Artificial intelligence generated text detection method based on precise disturbance
By combining self-attention mechanism and thought chain reasoning with reinforcement learning, key semantic features are protected and targeted perturbation training is performed, which solves the robustness and generalization problems of AIGT detection method in cross-domain scenarios and achieves higher detection accuracy and adversarial robustness.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- HUNAN UNIV
- Filing Date
- 2026-01-21
- Publication Date
- 2026-04-24
AI Technical Summary
Existing AIGT detection methods struggle to balance cross-domain generalization and robustness. Feature alignment strategies are susceptible to adversarial perturbations such as synonym substitution and lack fine-grained guidance, making it difficult to form an accurate detection loop.
By utilizing a self-attention mechanism to generate semantic-aware perturbation masks, and combining thought chain reasoning and reinforcement learning, a dynamic perturbation network is used to protect key semantic features, thus achieving a closed loop of feature protection, targeted perturbation, and precise training for detection.
It significantly improves the model's detection accuracy and adversarial robustness in cross-domain scenarios, effectively resists adversarial attacks such as synonym substitution, and enhances cross-domain adaptability and resistance to semantic-level perturbations.
Smart Images
Figure CN121919360A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to an artificial intelligence-generated text detection method based on precise perturbation, belonging to the field of natural language processing. Background Technology
[0002] With the iterative optimization of large-scale language models, AI-Generated Text (AIGT) is becoming increasingly similar to human text in terms of syntax, semantics, and style. While this improves the efficiency of content creation, it also raises issues such as intellectual property infringement, the spread of misinformation, and academic misconduct. Developing reliable AIGT detection tools has become a key requirement for ensuring information security and regulating the dissemination of content.
[0003] Current AIGT detection methods face a core bottleneck: the difficulty in balancing cross-domain generalization and robustness. General-domain detection models suffer performance degradation in fields such as medicine and law due to their inability to adapt to specialized terminology systems; while specific-domain detection models, although highly accurate, incur high costs for scenario transfer. Moreover, both approaches are contradictory: feature alignment strategies that enhance cross-domain capabilities are susceptible to adversarial perturbations such as synonym substitution, while robustness-enhancing defense mechanisms reduce generalization ability to out-of-distribution samples, thus limiting practical applications.
[0004] Existing detection methods based on text embedding perturbations still have technical shortcomings: policy networks cannot capture the semantic relationships between different tokens in text embeddings, and noise perturbations can easily destroy key discriminative features indiscriminately; reinforcement learning reward functions rely solely on classification loss, lacking fine-grained guidance on feature protection and perturbation, and depend on empirical parameter tuning. Meanwhile, Chain-of-Thought (CoT) inference is not yet applied in the AIGT detection field, failing to convert its mined interpretable features into detection optimization criteria, making it difficult to form a precise detection loop.
[0005] Therefore, in this invention, we focus on using a self-attention mechanism to generate semantically aware perturbation masks to protect key discriminative features of the text. We then combine this with thought chain reasoning to mine interpretable features and convert them into reinforcement learning optimization criteria. A dynamic perturbation network is used to achieve a closed-loop detection process of "feature protection - targeted perturbation - precise training." We propose an AI-generated text detection method based on precise perturbation. This method not only effectively balances cross-domain generalization and adversarial robustness but also improves the model's ability to capture the essential differences between human and machine text through a feature-driven training paradigm. It demonstrates superior detection performance compared to existing baseline methods in cross-generator and cross-corpus scenarios across multi-domain datasets. Summary of the Invention
[0006] This invention designs an AI-generated text detection method based on precise perturbation. Under conventional experimental hardware conditions, it leverages semantically aware perturbation masks or CoT-guided reinforcement learning to help a dynamic perturbation network accurately capture the core discriminative differences between AIGT and human text. An attention enhancement module protects key semantic features, and a CoT enhancement module generates targeted perturbation constraints, effectively strengthening the model's cross-domain adaptability and adversarial robustness. Compared to traditional detection methods, it uses a self-attention mechanism to mine semantic relationships between text tokens for precise noise control, resulting in more targeted feature protection. It transforms the interpretable features of CoT inference into reinforcement learning reward signals and action space constraints, outperforming loss-driven optimization paradigms that rely solely on classification loss. This significantly improves detection accuracy in cross-domain scenarios, and its robustness against adversarial attacks such as synonym substitution also significantly surpasses existing baseline methods.
