that machine-generated prose carries statistical fingerprints a classifier can find. The paraphrase-attack literature tests the obvious counter-move — run the generated text through a rewriting step and see whether the fingerprints survive. This review reads the two foundational attack papers closely, checks their numbers, follows the defenses they propose, and connects the laboratory results to the field measurements from the educational-integrity literature.

The short version, supported in detail below: paraphrasing works as an attack, it works against every detector family tested — classifiers, zero-shot methods, watermarks, and retrieval — and the defenses proposed so far either require infrastructure that does not exist or fall to the next iteration of the same attack. The asymmetry is structural. That conclusion has direct consequences for anyone adjudicating integrity cases on detector scores, and it is the technical backdrop for the commercial "humanizer" industry that industrializes these attacks for $20 a month.

The paraphraser as an instrument: Krishna et al.

The most carefully engineered attack study is Krishna, Song, Karpinska, Wieting and Iyyer, "Paraphrasing evades detectors of AI-generated text, but retrieval is an effective defense" (arXiv:2303.13408, first posted March 2023, revised October 2023). The authors did not use an off-the-shelf rewriter; they built a purpose-designed one, in their words:

"We build a 11B parameter paraphrase generation model (DIPPER) that can paraphrase paragraphs, condition on surrounding context, and control lexical diversity and content reordering."

Three design properties matter. DIPPER paraphrases paragraphs, not sentences, so it can restructure text beyond word swaps. It conditions on surrounding context, so the rewrite stays coherent across a document. And it exposes control knobs for lexical diversity and reordering, so an attacker can dial in exactly as much transformation as evasion requires.

The headline measurement, quoted exactly:

"DIPPER drops detection accuracy of DetectGPT from 70.3% to 4.6% (at a constant false positive rate of 1%), without appreciably modifying the input semantics."

Read the parenthetical carefully, because it is what makes the number damning. Detector accuracy trades off against false positives: any tool can "catch more AI" by flagging more of everything. Holding the false positive rate fixed at 1% — roughly the operating point commercial vendors advertise — the detector's catch rate fell from 70.3% to 4.6%. At that operating point the detector is, functionally, switched off. And the clause "without appreciably modifying the input semantics" closes the remaining escape: the paraphrase did not garble the essay. The cheating student's product survives; the detector's signal does not.

The generalization: Sadasivan et al.

Krishna et al. attacked specific detectors with one strong paraphraser. Sadasivan, Kumar, Balasubramanian, Wang and Feizi, "Can AI-Generated Text be Reliably Detected?" (arXiv:2303.11156, first posted March 2023, revised through January 2025), asked the structural question: does any detector family resist this class of attack? Their method, from the abstract:

"We introduce recursive paraphrasing attack to stress test a wide range of detection schemes"

— recursive meaning the output is paraphrased again, and again — applied, in their words, to detectors

"including the ones using the watermarking as well as neural network-based detectors, zero shot classifiers, and retrieval-based detectors"

That list is the entire known taxonomy of detection, including the two approaches most often proposed as rescues: watermarking (covered in depth in our watermarking review) and the retrieval defense Krishna et al. themselves proposed. The result:

"our recursive paraphrasing method can significantly reduce detection rates, [while] it only slightly degrades text quality"

The paper adds a second attack class that matters for the accusation setting: spoofing. The authors report that

"an attacker can infer hidden AI text signatures without white-box access to the detection method"

and demonstrate the

"susceptibility of watermarked LLMs to spoofing attacks aimed at misclassifying human-written text as AI-generated"

Pause on what spoofing means in an integrity context. Evasion makes guilty text look innocent. Spoofing makes innocent text look guilty — a third party can craft or perturb text so a detector flags a human author. A detection regime vulnerable in both directions cannot anchor a misconduct finding in either direction.

The same paper contributes the theoretical ceiling we examine in the accuracy review: a bound connecting the best achievable detector to the statistical distance between human and AI text distributions — a distance that shrinks with every model generation, because writing like a human is the models' training objective.

The proposed defense, and its honest prerequisites

Krishna et al. did not stop at the attack; the second half of their title is "retrieval is an effective defense." The idea, quoted:

"Our algorithm searches a database of sequences previously generated by the API, looking for sequences that match the candidate text within a certain threshold."

In other words: stop trying to recognize AI style, and instead check whether this specific text (or a paraphrase of it) was previously generated by the provider. Against their own attack it performs well:

"It can detect 80% to 97% of paraphrased generations across different settings while only classifying 1% of human-written sequences as AI-generated."

But look at the prerequisite built into the method's first clause: a database of sequences previously generated by the API. Retrieval only works if the model provider logs every generation, retains it, and exposes a matching service that institutions can query. No major provider operates such a public service; a student can use a local model that logs nothing; and the privacy implications of a permanent, searchable archive of everything every user ever generated are their own research field. (We note, per our sourcing rule, that the fetched abstract states the database prerequisite but we could not verify a fuller limitations discussion from the abstract alone.) And Sadasivan et al. already report their recursive attack degrading retrieval-based detectors among the rest.

