{"id":"fa4388b1-171d-4af6-9012-8a48b333740d","arxiv_id":"2501.03940","paper_version":3,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"A learned token-weighting head over next-token probabilities improves AI-text detection accuracy and generalization with about one million trainable parameters.","lead":"AI-generated text detectors usually average word-by-word statistics; this paper trains a small neural network to weight which words matter more, improving detection on new topics and new AI models. It reports that a roughly one-million-parameter add-on to a frozen language model matches or beats much larger fine-tuned detectors while needing far less training compute.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The OOD generalization claim is only tested against source models of the same broad type as the frozen backbone; the gating head has no way to adapt if a genuinely different tokenizer or architecture shifts the next-token statistics.","rationale":"The reader's weakest assumption is that a single frozen LLM's next-token metrics and hidden states carry enough signal to separate human from AI text across unseen domains and source models. That is exactly the load-bearing point I stress. The paper validates this assumption on a range of modern transformer-based, subword-tokenized LLMs, and the results are encouraging, but the central claim is broader than the evidence. The gating mechanism can only reweight features that the backbone already provides, so if a truly different source model produces text with unfamiliar surface statistics, there is no learned mechanism to recover the signal. Appendix B's finding that the highest-weighted tokens are surface-level discourse markers strengthens this concern, and the large degradation under paraphrasing shows that the learned weighting is sensitive to surface form. This does not invalidate the paper; the conditional verdict already asks for additional evidence. My concrete test would settle the scope of the claim by adding one held-out model family with a genuinely different tokenizer or architecture. The paper deserves credit for releasing code, caching to reduce training cost, and being transparent about the RAID split mismatch and the paraphrasing limitation; those strengths remain intact.","tokens_in":28112,"tokens_out":12383,"duration_ms":126207,"concrete_test":"Hold out one model family whose tokenizer and architecture are qualitatively different from GPT-2 and Llama-3.2, for example Mamba-2.8B, RWKV, or a byte-level model, and generate test texts in the same domains used for training. Train PAWN-GPT2 and PAWN-LLaMA together with the Longformer and RoBERTa baselines on MAGE's main corpus, then evaluate on this held-out family plus human text from the same domains. If PAWN's AvgRec and AUROC advantage over the fine-tuned baselines in testbeds 5-7 is not reproduced for this family, the central OOD generalization claim is limited to subword-transformer-like source models.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is that a small learned reweighting of one frozen LLM's next-token metrics generalizes to unseen domains and source models. For this to hold, the features extracted by the frozen backbone must retain a transferable human-vs-machine signal for any likely source model. The evidence covers decoder-only transformer LLMs with subword tokenizers similar to GPT-2 and Llama-3.2 (MAGE families, M4 models, RAID models). It does not include a source model with a fundamentally different architecture or tokenization, such as Mamba, RWKV, a char-level model, or a sentencepiece-unigram model. Because the gating network only reweights the five next-token metrics, it cannot create signal that the backbone does not provide; if the unseen model's text has very different surface statistics, the softmax weights learned on MAGE may be miscalibrated. Appendix B supports this worry: the highest-weighted tokens are surface and stylistic cues such as 'Additionally', 'Furthermore', and 'bacteria', and the known collapse under paraphrasing attacks (testbed 8) shows that the learned weighting can be disrupted by changing surface form. Thus the 'unseen source model' part of the central claim may be an artifact of evaluating within a narrow model family rather than a general property of next-token distributions.