Humanization by Iterative Paraphrasing (HIP)

• HIP is a process that recursively paraphrases AI-generated text to eliminate machine-specific markers and closely emulate human authorship.
• It leverages multiple techniques, including style alternation and adversarial token guidance, to systematically reduce AI detection signals.
• Empirical evaluations show HIP can significantly lower classifier detection rates while maintaining semantic integrity of the original content.

Humanization by Iterative Paraphrasing (HIP) designates a suite of methodologies for systematically transforming AI-generated text, particularly outputs from LLMs, so that their stylistic and distributional properties increasingly resemble those of genuinely human-authored text. HIP is driven by iterative re-expression of content through repeated paraphrasing and summarization, with the explicit goal of eroding detection-sensitive artifacts at the surface level while preserving semantic content and factual structure. This process has emerged as a central tactic in both adversarial evasion (bypassing AI-text detectors) and in probing the deep representations underlying authorship attribution—testing whether detectors rely on surface stylometry or deeper idea-level invariants (Shahriar et al., 4 Dec 2025, Cheng et al., 8 Jun 2025, Xu et al., 19 May 2026).

1. Definitions and Underlying Motivation

HIP is defined as the process by which an LLM-generated (or otherwise non-human) text is recursively paraphrased—across varied styles and compressions—so as to minimize machine-identifiable "signatures" and maximize resemblance to human textual norms. The principal motivation stems from the observation that classifiers used to differentiate LLM and human content rely heavily on stylistic cues: domain-specific lexical choices, syntactic complexity, academic register, and higher-order coherence patterns. By intentionally shifting these forms, HIP seeks to answer two fundamental questions: (1) Can surface-level artifacts be eliminated to the point of rendering the source origin undetectable even with strong classifiers? (2) Does the core "idea" or information invariant persist as a detectable fingerprint after full humanization (Shahriar et al., 4 Dec 2025, Xu et al., 19 May 2026)?

2. Canonical HIP Pipelines and Algorithmic Variants

Recent literature describes several instantiations of HIP. In attribution-focused studies, pipelines generally follow a multi-stage design (Shahriar et al., 4 Dec 2025, Xu et al., 19 May 2026):

• Multi-Stage Paraphrasing and Summarization:
  • Start with either synthetic (LLM) or human-annotated ideas. Each input is paraphrased/summarized into a distinct style (e.g., general, simplified non-expert, technical, brief).
  • The process iterates several times (5–10 rounds typical), with each paraphrase feeding into the next stage, cycling paraphrasing strategies to avoid degenerate over-compression.
  • To increase robustness, state-of-the-art LLMs such as GPT-4o, Claude-3-Opus, O3-mini, and others are used at each paraphrasing step (Shahriar et al., 4 Dec 2025).
• Paraphraser Fine-Tuning (Detector-Agnostic):
  • In evasion-oriented HIP (editor’s term, covering (Xu et al., 19 May 2026)), base LLMs (prior to instruction tuning) are fine-tuned as paraphrasers using a curated dataset of paraphrase–original pairs filtered via semantic and anomaly checks.
  • Once trained, the paraphraser rewrites input text iteratively (e.g., 10 rounds), each time moving further from initial artifacts and closer to the human manifold, as measured by detector-assigned probabilities (Xu et al., 19 May 2026).
• Adversarial Paraphrasing (Detector-Guided):
  • Here, HIP is operationalized at the token level: a paraphraser LLM generates candidates for each next token, and a separate AI-text detector provides feedback, steering generation toward tokens that minimize the detector’s “AI-ness” score (Cheng et al., 8 Jun 2025).
  • The process is inherently gradient- and training-free, maximizing human-likeness in a search-theoretic framework.

The following table summarizes canonical HIP pipeline choices:

HIP Instantiation	Paraphrasing Strategy	Guidance Signal
Attribution via staged paraphrasing	Alternating style, rotation	None (style only)
Detector-agnostic iterative rewriting	Minimal finetune, multi-pass	None (repetition only)
Detector-guided adversarial rewriting	Token-by-token, min-AI score	Detector feedback

3. Methodological Details and Mathematical Formulations

Formal algorithmic elements are essential for both practical deployments and comparative evaluations:

• Pipeline Pseudocode (attribution HIP (Shahriar et al., 4 Dec 2025)):

  for each idea r₀ in ideas_H∪ideas_L: r₁ ← Summarize(r₀, RP) strategies ← [general, simplified, brief, technical] for stage = 2 to 5: choose s ∈ strategies not used in previous stage r_stage ← Paraphrase(r_{stage−1}, RP, style=s) store [r₀…r₅] with original label

• Adversarial objective (detector-guided (Cheng et al., 8 Jun 2025)):

$$c_t^* = \arg\min_{c\in\mathcal{C}_t}\;\mathcal{D}(y_{<t}\oplus c)$$

where $c$ is a candidate token, $\mathcal{D}$ is the fixed detector, and $y_{<t}$ is the output prefix so far.

• Detector Score and Trade-Off Metric (evasion HIP (Xu et al., 19 May 2026)):

$$(S_t, H_t) = (M(x^{(t)}, x^{(0)}),\; s_\text{det}(x^{(t)}))$$

where $M(\cdot)$ is semantic similarity and $s_\text{det}(\cdot)$ is detector-assigned human-probability.

The iterative refinement paradigm is further generalized in models such as ReDecode, in which a latent-variable paraphraser model with multiple decoders incrementally polishes outputs, optionally with style-specific priors and classifier-guided loss components (Aggarwal et al., 2018).