[0007] An AI-generated text detection method based on precise perturbations includes the following steps:
[0008] Step S101: Generate text embedding codes using a pre-trained language model;
[0009] Step S102: Precise perturbation design, providing two independent perturbation schemes. Scheme 1 is attention-enhanced perturbation, and Scheme 2 is CoT-enhanced perturbation; the importance weights are calculated for each.
[0010] Step S103: Deep deterministic policy gradient algorithm optimization treats the mean and variance of Gaussian noise as continuous control actions, constructs a reinforcement learning framework, realizes dynamic regulation of noise distribution and parameter update of policy network, and completes end-to-end training optimization of AIGT detection model.
[0011] Further improvements are made, and the specific steps of step S101 are as follows:
[0012] A pre-trained RoBERTa model with fixed input parameters is used to encode all tokens in the text, generating an initial text embedding with fixed dimensions. This provides a basic semantic representation for subsequent feature optimization and perturbation processing.
[0013] Further improvements are made, and the specific steps of step S102 are as follows:
[0014] Option 1: Attention-enhancing perturbation.
[0015] First, vector mapping is performed, transforming the initial text embedding into a query vector for calculating semantic associations through a linear transformation. Key vector Sum value vector Next, attention weights are calculated. Based on the similarity between the query vector and the key vector, an attention weight matrix reflecting the semantic association strength between different tokens is obtained. :
[0016]
[0017] Next, the semantic importance scoring stage is performed. The data in each row of the attention weight matrix is summed and normalized to obtain the semantic importance score for each token. :
[0018]
[0019] Based on this, a perturbation mask is constructed and noise is modulated. The perturbation mask is constructed according to the semantic importance score. :
[0020]
[0021] Generate another mean and variance Gaussian noise within the specified range The noise and perturbation mask are multiplied element-wise and then superimposed onto the initial text embedding to obtain the noise-enhanced embedding:
[0022]
[0023] Next, the original embedding and the written noise-enhanced embedding are input into the feature extractor to obtain low-dimensional classification representations. and The calculation formula is as follows:
[0024]
[0025] in, represent or , represent or .
[0026] To improve the detector's ability to align noisy samples with original samples, a distance loss is introduced into the model. To minimize the distance between the two embeddings, the calculation formula is as follows:
[0027]
[0028] Using the softmax function and The predicted probabilities are obtained by processing them. and And introduce two cross-entropy losses and To improve prediction accuracy, among which This is the cross-entropy loss for predicting noisy samples under attention-enhanced noise, calculated using the following formula:
[0029]
[0030] Where y is the true label of text x. The total loss of the model... Defined as:
[0031]
[0032] in , and These are adjustable hyperparameters.
[0033] Option 2: Enhance perturbation of the thought chain.
[0034] Two-branch CoT inference and feature extraction. The Llama-2-7b-chat model is used to perform two-branch inference on the input text to generate explanatory text. The structured feature labels are extracted from them, including two categories: human text features as protective features and artificial intelligence-generated text features as enhancement features.
[0035] CoT-perceived multi-dimensional reward function. The original reward... CoT Feature Reward Combined, to form the total reward:
[0036]
[0037] in, and It is a hyperparameter of the reward weight. It is a loss-oriented reward. It is a CoT feature retention reward.
[0038]
[0039] in It is the reward scaling factor. It refers to the similarity of key features between the perturbated text and the original text, calculated using the CoT inference model.
[0040]
[0041] in The CLS vector of the original text. This is the CLS vector after adding noise. (Through...) To ensure that noise adjustment in the model does not destroy key semantics, specifically: when the protective features of human text are preserved after perturbation, or the enhancing features of AI-generated text are effectively destroyed, Give positive rewards; when protective traits are compromised or enhancing traits remain significant, Negative rewards are then given to drive the model to learn to accurately protect or attack specific semantic features while reducing classification loss.
