[Paper Review] Zero-Shot Detection of Machine-Generated Codes

Xianjun Yang, Kexun Zhang+4 more|arXiv (Cornell University)|Oct 8, 2023

Software Engineering ResearchComputer Science3 citations

TL;DR

This paper proposes DetectGPT4Code, a zero-shot, training-free method for detecting machine-generated code using a surrogate white-box model to estimate rightmost token probabilities, achieving state-of-the-art performance on GPT-3.5, GPT-4, and text-davinci-003 across Python and Java datasets, with PolyCoder-160M emerging as the most effective universal detector.

ABSTRACT

This work proposes a training-free approach for the detection of LLMs-generated codes, mitigating the risks associated with their indiscriminate usage. To the best of our knowledge, our research is the first to investigate zero-shot detection techniques applied to code generated by advanced black-box LLMs like ChatGPT. Firstly, we find that existing training-based or zero-shot text detectors are ineffective in detecting code, likely due to the unique statistical properties found in code structures. We then modify the previous zero-shot text detection method, DetectGPT (Mitchell et al., 2023) by utilizing a surrogate white-box model to estimate the probability of the rightmost tokens, allowing us to identify code snippets generated by language models. Through extensive experiments conducted on the python codes of the CodeContest and APPS dataset, our approach demonstrates its effectiveness by achieving state-of-the-art detection results on text-davinci-003, GPT-3.5, and GPT-4 models. Moreover, our method exhibits robustness against revision attacks and generalizes well to Java codes. We also find that the smaller code language model like PolyCoder-160M performs as a universal code detector, outperforming the billion-scale counterpart. The codes will be available at https://github.com/ Xianjun-Yang/Code_detection.git

Motivation & Objective

• To address the growing risk of undetected machine-generated code from advanced LLMs like GPT-4 and Codex.
• To investigate why existing text-based detectors fail on code due to its unique statistical properties, such as lower entropy.
• To develop a zero-shot detection method specifically tailored for black-box LLM-generated code without requiring model fine-tuning.
• To evaluate robustness against revision attacks where users modify generated code to evade detection.
• To explore the potential of smaller code-specific models as universal detectors across multiple programming languages and models.

Proposed method

• Adapt the zero-shot text detector DetectGPT by replacing the need for output logits (unavailable in black-box models like GPT-4) with a surrogate white-box model.
• Use a filling-in-the-middle (FIM) task to generate perturbed code snippets by masking a controlled number of lines (optimal: 8 lines).
• Compute the probability of the rightmost token given the preceding context using the surrogate model, with a ratio γ controlling the scoring window.
• Score each code snippet based on the estimated probability of the rightmost tokens, comparing it to a predefined threshold for detection.
• Leverage the surrogate model to estimate likelihoods without access to the original LLM’s internal logits, enabling detection in black-box settings.
• Apply the method across diverse datasets (CodeContest, APPS) and programming languages (Python, Java) to evaluate generalization and robustness.

Experimental results

Research questions

• RQ1 Can existing zero-shot or training-based text detectors effectively detect code generated by advanced LLMs like GPT-3.5 and GPT-4?
• RQ2 How does the structural and statistical uniqueness of code (e.g., lower entropy) affect the performance of standard text detectors?
• RQ3 Can a surrogate white-box model effectively estimate the likelihood of rightmost tokens in code to enable zero-shot detection in black-box LLM settings?
• RQ4 How robust is the proposed method against revision attacks where users modify generated code to evade detection?
• RQ5 Do smaller code-specific language models outperform larger general-purpose LLMs in serving as universal detectors for machine-generated code?

Key findings

• Existing text detectors, including DetectGPT, fail to detect code generated by advanced LLMs due to code’s unique statistical properties such as lower entropy.
• The proposed DetectGPT4Code method achieves state-of-the-art AUROC scores of 79.89 on APPS-GPT3 and 77.90 on APPS-GPT4, with TPR reaching 47.82% and 45.93% respectively.
• Masking 8 lines in the FIM task yields optimal detection performance, as fewer or more masked lines degrade AUROC and TPR due to insufficient or excessive perturbation.
• The method remains robust against revision attacks: performance drops by only 3.09 AUROC points on APPS-GPT4 when 4 lines are revised, indicating strong evasion resistance.
• Surprisingly, the smaller PolyCoder-160M model outperforms larger models as a surrogate detector across all benchmarks, programming languages, and LLMs.
• Detection performance degrades significantly when switching to Java, especially for models not fine-tuned on Java, indicating a need for language-specific adaptation in future work.