RepreGuard: Hidden-State Detector for LLM Text

• RepreGuard is a representation-based detector that analyzes hidden activations from surrogate models to differentiate LLM-generated text from human-written content.
• It computes a RepreScore by projecting selected token activations onto learned directions that capture the distinct signature between machine and human text.
• Validated across in-distribution and out-of-distribution settings, it achieves high AUROC and TPR with robust performance over varied text lengths and generator models.

RepreGuard is a representation-based detector for LLM-generated text (LGT) that treats hidden states from a surrogate LLM as the primary detection signal rather than relying only on surface statistics such as perplexity, rank, or perturbation sensitivity. It is designed for the binary discrimination of LGT versus human-written text (HWT), with particular emphasis on out-of-distribution (OOD) robustness across generator models, domains, text lengths, paraphrases, perturbations, and decoding strategies. Operationally, the method extracts hidden activations from a surrogate model, estimates per-layer directions that capture the systematic difference between LGT and HWT, computes a scalar “RepreScore” by projection onto those directions, and classifies text by thresholding that score. The reported average performance across in-distribution (ID) and OOD settings is 94.92% AUROC, with strong low-FPR behavior measured by 82.44% [email protected] (Chen et al., 18 Aug 2025).

1. Problem formulation and conceptual basis

RepreGuard addresses the task of authorship detection for machine-generated text: given a text sequence, determine whether it was written by a human or generated by an LLM. The paper motivates this task through concerns about fake news, academic dishonesty, hallucinated or biased content, and the broader requirement for trustworthy AI systems. It positions prior detectors in two main families. Fine-tuning-based classifiers, such as RoBERTa-based detectors, are often strong in-distribution but require large labeled datasets, are expensive to update, and frequently overfit to the generators or domains seen during training. Statistics-based detectors, such as likelihood-, rank-, perturbation-, and cross-perplexity-based methods, are more interpretable and easier to recalibrate, but are brittle under prompt changes, decoding changes, generator transfer, and domain shift (Chen et al., 18 Aug 2025).

The central hypothesis of RepreGuard is that internal hidden representations encode a richer and more fundamental signal than output-level observables. The paper states that LLMs exhibit distinct hidden representation patterns when processing LGT compared to HWT, owing to differences in how models internally perceive the statistical structure of these texts. This shifts the detection problem from surface behavior to representation space. RepreGuard therefore uses a surrogate LLM as an observer: it need not be the generating model, but it must expose hidden states. A new text is passed through that surrogate, and the resulting activations are scored against a small set of precomputed representation directions derived from paired LGT/HWT data.

In methodological terms, the detector is best understood as a thresholded linear projection test in hidden-state space. It is not a generator watermark, not a fine-tuned end-task classifier, and not a perturbation-heavy zero-shot detector. Its claimed advantage is that a low-dimensional hidden-state statistic transfers more reliably across generators and domains than conventional output-based scores.

2. Empirical evidence from hidden activations

Before defining the detector, the paper empirically examines whether HWT and LGT actually induce different internal computations. Using Llama-3.1-8B as the observing model and 1000 pairs of LGT and HWT drawn from texts generated by four different LLMs, it reports that the two text types have largely similar hidden representations in the early part of the sequence, approximately tokens 0–20, but diverge substantially after about 20 tokens. LGT also shows a consistently higher overall activation level than HWT. Across layers, lower layers, roughly 1–11, remain more similar, while higher layers, roughly 11–32, show more pronounced differences (Chen et al., 18 Aug 2025).

This activation analysis is complemented by score-distribution evidence. When the method is trained on multi-LLM data, the resulting RepreScore distributions separate HWT and LGT across four generator families: HWT scores are mainly in the range $(-2, 2)$, while LGT scores are consistently in the range $(0, 8)$. The paper interprets this as evidence that the hidden-space distinction is not generator-specific in a narrow sense. A plausible implication is that the detector is exploiting a representation-level regularity shared by multiple modern LLMs rather than a single model artifact.

The paper also reports that not all token positions contribute equally. RepreGuard uses an activation token ratio that selects tokens from the end of the sequence toward the beginning, and performance peaks near a ratio of 0.1, remains stable until about 0.6, and then drops sharply. This aligns with the observation that later tokens reflect more complete contextual processing and therefore carry stronger discriminative signal.