[0042] Feature-guided action space constraints. The feature tokens extracted by CoT are converted into direct constraints on the output actions of the policy network as follows: protective feature tokens, constraining their noise variance. Limit the perturbation intensity; enhance the feature token and constrain its noise variance. Forced perturbation; ordinary token, no additional constraints, applicable to basic noise generated by the policy network.
[0043] Loss function design. The total loss of the model. Defined as:
[0044]
[0045] in , and These are adjustable hyperparameters. It is the cross-entropy loss for predicting noisy samples under the enhanced thinking chain. It is the distance loss of feature embedding under the enhanced thinking chain. =2- , As the expectation operator, the batch average of the weighted classification loss is taken to avoid loss fluctuations caused by anomalies in a single sample dimension.
[0046] Further improvements are made, and the specific steps of step S103 are as follows:
[0047] The mean and variance of Gaussian noise during training are treated as a continuous control task, employing the standard framework of deep deterministic policy gradients. To adjust the noise distribution, a piecewise function is used... Perform the mapping, defined as:
[0048] in, It is an adjustable threshold hyperparameter. This represents the total loss. Next, the interaction data tuples between the model and the environment are... Stored in the experience playback buffer Among them Indicates the current noise distribution status; Indicates the action to be performed; This indicates the subsequent state that occurs after an action is performed; This represents the reward received. Subsequently, for each sampled tuple, the target network is used to calculate the target... value:
[0049]
[0050] in As a discount factor, and Representing the target Network and target policy network, and These are the parameters of the corresponding network. The loss function is minimized. Update Network parameters The loss function is defined as:
[0051]
[0052] Policy Network The update is performed using the gradient of a deterministic policy, and the update formula is as follows:
[0053]
[0054] This new process involves adjusting the parameters of the policy network. In order to maximize expected returns.
[0055] The parameters of the target network are updated using a soft update strategy:
[0056]
[0057]
[0058] in, ≪1 is a small parameter whose function is to ensure that the target network parameters are updated slowly, thereby ensuring the stability of the training process.
[0059] Compared with other methods, the present invention has the following significant advantages:
[0060] This invention utilizes a self-attention mechanism to generate semantically aware perturbation masks to accurately protect key text discriminative features, and leverages CoT inference to mine interpretable features. In a dynamic perturbation network, it combines reinforcement learning to upgrade loss-driven optimization to feature-driven targeted perturbation, offering the following advantages: 1. Cross-domain generalization: By capturing semantic relationships between text tokens through a self-attention mechanism, it avoids the indiscriminate destruction of core features by noise in traditional methods; CoT inference can mine the advantages of domain-specific features, reducing feature mismatch problems in cross-domain scenarios and effectively solving the performance degradation bottleneck caused by domain shift in existing models; 2. Adversarial robustness: By capturing differential noise in semantic feature allocation using a self-attention mechanism, and converting the feature labels extracted by CoT into reinforcement learning action space constraints, it can significantly improve the model's ability to resist semantic-level perturbations when facing adversarial attacks such as synonym substitution. Attached Figure Description
[0061] Figure 1 The overall flowchart of the present invention, "Artificial Intelligence Generated Text Detection Method Based on Precise Perturbation", is shown. Detailed Implementation
[0062] To more clearly demonstrate the features and advantages of this patent, detailed descriptions of embodiments are provided below. It should be understood that the following detailed descriptions are merely examples and are intended to provide further explanation of this application. Unless otherwise stated, all technical and scientific terms used in this specification have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains. Figure 1 An embodiment of this application illustrates an AI-generated text detection method based on precise perturbation, the method comprising the following steps:
[0063] Step 1: Text Embedding Encoding Generation Steps
[0064] A pre-trained RoBERTa model with fixed input parameters is used to encode all tokens in the text, generating an initial text embedding with fixed dimensions. This provides a basic semantic representation for subsequent feature optimization and perturbation processing.
