T5-CSBoost: Adversarial Perturbation Resistant LLM Fingerprinting

Authors: Gayan K. Kulatilleke, Mahsa Baktashmotlagh, Siamak Layeghy, Marius Portmann

Published: 2026-05-08 08:03:47+00:00

Comment: 14 pages, 3 datasets, code and data will be provided

AI Summary

T5-CSBoost enhances the T5-Sentinel framework for robust AI-generated text detection by incorporating an auxiliary margin-based triplet loss over decoder embeddings. This contrastive style regularization enables learning perturbation-resistant stylistic representations without architectural changes, achieving state-of-the-art performance in multiclass source attribution and binary human-vs-LLM detection, even under severe adversarial perturbations.

Abstract

While many AI-generated text (AIGT) detectors achieve strong performance on clean inputs, their accuracy degrades significantly under light paraphrasing, word substitutions, character edits, and distribution shifts. We present T5 Contrastive Style Boosted Classifier (T5-CSBoost), an extension to the T5-Sentinel framework that keeps the original next-token prediction objective for source attribution while introducing an auxiliary margin-based triplet loss over decoder embeddings. This contrastive style regularization encourages the learning of compact, perturbation-resistant stylistic representations, offering a lightweight yet effective alternative to prior approaches that rely on architectural modifications, adversarial training, or complex multi-task objectives without altering the underlying T5-small backbone. T5-CSBoost achieves state-of-the-art multiclass source attribution and binary human-vs-LLM detection on OpenLLMText and HC3 AIGT benchmarks. More importantly, T5-CSBoost demonstrates enhanced robustness to word and character level adversarial perturbations of up to 90% intensity, achieving state-of-the-art on the challenging MAGE/Deepfake stress-test suite, including unseen models, unseen domains, and extreme paraphrasing scenarios. Our results highlight that explicitly regularizing stylistic embeddings via contrastive learning is a practical and effective strategy for building more robust LLM fingerprinting systems in real-world adversarial settings.

Key findings

T5-CSBoost achieves state-of-the-art performance in both multiclass source attribution and binary human-vs-LLM detection on OpenLLMText and HC3 datasets, demonstrating superior accuracy and robustness against word and character-level adversarial perturbations up to 90% intensity. The auxiliary triplet loss is crucial for learning robust, perturbation-resistant stylistic representations, leading to improved performance on challenging out-of-distribution tasks and extreme paraphrasing scenarios in the MAGE/Deepfake testbed.

Approach

The T5-CSBoost model extends the T5-Sentinel framework, which uses a next-token prediction objective for source attribution. It integrates an auxiliary margin-based triplet loss applied to the decoder embeddings, promoting compact intra-class and separated inter-class stylistic representations. This contrastive regularization helps the model learn perturbation-resistant stylistic features without modifying the underlying T5-small backbone.

Datasets

OpenLLMText, HC3, MAGE/Deepfake

Model(s)

T5-small (T5-CSBoost, T5-Sentinel baseline), RoBERTa, DetectGPT, CoCo, PRDetect, OpenAI's classifier, ZeroGPT, T5-Hidden, DeTeCtive, SCL, Binoculars, Longformer, GLTR, FastText, RADAR, PAWN-GPT2, PAWN-Llama3-1b

Author countries

Australia

← Previous