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes Perplexity Attention Weighted Network (PAWN), a supervised detector that takes a frozen LLM's next-token distribution metrics (log-probability of the next token, entropy, max log-probability, rank, top-p) over a text, and uses a small MLP 'gate' to compute per-token, per-feature weights from the LLM's last hidden states and positional indices. A softmax over sequence length produces weights, and the weighted sum of metric features is passed to a final MLP for binary classification. The head has about 1M-1.6M trainable parameters. Evaluations on MAGE (testbeds 1-8), M4 (domain, language, model leave-one-out), and RAID (decoding strategies, repetition penalty, adversarial attacks) compare PAWN against fine-tuned LMs, zero-shot detectors, and RAID baselines. The central claim is that PAWN is competitive in-distribution and better out-of-distribution than fine-tuned LMs, with more stable decision boundaries and robustness to attacks.","tokens_in":28374,"tokens_out":9771,"duration_ms":86019,"significance":"If supported, the result is practically important: a lightweight head on frozen LLM features yields competitive in-distribution and superior OOD detection at low training cost. The paper's strengths include the use of standard held-out testbeds (MAGE testbeds, M4 leave-one-out), McNemar significance tests on MAGE, a clear ablation isolating the contribution of the weighting mechanism, transparent release of code, and an honest statement of the paraphrasing weakness. The RAID evaluation, however, mixes test splits, and the OOD source-model evidence is confined to one architectural family, so the scope of the headline claims needs tightening.","major_comments":[{"comment":"The RAID evaluation mixes results from different test splits and different training sets. PAWN, Longformer, RoBERTa, RADAR-PTM, and fine-tuned RADAR are evaluated on the authors' own split of the RAID open data, whereas the RAID-published baselines (R-B GPT2, R-L GPT2, GLTR, Binoculars, GPTZero, etc.) are evaluated on the hidden test set and trained on different datasets. The footnote to Table 10 acknowledges this, but the text still asserts relative conclusions such as \"the methods in the first box ... are generally inferior in absolute terms\" and the table presents all rows under one 'Avg.' column. Because split difficulty is not controlled, cross-split comparisons do not support claims of superiority over those baselines. Please either rerun the RAID baselines on the same split used for PAWN, or clearly separate the tables and explicitly state that no cross-split comparison is valid. This issue is load-bearing for the \"more robust to adversarial attacks\" claim, which relies on Table 12.","section":"Section 4.5, Tables 10-12"},{"comment":"The claim that PAWN \"generalizes better to unseen domains and source models\" is only evidenced for source models from the same broad family as the frozen backbones: all are decoder-only transformer LLMs with subword tokenizers (GPT-2, Llama, Mistral, MPT, Bloomz, ChatGPT, Cohere, Davinci, Dolly, GPT-4). No test includes architectures with fundamentally different tokenization or sequence models (e.g., Mamba, RWKV, char-level models). Because the gating head can only reweight the frozen backbone's next-token metrics, it cannot create signal absent from the backbone; if an unseen model's text has very different surface statistics, the learned softmax weights may be miscalibrated. Appendix B's observation that the highest-weighted tokens are surface/stylistic (\"Additionally\", \"Furthermore\", \"bacteria\") and the near-collapse under paraphrasing (MAGE TB8) reinforce this concern. I recommend either adding at least one out-of-family source model to the OOD evaluation or explicitly restricting the generalization claim to the tested model family.","section":"Section 4.1 and 4.4, abstract"},{"comment":"In the OOD language tests, PAWN-GPT2 achieves an AUROC of 0.162 on German, far below the random baseline of 0.5. Such a value suggests either label inversion, threshold miscalibration, or an evaluation artifact. The paper should explain this result or correct it, since it undermines confidence in the multilingual evaluation for the GPT-2 backbone (even if the LLaMA backbone performs well).","section":"Section 4.4, Table 9"}],"minor_comments":[{"comment":"\"Italia\" should be \"Italian\", and there are several OCR artifacts in the text (\"V oight-Kampff\", \"W A N\", \"P A WN\") that should be cleaned.","section":"Section 2.2"},{"comment":"The entropy metric M^{entropy}_i = \\sum_j P_{i,j} \\log P_{i,j} is the negative of the usual Shannon entropy; the sign convention should be stated so that the reader knows whether larger values correspond to more random distributions.","section":"Section 3.1"},{"comment":"The definition of M^{rank}_i = rank(\\log P_{i,:}, t_{i+1}) / V should specify whether rank