[0065] Step Two: Precise Perturbation Design Steps
[0066] Option 1: Attention-enhancing perturbation.
[0067] First, vector mapping is performed, transforming the initial text embedding into a query vector for calculating semantic associations through a linear transformation. Key vector Sum value vector Next, attention weights are calculated. Based on the similarity between the query vector and the key vector, an attention weight matrix reflecting the semantic association strength between different tokens is obtained. :
[0068]
[0069] Next, the semantic importance scoring stage is performed. The data in each row of the attention weight matrix is summed and normalized to obtain the semantic importance score for each token. :
[0070]
[0071] Based on this, a perturbation mask is constructed and noise is modulated. The perturbation mask is constructed according to the semantic importance score. :
[0072]
[0073] Generate another mean and variance Gaussian noise within the specified range The noise and perturbation mask are multiplied element-wise and then superimposed onto the initial text embedding to obtain the noise-enhanced embedding:
[0074]
[0075] Next, the original embedding and the written noise-enhanced embedding are input into the feature extractor to obtain low-dimensional classification representations. and The calculation formula is as follows:
[0076]
[0077] in, represent or , represent or .
[0078] To improve the detector's ability to align noisy samples with original samples, a distance loss is introduced into the model. To minimize the distance between the two embeddings, the calculation formula is as follows:
[0079]
[0080] Using the softmax function and The predicted probabilities are obtained by processing them. and And introduce two cross-entropy losses and To improve prediction accuracy, among which This is the cross-entropy loss for predicting noisy samples under attention-enhanced noise, calculated using the following formula:
[0081]
[0082] Where y is the true label of text x. The total loss of the model... Defined as:
[0083]
[0084] in , and These are adjustable hyperparameters.
[0085] Option 2: Enhance perturbation of the thought chain.
[0086] Two-branch CoT inference and feature extraction. The Llama-2-7b-chat model is used with the two thought chain prompts in Table 1 to perform two-branch inference on the input text, generating explanatory text. The structured feature labels are extracted from them, including two categories: human text features as protective features and artificial intelligence-generated text features as enhancement features.
[0087] Table 1. Prompt Template Design
[0088]
[0089] CoT-perceived multi-dimensional reward function. The original reward... CoT Feature Reward Combined, to form the total reward:
[0090]
[0091] in, and It is a hyperparameter of the reward weight. It is a loss-oriented reward. CoT feature retention reward:
[0092]
[0093] in It is the reward scaling factor. It refers to the similarity of key features between the perturbated text and the original text, calculated using the CoT inference model.
[0094]
[0095] in The CLS vector of the original text. This is the CLS vector after adding noise. (Through...) To ensure that noise adjustment in the model does not destroy key semantics, specifically: when the protective features of human text are preserved after perturbation, or the enhancing features of AI-generated text are effectively destroyed, Give positive rewards; when protective traits are compromised or enhancing traits remain significant, Negative rewards are then given to drive the model to learn to accurately protect or attack specific semantic features while reducing classification loss.
[0096] Feature-guided action space constraints. The feature tokens extracted by CoT are converted into direct constraints on the output actions of the policy network as follows: protective feature tokens, constraining their noise variance. Limit the perturbation intensity; enhance the feature token and constrain its noise variance. Forced perturbation; ordinary token, no additional constraints, applicable to basic noise generated by the policy network.
[0097] Loss function design. The total loss of the model. Defined as:
[0098]
[0099] in , and These are adjustable hyperparameters. It is the cross-entropy loss for predicting noisy samples under the enhanced thinking chain. It is the distance loss of feature embedding under the enhanced thinking chain. =2- , As the expectation operator, the batch average of the weighted classification loss is taken to avoid loss fluctuations caused by anomalies in a single sample dimension.
