NormDetect recovers half the machine text that homoglyph attacks push back into the human range
AspireAI community · arXiv
Web platforms screen posts for machine-written text, and every false flag lands on a real human writer, so detectors have to run at a very low false positive rate. Zero-shot detectors like Binoculars score text with frozen language models, but invisible edits such as homoglyphs shatter tokenization and push machine text into the human range. Unicode normalization undoes those edits, yet the authors find the normalized score still misses half of the machine text at a strict FPR, under attacks that leave nothing to clean. They also report that with the Falcon-7B scoring pair, heads built on token statistics recall less than the normalized score at this FPR and several flag too many human posts in some sections. NormDetect anchors a learned per-section head to the normalized zero-shot score: a blend weight chosen on training folds under a human FPR cap combines the two, and one threshold is calibrated on human text only. On eight sections of the RAID benchmark with eleven attacks, the authors report NormDetect raises recall at a 0.1% calibrated FPR by 5.0 points over normalized Binoculars, with its human FPR bound at most 1% in every section and no other detector within that bound recalling as much. The limitation is that the recall gain is measured against one benchmark family of attacks on English web text.
Read the story and explore more from the AspireAI community.
Two sparse-autoencoder analyses have resisted scaling: matching semantically similar features across layers, and compressing large feature circuits into interpretable supernodes. This paper argues both are the same underlying problem, estimating semantic distances between SAE features that sit on different activation manifolds. Its representation treats each feature not as a single decoder vector but as an activation-weighted distribution over the hidden states expressing it, projects those distributions into a shared reference space, and compares them with Wasserstein distance. The representation is proved invariant to activation rescaling and stable under perturbation, and recovers true matches under finite-sample margin conditions. Empirically it outperformed decoder-vector and LLM-based baselines and captured subtle functional distinctions between related features, and it compressed large feature circuits into interpretable supernodes automatically. The limitation is that this is interpretability tooling: the paper demonstrates better feature matching and circuit compression, not that downstream interpretability claims become more accurate.