3. Detection method and mathematical structure

RepreGuard assumes a small paired training set

$$\{(\mathcal{T}^i_{\text{LGT}}, \mathcal{T}^i_{\text{HWT}})\mid i\in[1,N]\},$$

where each pair contains one LLM-generated text and one human-written text. A surrogate model with $\mathcal{L}$ layers processes a token sequence $\mathcal{T}=\{t_1,\dots,t_n\}$, producing a hidden state

$h_j^l \in \mathbb{R}^d$

for token $t_j$ at layer $l$. The full activation set is

$$\mathcal{A}(\mathcal{T})=\{h_j^l \mid j \in [1, n], l \in [1, \mathcal{L}]\}.$$

For each paired sample, the method computes a hidden-state difference

$$\Delta \mathcal{A}_i = \mathcal{A}(\mathcal{T}^i_{\text{LGT}}) - \mathcal{A}(\mathcal{T}^i_{\text{HWT}}).$$

Per layer, the difference set is denoted

$(0, 8)$0

PCA is then applied layerwise: $(0, 8)$1 The resulting $(0, 8)$2 is the per-layer “probing vector” or distinct activation feature that captures the dominant direction of LGT–HWT difference at that layer (Chen et al., 18 Aug 2025).

At inference, a token-level score is computed by projecting the token’s hidden states across layers onto those directions: $(0, 8)$3 The text-level score is the average over tokens: $(0, 8)$4 In practice, this averaging is applied to the selected suffix tokens rather than uniformly over the entire sequence. Classification uses a threshold chosen on training data: $(0, 8)$5 with final decision

$(0, 8)$6

The method therefore has two phases: a lightweight calibration stage that estimates $(0, 8)$7 and $(0, 8)$8, and a one-forward-pass inference stage that computes a scalar score. It does not use a CLS token, and it does not require iterative perturbation or direct access to the target generator.

4. Experimental protocol and quantitative results

The main benchmark is DetectRL, comprising four domains: ArXiv Archive, XSum, Writing Prompts, and Yelp Review. Each domain contains 2,800 pairs of LGT and HWT. The LGT portion is produced by four source models: ChatGPT, Claude-instant, Google-PaLM, and Llama-2-70B. The experiments use 5 rounds of bootstrapping, each with 512 pairs for training and 1,000 pairs for testing. The paper distinguishes strict ID evaluation, where train and test use the same generator distribution, from strict OOD evaluation, where training occurs on one generator and testing on a different unseen generator. Thresholds are calibrated on training data only (Chen et al., 18 Aug 2025).

Evaluation setting	AUROC	[email protected]
ID average	96.34%	83.74%
OOD average	93.49%	81.13%
Overall ID+OOD average	94.92%	82.44%
OOD across domains	91.60%	85.63%

These averages mask some especially strong individual settings. When trained and tested on ChatGPT data, RepreGuard reaches 99.84 AUROC and 100.00 [email protected]. In a hard OOD transfer setting, training on Google-PaLM and testing on Claude-instant yields 90.57 AUROC and 56.90 [email protected], substantially above the cited baselines in the same configuration. Training on a combined Multi-LLMs dataset gives 95.55 AUROC and 82.43 [email protected] averaged across test generators.

The paper compares RepreGuard against RoBERTa-based detection, LRR, DetectGPT, Fast-DetectGPT, Straight-forward Detector, and Binoculars. It reports that RepreGuard exceeds the RoBERTa-based classifier by 11.05% AUROC on average and Binoculars by 5.88% AUROC on average. The difference is especially marked at very low false-positive operating points, where Binoculars often retains respectable AUROC but collapses in [email protected] under harder OOD settings.

5. Robustness, surrogate-model choice, and implementation profile

A major claim of RepreGuard is robustness beyond standard ID testing. Under varied text sizes, performance improves with longer texts: at 64 tokens the method attains 84.22% AUROC and 57.74% [email protected], while at 256 tokens it reaches 92.94% AUROC and 81.70% [email protected]. This is consistent with the earlier activation analysis, since later tokens appear more discriminative (Chen et al., 18 Aug 2025).