[0100] Step 3: Reinforcement Learning Steps
[0101] The mean and variance of Gaussian noise during training are treated as a continuous control task, employing the standard framework of deep deterministic policy gradients. To adjust the noise distribution, a piecewise function is used... Perform the mapping, defined as:
[0102] in, It is an adjustable threshold hyperparameter. This represents the total loss. Next, the interaction data tuples between the model and the environment are... Stored in the experience playback buffer Among them Indicates the current noise distribution status; Indicates the action to be performed; This indicates the subsequent state that occurs after an action is performed; This represents the reward received. Subsequently, for each sampled tuple, the target network is used to calculate the target... value:
[0103]
[0104] in As a discount factor, and Representing the target Network and target policy network, and These are the parameters of the corresponding network. The loss function is minimized. Update Network parameters The loss function is defined as:
[0105]
[0106] Policy Network The update is performed using the gradient of a deterministic policy, and the update formula is as follows:
[0107]
[0108] This new process involves adjusting the parameters of the policy network. In order to maximize expected returns.
[0109] The parameters of the target network are updated using a soft update strategy:
[0110]
[0111]
[0112] in, ≪1 is a small parameter whose function is to ensure that the target network parameters are updated slowly, thereby ensuring the stability of the training process.
[0113] For the training task, we treated it as a binary classification problem, experimenting with the M4 dataset. The data source was represented by a combination of the corpus name and the generator name. We used "Arxiv ChatGPT" as the training set and then tested it on datasets across corpora and generators. All networks used the Adam optimizer, with a learning rate of 3e-4 for the actor and critic, and 8e-5 for the encoder, employing a learning rate decay strategy. Model training was conducted on an NVIDIA GeForce RTX 4090 hardware environment. The RL_Att model underwent 350 epochs of training on the source domain data, taking approximately 7 hours in total. The RL_CoT model underwent segmented training, first using the Llama-2-7b-chat model for bi-branch inference to extract structured feature labels, and then training on the source domain data for 20 epochs, taking approximately 45 minutes. After training, the performance of both models was evaluated on multiple target domain test sets. The remaining training parameters are as follows: =0.9, =0.1, =5, =0.5, =1, =0.01, =1.
[0114] In the specific experimental verification process, we selected relatively advanced existing methods for comparison. Regarding evaluation metrics, we used accuracy and F1 score to assess the generalization ability of the proposed method. The experimental results are shown in Table 2:
[0115] Table 2 Generalization performance evaluation
[0116]
[0117] The robustness test results under a synonym substitution attack with a substitution rate of 0.2 are shown in Table 3:
[0118] Table 3. Robustness experiments against synonym substitution attacks
[0119]
[0120] Next, the AIGT was rewritten in two rounds using the Flan-T5-base model. The results of this robustness experiment are shown in Table 4.
[0121] Table 4. Robustness experiments against rewrite attacks
[0122]
[0123] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.
Claims
1. A method for detecting text generated by artificial intelligence based on precise perturbation, characterized in that, Includes the following steps: Step S101: Generate text embedding codes using a pre-trained language model; Step S102: Precise perturbation design, providing two independent perturbation schemes. Scheme 1 is an attention-enhancing perturbation, and Scheme 2 is a chain-of-thought (CoT)-enhancing perturbation, calculating the importance weights for each; Step S103: Deep deterministic policy gradient algorithm optimization. The mean and variance of Gaussian noise are regarded as continuous control actions. A reinforcement learning framework is constructed to realize the dynamic control of noise distribution and the parameter update of policy network, thus completing the end-to-end training optimization of the artificial intelligence text detection model.
2. The method for detecting AI-generated text based on precise perturbation according to claim 1, characterized in that, The specific steps of step S101 are as follows: A pre-trained RoBERTa model with fixed input parameters is used to encode all tokens in the text, generating an initial text embedding with fixed dimensions. This provides a basic semantic representation for subsequent feature optimization and perturbation processing.