is 1-based and whether higher rank corresponds to higher probability.","section":"Section 3.1"},{"comment":"The header layout (e.g., \"Chat No Chat\" under \"Open Source\") is confusing; a clearer presentation would separate open-source and closed-source results into distinct column groups with explicit labels.","section":"Table 10"},{"comment":"The ensemble experiments are useful, but the conclusion \"we recommend against using ensembled PAWN models\" should be justified with a small note on the computational cost of ensembling relative to the observed gains.","section":"Section 4.3"},{"comment":"References [30] and [31] are pre-prints; please update to the published versions if available.","section":"References"}],"recommendation":"major_revision","confidential_remarks":"The paper is a solid empirical contribution with transparent code and sound main experimental design for MAGE and M4. The main concerns are the RAID cross-split comparison and the scope of the OOD source-model claim. If the authors tighten these, the paper would be acceptable. The manuscript fits the journal's scope. No concerns about citation behavior or novelty disclosure."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: PAWN is a real, modest contribution — a learned gate over five next-token distribution metrics, weighted by hidden states and position, replacing plain mean aggregation. The MAGE and M4 held-out results back the central claim: competitive in-distribution with fine-tuned LMs at a fraction of trainable parameters, and better out-of-distribution recall/AUROC on those testbeds. The paper is also honest about its weaknesses, which counts for something.\n\nWhat's actually new: the attention-weighted aggregation itself. Prior zero-shot detectors average the metrics; Liu et al. use fixed keyword weighting. PAWN learns per-token weights from the backbone's own hidden states and positions, and the ablation (Table 7) shows this middle ground beats both the pure metrics branch and the pure hidden-state branch out-of-distribution. Code is public, hyperparameters are concrete, and the caching trick makes training cheap.\n\nSoft spots, in proportion: (1) The RAID comparison is not fully apples-to-apples. PAWN and the locally trained baselines are run on the authors' own split of RAID's open data, while the baseline numbers from the original RAID paper come from the hidden test set. The paper discloses this, but it still undermines any fine-grained ranking against those baselines. (2) No multi-seed variance anywhere. Given the head is only ~1M parameters and training is cheap, five seeds and error bars would be easy and would materially strengthen the paper. (3) The 'unseen source model' claim is tested on a narrow family of generators — all standard subword-transformers. The stress-test note about tokenizer/architecture conflates the generator with the frozen backbone; what is genuinely missing is evidence for Mamba/RWKV-style generators or non-subword tokenizers. The Appendix B weight analysis supports the worry that the head latches onto surface cues like 'Additionally' and 'Furthermore', and the paraphrasing-attack collapse (testbed 8, Table 5) is real. That doesn't kill the paper — the authors state it as a known weakness — but the generalization-to-unseen-models claim should be labeled as 'unseen models of the standard family.'\n\nWho this is for: anyone working on practical AI-text detection or on why next-token statistics separate human from machine text. It deserves a serious referee. My recommendation: send it out, ask for multi-seed runs and a clarified RAID split; the central idea is sound and the evidence on MAGE/M4 supports it.","headline":"PAWN is a genuine, modest contribution with solid MAGE/M4 evidence and some honest caveats; the RAID split mismatch and missing variance estimates are fixable, so it deserves peer review.","tokens_in":28900,"tokens_out":3619,"would_cite":true,"duration_ms":34506,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"PAWN claims that learning to weight token-level likelihood metrics—rather than averaging them—lets a frozen-LLM detector match or beat fine-tuned encoders in-distribution and generalize better to unseen domains and generators.","keywords":["AI-generated text detection","perplexity weighting","next-token distribution metrics","out-of-distribution generalization","frozen LLM detector","multilingual detection","adversarial robustness"],"falsifier":"Train PAWN and its mean-aggregation ablation (MPN) on the same corpus, then evaluate both on texts generated with a decoding setting absent from training, such as strong repetition