4. Empirical Evaluation and Quantitative Findings

HIP efficacy is typically evaluated along two axes: (1) loss of detectability (as measured by classifier accuracy or human-probability) and (2) semantic retention or fidelity to original content.

• In scientific idea attribution, five-stage humanization reduced state-of-the-art classifier macro-F1 from 92.3% to 63.2% (Δ_drop = 29.1 for BigBird; mean drop 25.4% across models) (Shahriar et al., 4 Dec 2025). Detection improvement via problem-context inclusion was marginal (+2.97%).
• In detector-agnostic HIP, iterative paraphrasing increased detector-assigned human-probability from near 0% to 100% over 10 rounds, with semantic scores declining from 10 to between 6–8 (human-evaluated on a 0–10 scale) (Xu et al., 19 May 2026). Across Qwen-3 and Llama-3 base models, HIP yielded Pareto-dominant trade-offs compared to zero-shot, DIPPER, SilverSpeak, and StealthRL baselines.
• Adversarial paraphrasing reduces T@1%F (true positive rate at 1% false positive) for Fast-DetectGPT by 98.96% and for RADAR by 64.49%, outperforming simple or recursive paraphrasing (Cheng et al., 8 Jun 2025).

The following table presents classifier performance drops in a multi-stage pipeline (Shahriar et al., 4 Dec 2025):

Stage	BigBird (RP+idea) Macro-F1 (%)
S1	92.3
S2	83.4
S3	70.9
S4	65.1
S5	63.2

5. Stylometric Mechanisms and the Role of Simplification

A central empirical finding is that paraphrasing into simplified, non-expert style is the single most effective driver of detector evasion. In (Shahriar et al., 4 Dec 2025), simplified paraphrasing underperforms stage-average detection by 2.98% (p=0.03). This modality systematically replaces complex, domain-specific lexicon with general vocabulary, strips syntactic and structural markers, and collapses class-distinguishing Fisher Discriminant Ratio (FDR) and Word Mover’s Distance (WMD) between human and AI outputs. As a result, distributional embeddings of human and LLM texts become indistinguishable. This convergence explains the consistent performance degradation of neural attribution and watermarking schemes in the simplified paraphrasing regime (Shahriar et al., 4 Dec 2025, Cheng et al., 8 Jun 2025, Xu et al., 19 May 2026).

This suggests that stylometric detection is fundamentally brittle under targeted style manipulation and that content-level features alone are insufficient for source attribution once surface artifacts are erased.

6. Practical Implementations, Hyperparameters, and Evaluation Protocols

HIP pipelines are characterized by specific design choices regarding base model selection, fine-tuning, datasets, and detector targeting.

• Base Models: Preference for pre-instruction-tuned checkpoints (e.g., Qwen-3, Llama-3 base) due to their intrinsically higher human-likeness on commercial detectors (GPTZero, Pangram) (Xu et al., 19 May 2026).
• Fine-Tuning: Minimal epochs (usually one) with LoRA parameter-efficient updates; training datasets comprise strictly curated paraphrase–original pairs (e.g., 11,757 for (Xu et al., 19 May 2026)) with semantic and anomaly filtering.
• Paraphrasing Iterations: N=5 for scientific idea attribution; N=10 for evasion-centric HIP (Shahriar et al., 4 Dec 2025, Xu et al., 19 May 2026).
• Metrics: Classifier macro-F1, T@1%F, ROC-AUC, perplexity, GPT-4o Likert quality ratings, meaning preservation (human/GPT-based on 0-10 scale), and distributional similarity (FDR, WMD).
• Compute: 4–8 L40S GPUs, batch 16, sequence length 2048, AdamW optimizer, lr=5e-5, cosine schedule, LoRA rank=128, α=128, dropout=0.05 (Xu et al., 19 May 2026).

Commercial detectors remain susceptible to HIP-rewritten content, indicating that their discrimination functions largely track artifacts of instruction tuning and local context.

7. Implications, Limitations, and Directions for Robust Detection

HIP exposes fundamental limitations in surface-form-based authorship detection. Despite sophisticated classifiers, iterative paraphrasing depletes stylistic signal, elevating classifier error rates to near chance under strong adversarial or simplification regimes. Detectors that incorporate external context (e.g., research problem concatenation), model idea–context relationships, or leverage multi-modal/provenance cues show only modest gains and residual vulnerability (Shahriar et al., 4 Dec 2025, Xu et al., 19 May 2026). The inability of current detectors to robustly attribute source after HIP suggests a need for a paradigm shift toward provenance, trace logging, and knowledge-augmented or reasoning-aware classification strategies, as well as explicit modeling of instruction-tuning artifacts. A plausible implication is that future detection systems must integrate deeper models of idea structure and generation process, potentially requiring access to non-textual metadata or procedural context (Shahriar et al., 4 Dec 2025, Xu et al., 19 May 2026).

• "The Erosion of LLM Signatures: Can We Still Distinguish Human and LLM-Generated Scientific Ideas After Iterative Paraphrasing?" (Shahriar et al., 4 Dec 2025)
• "Adversarial Paraphrasing: A Universal Attack for Humanizing AI-Generated Text" (Cheng et al., 8 Jun 2025)
• "Base Models Look Human To AI Detectors" (Xu et al., 19 May 2026)
• "ReDecode Framework for Iterative Improvement in Paraphrase Generation" (Aggarwal et al., 2018)