3. The AI-generated text detection method based on precise perturbation as described in claim 1, characterized in that, The specific steps of step S102 are as follows: Option 1: Attention-enhancing perturbation; First, vector mapping is performed, transforming the initial text embedding into a query vector for calculating semantic associations through a linear transformation. Key vector Sum value vector Next, attention weights are calculated. Based on the similarity between the query vector and the key vector, an attention weight matrix reflecting the semantic association strength between different tokens is obtained. : Next, the semantic importance scoring stage is performed. The data in each row of the attention weight matrix is summed and normalized to obtain the semantic importance score for each token. : Based on this, a perturbation mask is constructed and noise is modulated. The perturbation mask is constructed according to the semantic importance score. : Generate another mean and variance Gaussian noise within the specified range The noise and perturbation mask are multiplied element-wise and then superimposed onto the initial text embedding to obtain the noise-enhanced embedding: Next, the original embedding and the written noise-enhanced embedding are input into the feature extractor to obtain low-dimensional classification representations. and The calculation formula is as follows: in, represent or , represent or ; To improve the detector's ability to align noisy samples with original samples, a distance loss is introduced into the model. To minimize the distance between the two embeddings, the calculation formula is as follows: Using the softmax function and The predicted probabilities are obtained by processing them. and And introduce two cross-entropy losses and To improve prediction accuracy, among which This is the cross-entropy loss for predicting noisy samples under attention-enhanced noise, calculated using the following formula: Where y is the true label of text x. The total loss of the model. Defined as: in , and These are adjustable hyperparameters; Option 2: Enhance perturbation of the thought chain; Two-branch CoT inference and feature extraction. The Llama-2-7b-chat model is used to perform two-branch inference on the input text to generate explanatory text. And extract structured feature labels from them, including two categories: human text features as protective features and artificial intelligence generated text features as enhancement features; CoT-perceived multi-dimensional reward function. The original reward... CoT Feature Reward Combined, to form the total reward: in, and It is a hyperparameter of the reward weight. It is a loss-oriented reward. CoT feature retention reward: in It is the reward scaling factor. It refers to the key feature similarity between the perturbated text and the original text calculated by the CoT inference model; in The CLS vector of the original text. This is the CLS vector after adding noise. (Through...) To ensure that noise adjustment in the model does not destroy key semantics, specifically: when the protective features of human text are preserved after perturbation, or the enhancing features of AI-generated text are effectively destroyed, Give positive rewards; when protective traits are compromised or enhancing traits remain significant, Negative rewards are then given to drive the model to learn to accurately protect or attack specific semantic features while reducing classification loss. Feature-guided action space constraints. The feature tokens extracted by CoT are converted into direct constraints on the output actions of the policy network as follows: protective feature tokens, constraining their noise variance. Limit the perturbation intensity; enhance the feature token and constrain its noise variance. Forced perturbation is applied; ordinary tokens have no additional constraints and are subject to basic noise generated by the policy network. Loss function design. The total loss of the model. Defined as: in , and These are adjustable hyperparameters. It is the cross-entropy loss for predicting noisy samples under the enhanced thinking chain. It is the distance loss of feature embedding under the enhanced thinking chain; =2- , As the expectation operator, the batch average of the weighted classification loss is taken to avoid loss fluctuations caused by anomalies in a single sample dimension.
4. The AI-generated text detection method based on precise perturbation according to claim 1, characterized in that, The specific steps of step S103 are as follows: The mean and variance of Gaussian noise during training are treated as a continuous control task, employing the standard framework of deep deterministic policy gradients. To adjust the noise distribution, a piecewise function is used... Perform the mapping, defined as: in, It is an adjustable threshold hyperparameter. This represents the total loss. Next, the interaction data tuples between the model and the environment are... Stored in the experience playback buffer Among them Indicates the current noise distribution status; Indicates the action to be performed; This indicates the subsequent state that occurs after an action is performed; This represents the reward received. Subsequently, for each sampled tuple, the target network is used to calculate the target... value: in As a discount factor, and Representing the target Network and target policy network, and These are the parameters of the corresponding network. The loss function is minimized. Update Network parameters The loss function is defined as: Policy Network The update is performed using the gradient of a deterministic policy, and the update formula is as follows: This new process involves adjusting the parameters of the policy network. In order to maximize expected returns; The parameters of the target network are updated using a soft update strategy: in, ≪1 is a small parameter whose function is to ensure that the target network parameters are updated slowly, thereby ensuring the stability of the training process.