penalty or a very different sampling temperature; if MPN matches or beats PAWN's recall at 5% FPR, the learned weighting is not what drives the reported generalization.","tokens_in":27917,"feed_emoji":"🔍","tokens_out":5097,"duration_ms":47140,"temperature":0.7,"pith_summary":"This paper argues that zero-shot AI-text detectors fail partly because they average next-token statistics across all tokens, treating easy and hard predictions alike. It proposes PAWN, a small trained head on top of a frozen LLM that uses the model's hidden states and token positions to weight five next-token distribution metrics before aggregating them. With roughly a million trainable parameters and cached backbone outputs, PAWN reports in-distribution performance competitive with fine-tuned encoder detectors and larger out-of-distribution gains on unseen domains, source models, languages, and decoding settings. The paper's central claim is that semantic-and-position-weighted aggregation is what transfers, not semantic information used directly for classification.","feed_headline":"Weighted token surprise beats fine-tuned AI-text detectors","feed_subtitle":"A one-million-parameter head on a frozen LLM generalizes to unseen domains and languages better than fine-tuned encoders.","key_machinery":"The central object is the Perplexity Attention Weighted Network (PAWN), a gated aggregation head on a frozen decoder-only LLM. For each token it forms five next-token distribution metrics, processes them with an MLP into F feature channels, and builds G gate logits from the hidden states of the token and its successor plus the normalized position; a softmax across the sequence length turns these gates into weights that sum to one, and the weighted sum of metric features feeds a final classification MLP. The design restricts hidden-state and position information to weighting only, which the paper argues is why PAWN fits in-distribution data without learning domain-specific semantic shortcuts that hurt generalization.","core_discovery":"On the paper's own terms, the discovery is that a frozen LLM's next-token distributions are a much stronger detection signal than zero-shot use of them suggests, once tokens are weighted by how informative they are. PAWN computes five per-token metrics—log-probability of the occurring token, distribution entropy, maximum log-probability, rank of the occurring token, and top-p coverage—and replaces the usual mean with a weighted sum. The weights come from a small MLP that sees the concatenated hidden states of the current and next token plus a normalized position index, softmaxed across the sequence so they act purely as gates over the metric features. Reported results show PAWN matching or beating the strongest fine-tuned baselines on MAGE's unrestricted in-distribution testbed while suffering smaller performance drops when domain, source model, or language is held out; the same head also retains most of its accuracy under several non-paraphrase adversarial attacks.","pith_inferences":["If the weighting principle transfers, the same frozen-backbone head could be applied to other per-token signals, such as authorship attribution or machine-translation quality estimation, where token-level confidence is known to be heterogeneous.","The paper's own ablation suggests a testable extension: adversarially training the small head against a paraphrasing model could close the paraphrase gap without giving up the generalization advantage, an option the paper names as future work but does not run.","The learned per-token weights themselves may serve as an interpretability probe: the appendix already shows that the head upweights sentence-initial discourse markers and downweights word fragments and digits, suggesting the weights encode stylistic priors about which cues betray machine authorship.","A cheap stress test of the claim is to swap the backbone for a model with a very different tokenizer and re-run the leave-one-source-model testbeds; if transfer fails there, the approach is tied to the specific backbone's tokenization rather than to a general property of next-token statistics."],"forward_implications":["Training a detector no longer requires fine-tuning a large language model: a ~1M-parameter head on a frozen backbone reaches the accuracy of fine-tuned encoder detectors in-distribution.","Because the backbone is frozen, its hidden states and metrics can be cached once on disk, cutting training time by a factor of 7–10 in the reported setup.","Out-of-distribution detection improves in exactly the settings where deployed detectors fail: unseen domains, unseen source