Attacking Neural Text Detectors
Table 2: Average rank of each word in GPT-2 117M predictions across 50 randomly chosen text samples for each category.
['[EMPTY]', '[BOLD] Rank']
This experiment, similar to the ones performed by the GLTR authors, was designed to quantify the extent to which a homoglyph attack could shift the distribution of neural text away from that of text produced by a language model. The token’s position within GPT-2 117M’s predictions, or rank, was then recorded. Lower ranks indicate an alignment with GPT-2 117M’s predictions. 50 text samples were randomly chosen from the neural text dataset, which then had the English “e” and English “a” to Cryllic “Ye” and Cyrillic “a” homoglyph attack with no maximum character replacement restriction applied to them. Overall, the homoglyph attack was successful in shifting neural text’s distribution away from that of a language model.