So the strongest published defense is one that (a) requires cooperation infrastructure that does not exist, and (b) was partially degraded by the very next paper in the literature. That is not a stable foundation for institutional judgments.

From laboratory to field: the integrity-research measurements

The attack papers use purpose-built paraphrasers. The educational-integrity literature measured what commodity tools do, and found the same effect at consumer scale. Weber-Wulff et al. (2023), the largest independent evaluation of detection tools in an academic setting, tested detectors against AI text that had been machine-paraphrased with Quillbot — a consumer subscription product, not an 11B-parameter research system — and found average detection accuracy fell to 26%, with the authors estimating that

"approximately 50% of AI-generated texts that undergo some obfuscation would likely be misattributed to humans."

Their conclusion for practice: the "systems we tested should not be used in academic settings."

The vendors themselves acknowledge the category. Turnitin's FAQ states its detector "can also identify instances where AI-generated text may have been modified by AI paraphraser or bypasser (also called humanizers) tools to evade detection," while declining to name which tools it counters because disclosure "would make it easier for students to evade." Whatever one makes of that claim, note its epistemic shape: an undisclosed counter-capability against an undisclosed and shifting attack population, with no independently checkable error rate. The laboratory literature gives no reason to expect that race to be won by the defender — and the commercial reality is ~150 humanizer tools iterating against the detectors daily.

Why the asymmetry is structural

Reading the attack papers together, the defender's disadvantage is not a temporary engineering gap. It follows from three facts the literature establishes directly:

1. The attacker moves last. A paraphraser is tuned against today's detectors (Krishna et al.'s control knobs exist precisely for this); a detector must anticipate tomorrow's paraphrasers.
2. The attack preserves the payload. Both papers verify semantic preservation — "without appreciably modifying the input semantics" (Krishna), "only slightly degrades text quality" (Sadasivan). The cheater loses nothing by attacking.
3. Every defense is in-distribution for the next attack. Watermarks, classifiers, zero-shot methods, and retrieval were all degraded by recursive paraphrasing in a single paper. A defense that becomes known becomes a training target.

And the population that cannot attack is the honest one. A student who wrote their own essay has no paraphrase button to press; their risk is set entirely by the detector's false-positive behavior, which the bias literature shows is not evenly distributed. The attack literature and the bias literature describe the same system from two sides: easy to evade if you are cheating, dangerous to be judged by if you are not.

Summary table

Paper	Attack	Target families	Key number / finding
Krishna et al. 2023	DIPPER (11B paraphraser)	Classifiers, zero-shot (DetectGPT), watermark, retrieval	DetectGPT 70.3% → 4.6% at 1% FPR
Sadasivan et al. 2023–25	Recursive paraphrasing; spoofing	Watermarks, neural classifiers, zero-shot, retrieval	Significant detection reduction, slight quality loss; human text spoofable as AI
Weber-Wulff et al. 2023	Commodity paraphrase (Quillbot)	14 commercial/academic tools	26% average accuracy on machine-paraphrased text
Krishna et al. (defense)	—	Retrieval over provider logs	80–97% detection of paraphrased generations at 1% FPR, requires provider-side database

What the literature does and does not establish

Established:

• Paraphrasing defeats every published detector family at realistic operating points, demonstrated independently by at least two research groups and corroborated by the integrity-testing literature with consumer tools.
• The attacks preserve meaning and quality; evasion is effectively free for the attacker.
• Spoofing — making human text read as AI — is demonstrated, not hypothetical.
• The best published defense requires provider-maintained generation archives that do not exist as public infrastructure, and was itself degraded by recursive attacks.

Not established:

• That every commercial detector fails against every commercial humanizer at every setting — vendors claim counter-training, and the specific vendor-vs-tool matchups are not independently measured. The burden of proof, however, sits with the score being used as evidence.
• That paraphrase detection is impossible in principle for specific providers with specific logging infrastructure (the retrieval result shows the opposite, conditional on that infrastructure existing).
• Anything about process-based evidence — these papers study the finished text only, which is precisely their shared limitation.

Where provenance stands in this literature

Notice what every attack in this review has in common: it operates on the finished text, after the writing is over. That is the entire attack surface a detector exposes — and the surface a writing-provenance record does not have. A paraphrased essay still had to arrive in the document somehow, and a consented process record shows how: typed over hours with revision structure, or pasted in three seconds. Paraphrasing the text after the fact does not reach back and edit a sealed record of how it was made; the keystroke-logging literature shows composition and transcription are separable with high accuracy from process features alone.

That is the design argument for Authmarks: move the evidence from the artifact — where this literature shows it cannot survive — to the process, where the attack papers simply do not apply. The record belongs to the writer, is sealed when finished, and can be checked by anyone without an account, which matters most for the writers who were never in the arms race at all.