models, unseen languages, and unseen decoding strategies such as repetition penalty.","The detector's decision boundary is more stable across distribution shifts, so a threshold chosen on training data does not degrade as much when the detector is applied to a new domain.","Paraphrasing attacks remain the main failure mode, indicating that robustness to semantic rewriting needs additional machinery such as adversarial training."],"supporting_citations":[{"why":"Provides the MAGE benchmark, its eight testbeds, and the Longformer and RADAR baselines that PAWN is compared against.","marker":"[2]"},{"why":"Supplies the M4 multi-domain, multi-model, multi-lingual corpus used for leave-one-out generalization tests.","marker":"[3]"},{"why":"Supplies the RAID benchmark with decoding-strategy, repetition-penalty, and adversarial-attack splits used to test robustness and generalization.","marker":"[4]"},{"why":"Defines Binoculars, the zero-shot next-token-distribution baseline whose aggregation scheme PAWN is designed to improve on.","marker":"[5]"},{"why":"Introduces DetectLLM's log-rank and probability-curvature metrics, motivating the rank and top-p features PAWN includes.","marker":"[6]"},{"why":"Establishes DetectGPT's perturbation-based zero-shot detection, an example of limited zero-shot performance that motivates learning the aggregation.","marker":"[7]"},{"why":"Provides the M4GT-Bench evaluation protocol and XLM-RoBERTa baselines used for out-of-distribution domain, language, and model tests.","marker":"[11]"},{"why":"Supplies the GPT-2 backbone that demonstrates PAWN works with a small frozen LLM.","marker":"[30]"},{"why":"Supplies the Llama-3.2-1B-Instruct backbone used for the stronger PAWN variant and for multilingual generalization results.","marker":"[31]"}],"fun_headline_variants":["Weighing token surprise beats fine-tuning for AI-text detection","PAWN: weighted token probabilities spot AI text better","Not all tokens equal: PAWN improves AI-text detection","Token-weighting detector generalizes beyond training domains"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that a single frozen LLM's next-token distribution and hidden states contain enough transferable signal to distinguish human from machine text across unseen domains, languages, and generators; if those representations fail to transfer, say to a model with very different tokenization or decoding, the trained head can only reweight the features it already has and cannot recover the missing signal.","fun_headline_variants_meta":{"raw":{"variants":["Weighing token surprise beats fine-tuning for AI-text detection","PAWN: weighted token probabilities spot AI text better","Not all tokens equal: PAWN improves AI-text detection","Token-weighting detector generalizes beyond training domains"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000594,"raw_usage":{"total_tokens":2846,"prompt_tokens":1071,"completion_tokens":1775,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":687,"completion_tokens_details":{"reasoning_tokens":1710}},"tokens_in":687,"tokens_out":1775,"duration_ms":13909,"temperature":1.0,"reasoning_tokens":1710,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T21:43:14.188557+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train PAWN and its mean-aggregation ablation (MPN) on the same corpus, then evaluate both on texts generated with a decoding setting absent from training, such as strong repetition penalty or a very different sampling temperature; if MPN matches or beats PAWN's recall at 5% FPR, the learned weighting is not what drives the reported generalization.","supporting_citations":[{"cited_title":"M4: Multi-Generator, Multi-Domain, and Multi-Lingual Black-Box Machine-Generated Text Detection","cited_arxiv_id":null,"evidence_quote":"Supplies the M4 multi-domain, multi-model, multi-lingual corpus used for leave-one-out generalization tests."},{"cited_title":"Spotting LLMs with Binoculars: Zero-Shot Detection of Machine-Generated Text","cited_arxiv_id":null,"evidence_quote":"Defines Binoculars, the zero-shot next-token-distribution baseline whose aggregation scheme PAWN is designed to improve on."},{"cited_title":"DetectGPT: Zero-Shot Machine-Generated Text Detection Using Probability Curvature","cited_arxiv_id":null,"evidence_quote":"Establishes DetectGPT's perturbation-based zero-shot detection, an example of limited zero-shot performance that motivates learning the aggregation."},{"cited_title":"Radford et al","cited_arxiv_id":null,"evidence_quote":"Supplies the GPT-2 backbone that demonstrates PAWN works with a small frozen LLM."}],"review_version":1}