Adnan KhanAdnanProduct & AI
San Francisco Bay Area
Get in touch

Source note2 min read

UTS at ELOQUENT 2026 Voight-Kampff: structural shifts in AI writing bypass state-of-the-art detectors

Source

arXiv

arxiv.org/abs/2607.13565v1

Read the source

Source

Plain-Language Brief

The authors investigate language model evasion attacks on state-of-the-art detectors in the ELOQUENT 2026 Voight-Kampff competition. They find that pushing generated text out of the detector's training distribution effectively bypasses adversarial detection, while pulling it into the distribution fails. Two novel attack families, cross-decade register attacks and modernist stream-of-consciousness form, are introduced, achieving higher fool rates than previous methods without losing naturalness.

What the Document Says

  • The authors investigate the survival of language model evasion attacks on state-of-the-art adversarial fine-tuning in ELOQUENT 2026 Voight-Kampff.
  • They find that pushing generated text out of the detector's training distribution defeats adversarial detection, while pulling it into the distribution fails completely.
  • Two novel out-of-distribution attack families are introduced: cross-decade register attacks and modernist stream-of-consciousness form.
  • These strategies bypass adversarial closure, achieving higher fool rates than previous methods.
  • The preservation of naturalness is maintained.
  • Experiments show that a countermeasure (augmenting training data with period prose) fails to close the vulnerability.
  • The findings indicate persistent vulnerabilities under structural out-of-distribution shifts in tested detector families.

Key Concepts Mentioned

  • Language model evasion attacks
  • Adversarial fine-tuning
  • ELOQUENT 2026 Voight-Kampff
  • Out-of-distribution shifts
  • Cross-decade register attacks
  • Modernist stream-of-consciousness form

Claims Made by the Document

  • Pushing generated text out of the detector's training distribution defeats adversarial detection.
  • Pulling generated text into the detector's training distribution fails completely to defeat adversarial detection.
  • Two novel attack families bypass adversarial closure and achieve higher fool rates than previous methods.
  • The countermeasure of augmenting training data with period prose fails to close the vulnerability.

Evidence Used

  • The authors' experiments demonstrate the effectiveness of their strategies on ELOQUENT 2026 Voight-Kampff leaderboard.

Methods / Approach

UNKNOWN

Limitations Stated by the Authors

UNKNOWN

Limitations Noted by the Agent

Agent interpretation — not from the source.

UNKNOWN

Open Questions

UNKNOWN

Notes for Future Q&A

May include interpretation. Labeled where it does.

UNKNOWN

Raw Abstract / Excerpt

We investigate which language model evasion attacks survive state-of-the-art adversarial fine-tuning, developing strategies that sweep the top 5 positions on the ELOQUENT 2026 Voight-Kampff leaderboard. While adversarial fine-tuning trivially closes the 2025 winning evasion recipes, we uncover a fundamental asymmetry in detector vulnerability: pushing generated text out of the detector's training distribution reliably defeats adversarial detection, whereas pulling it into the distribution (e.g., mimicking human training data) fails completely. Exploiting this, we introduce two novel out-of-distribution attack families - cross-decade register attacks and modernist stream-of-consciousness form. Both strategies easily bypass adversarial closure, achieving up to approximately 50x higher fool rates than previous methods while preserving naturalness. Furthermore, experiments show that the obvious deployer countermeasure (augmenting training data with period prose) fails to close the vulnerability. Our findings show that the tested detector families, including adversarially fine-tuned ones, exhibit persistent vulnerabilities under structural out-of-distribution shifts, a mechanism that directly powers our leading competition performance.