Does Paraphrasing Bypass AI Detection? The DIPPER Paper Explained

Does paraphrasing bypass AI detection? In a 2023 test, mostly yes: researchers at UMass Amherst and Google showed that a single pass of a good paraphrasing model could make AI-generated text slip past most detectors, while leaving its meaning almost untouched. Their paper, presented at NeurIPS 2023, cut DetectGPT's detection rate from 70.3% to 4.6% at a fixed 1% false positive rate. It also proposed a defense that does not rely on reading the text's style at all.

The paper is the starting point of most later work on AI humanizers and detector resilience. Here is what it did, what it found, and what it means for people who write with AI help.

What DIPPER is

DIPPER (short for Discourse Paraphraser) is an 11-billion-parameter model fine-tuned from T5-XXL. Most paraphrasers at the time worked one sentence at a time. DIPPER was trained to rewrite whole paragraphs, to use surrounding context such as the original prompt, and to reorder content across sentences.

Its training data came from PAR3, a dataset of multiple English translations of the same non-English novels. Two translators rendering the same paragraph produce natural paraphrases of each other, with different word choices and sentence order but the same content. That gave the model realistic examples of how people express one idea in different ways.

DIPPER has two control settings, both set at inference time:

• Lexical diversity (L): how much wording changes. The authors note that L = 20 corresponds roughly to a 20% lexical modification.
• Order diversity (O): how much content is reordered within the paragraph.

In the main experiments, L was set to 20, 40 or 60 and O to 0 or 60, and each text was paraphrased only once rather than retried until it passed.

How the test was set up

The authors generated 300-token texts with three models of very different sizes: GPT-2 XL (1.5B parameters), OPT-13B, and GPT-3.5 (text-davinci-003). Tasks were open-ended continuation of Wikipedia passages and long-form question answering.

They then tested five detectors: the Kirchenbauer et al. watermark, DetectGPT, GPTZero, OpenAI's AI text classifier and RankGen. Every detector was tuned to a 1% false positive rate, meaning only 1 in 100 human texts would be wrongly flagged. The authors argue this is the right way to judge detectors, adding that even 1% is probably too high in practice.

To check that paraphrases kept their meaning, they used P-SP, a semantic similarity model, plus human evaluation.

What happened to detection rates

• DetectGPT, GPT-2 XL text70.3%
• DetectGPT, after paraphrase4.6%
• Watermark, GPT-2 XL text100%
• Watermark, after paraphrase57.2%
• OpenAI classifier, GPT-3.5 text30.0%
• OpenAI classifier, after paraphrase15.6%

Source: Krishna et al. 2023, section 4.3 (open-ended Wikipedia generation).

Across models, detectors and tasks, paraphrasing lowered detection at every diversity setting. At the same time, 88% to 99% of paraphrases scored above the median similarity of human-written paraphrase pairs, so meaning was largely preserved.

Two other findings stand out:

• Watermarking was the most resilient. It still caught a majority of paraphrased GPT-2 XL texts, because some watermarked tokens survive rewording. Its strength comes from a signal planted at generation time, which is a different kind of evidence from style. See our watermarking explainer for how that signal works.
• Non-watermark detectors were weak even before paraphrasing on the larger models. GPTZero and RankGen caught under 15% of unparaphrased AI text in these settings, and DetectGPT fell from 74.9% on GPT-2 XL to 29.8% on OPT-13B in long-form QA. OpenAI withdrew its classifier in July 2023, citing low accuracy.

Why meaning-preserving rewriting changes the verdict

The result looks surprising until you recall what these detectors measure. As we explain in how AI detectors work, statistical detectors such as DetectGPT score how likely each token is under a language model. A watermark detector counts tokens from a secret "green list". Neither reads the argument.

A paraphrase keeps the argument but redraws the individual word choices from another model's distribution. The tokens that made the original text look machine-like, or watermarked, are replaced with different tokens that mean the same thing. The detector sees a new statistical fingerprint; a reader sees the same paragraph.

That is the core insight the paper hands to everyone who came after: style-based detection measures surface form, and surface form can change while meaning stays fixed. The same idea explains why light human editing confuses detectors in classroom tests, and why the Sadasivan et al. paper, released around the same time, argued detection may be fundamentally limited.

The retrieval defense

The second half of the paper offers a defense that does not depend on style. Instead of asking "does this look machine-written?", it asks "did our model write something with this meaning?"

1. StoreThe language model provider keeps every output its API generates in a database.
2. EncodeA text to be checked is turned into a representation of its content.
3. SearchThe system looks for stored generations with matching content, using BM25 or the P-SP semantic model.
4. DecideIf a close enough match exists, the text is flagged as coming from that provider's model.

Because a paraphrase keeps the content, it still matches the stored original. With a database of 15 million generations, retrieval detected 80% to 97% of paraphrased texts across settings while flagging only 1% of human text. In long-form QA, BM25 retrieval caught 97.8%, 97.3% and 96.2% of the most heavily paraphrased texts from the three models, against 55.8%, 51.4% and 38.1% for the best competing detector.

The authors discuss the limits openly. Retrieval only works if the provider runs it, it can only detect that provider's own outputs, and it raises real questions about storage, privacy and false matches as databases grow. Open-weight models run locally fall outside it entirely.

The humanizer research lineage

DIPPER defined the template that later work built on: transform AI text with a separate model, measure detection at a fixed low false positive rate, and verify that meaning survived. SICO showed the same effect with prompting alone. The RAID benchmark made paraphrase one of eleven standard attacks. More recent work steers paraphrasing with a detector's own feedback.

For academic writers, the lesson is not a recipe. It is a caution about what a detector verdict can mean. A flag, or the absence of one, reflects how a text's surface statistics line up with one model's expectations. It says nothing reliable about who had the ideas. That is why your drafts and notes matter more than any score, and why you should check your institution's or journal's rules on AI assistance and disclose where required. Commercial detectors have also changed since; see can Turnitin detect humanized text?

Where Academic Humanizer fits

Academic Humanizer applies the lesson from this research the other way round: since detectors respond to surface patterns, the goal is to change as little as possible while keeping what matters. The Humanizer rewrites only the sentences detectors flag, leaves the rest exactly as written, and keeps claims, numbers, hedging and citations in place. Its AI Detection Report pairs each flagged sentence with its rewrite so you can check meaning line by line before using the result.