Under perturbation attack, RepreGuard is reported at 89.65% AUROC and 88.63% [email protected], whereas Binoculars, the second-best detector in that comparison, has 69.45% AUROC and 58.54% [email protected]. On RAID, which varies model groups and decoding strategies, RepreGuard averages 92.05 AUROC and 77.53 [email protected], outperforming Binoculars by 6.42% AUROC and 23.77% [email protected] on average. The paper highlights that repetition penalty, which disrupts many likelihood-based detectors, degrades RepreGuard less severely.

The method also performs strongly in low-shot settings. With only 16 training pairs, averaged across training datasets, it achieves 90.21% AUROC and 77.36% [email protected]. This exceeds Binoculars by 6.61% AUROC and 4.76% [email protected] in that setting. The authors use this to argue that RepreGuard combines the small calibration requirement of statistics-based detectors with discrimination levels closer to learned classifiers.

Surrogate choice matters, but the method is not tied to a single backbone. The best reported surrogate is Llama-3.1-8B with 94.74 AUROC and 80.92 [email protected]. Other strong surrogates include Phi-2 at 94.14 AUROC, Gemma-2B-Instruct at 92.75 AUROC, and Llama-2-7B at 93.37 AUROC. GPT-Neo-2.7B is effectively random at 49.73 AUROC. The paper concludes that 7B+ models often work well, though smaller models can also suffice if their representations are strong enough.

The computational profile remains moderate relative to perturbation-heavy methods. On an A100 80GB, batch size 1, float32, RepreGuard with Phi-2 uses 16.0 GB and 0.072 s/sample, while RepreGuard with Llama-3.1-8B uses 38.0 GB and 0.359 s/sample. For comparison, Binoculars uses 58.0 GB and 0.653 s/sample, and Fast-DetectGPT uses 40.0 GB and 0.390 s/sample. The paper also provides code and data at https://github.com/NLP2CT/RepreGuard.

6. Position in the literature, limitations, and interpretive significance

RepreGuard occupies a distinct position among neighboring methods because it is a representation-based detector for machine authorship rather than a moderation system for harmful prompts or unsafe generations. In nearby work, ReGA also uses hidden-state directions, but it abstracts them into a DTMC to detect harmful prompts and conversations rather than human-versus-machine authorship (Wei et al., 2 Jun 2025). HiddenGuard likewise operates on intermediate representations, but uses them for in-stream token-level moderation and selective redaction during generation (Mei et al., 2024). By contrast, $(0, 8)$9-Guard couples category-specific guardrail predictors to probabilistic reasoning over safety taxonomies, making it a neuro-symbolic unsafe-content detector rather than an authorship detector (Kang et al., 2024).

Relative to watermarking, RepreGuard does not require the generator to embed any watermark and can therefore be applied to arbitrary existing text. Relative to log-likelihood, rank, or cross-perplexity methods, it depends on hidden-state access to a surrogate model but is more robust under generator and domain shift. Relative to supervised classifiers, it uses far less labeled data and remains threshold-based rather than fully retrained. Relative to perturbation-based methods, it is substantially cheaper at inference because it needs only one forward pass through the surrogate model plus dot products with precomputed vectors (Chen et al., 18 Aug 2025).

The method nevertheless has clear limitations. It requires white-box access to some surrogate model, even though it does not require access to the target generator. The mathematical specification leaves some implementation details underspecified, including preprocessing and normalization before PCA and the precise handling of token-layer alignment. Performance remains imperfect on very short texts and hard OOD transfers. The paper also reports that increased pretraining exposure of surrogate models to LGT weakens the low-FPR detection signal: AUROC drops only slightly from 94.76% to 94.68%, but [email protected] falls from 80.92% to 73.72%. This suggests that as future models are trained on increasingly synthetic corpora, the hidden distinction between HWT and LGT may narrow. The authors further note that if a model reproduces memorized human text from training data, such text can become fundamentally difficult to distinguish from genuine HWT.

Taken as a whole, RepreGuard is significant less because it introduces a complex architecture than because it reframes LLM-generated-text detection around internal representation geometry. Its core claim is that later-token, higher-layer hidden activations preserve a more stable authorship signature than output statistics do. The empirical results reported in the paper support that claim across generator transfer, domain shift, adversarial perturbation, low-shot calibration, and decoding variation, making RepreGuard a prominent representation-centric reference point within the broader detection literature.