The Flip Rate: Why Detector Accuracy Hides the Collapse

What your detector’s accuracy number will not tell you

One symbol substitution flips 93.73% of a detector’s per-document verdicts (95% CI 93.4–94.0) — while its aggregate accuracy merely “falls.” Measured on 480,000 generations from the RAID benchmark with two open detectors calibrated to a pooled 5% false-positive rate, the paired flip rate shows what pooled accuracy conceals: not how far the average moved, but how many individual documents changed their answer.

The flip rate is the fraction of documents whose detection verdict changes when that same document passes through a specific transformation—one transformation, applied to the exact same document, measured per-document. A detector can hold a respectable aggregate accuracy and still flip nearly every document it sees: the aggregate hides the per-document chaos.

That is the whole idea. Now the receipts.

The lie of aggregate accuracy

On clean, unmodified prose, the shallow detector in our study (a GPT-2-based perplexity scorer) labels 63.4% of machine-generated documents as machine. A mediocre-but-usable number. A vendor-edited headline, even.

We then applied one attack—homoglyph substitution, where visually identical characters replace Latin ones—and re-scored every document individually. Aggregate accuracy fell to 4.17%. But through the pairing we run, we can say more: 93.73% of documents individually flipped their verdict (CI 93.4–94.0). Not “the accuracy moved.” Nine documents in ten changed their answer.

Figure 1. Flip-rate anatomy: the same document, scored before and after one character-class substitution. A flip means the verdict changed on that same document—something pooled accuracy cannot show.

Aggregate deltas hide this. If some documents flip from machine to human and others flip back, the accuracy delta can stay deceptively small while the per-document verdict is a coin toss. Measuring per-document flips is the only way to see what is actually happening to individual documents—which is what the people checking your prose actually care about.

How we pair documents

The dataset groups generations by a source_id and hands us a field, adv_source_id, that points to the clean sibling of each attacked row. Our first pass accidentally collapsed eight model-decoding variants into one per source—yielding an inflated “99.96% flip.” The fix: pair attacked rows to their exact clean siblings per row, not per source. The corrected number is the one above, 93.73%. That difference—false 99.96% versus true 93.73%—is what sloppy methodology looks like, and we publish both the bug and the fix because that is what reproducibility means.

Confidence intervals done right

A row-IID bootstrap treats all 480,000 generations as independent draws—but the 96 rows per source share a prompt, a generator, and a decoding family. Standard IID intervals are anti-conservative: they report false precision. We cluster the bootstrap at the source level (500 resamples, seed 42), which is the statistically defensible way to say “±0.15 points” rather than pretend you know the third decimal.

Two detector families, two different kinds of fragile

The robustified Transformer detector (RADAR) holds up better under attack but still collapses: after the same homoglyph attack, its flip rate is 78.69% (CI 77.3–80.1), versus 93.73% for the shallow scorer. Robustification helps. It does not immunize.

Here are both, ranked worst-to-best for the shallow detector:

Attack	Shallow detector flip rate	Robustified detector flip rate
homoglyph	93.73% (CI 93.4–94.0)	78.69% (CI 77.3–80.1)
upper/lower casing	83.67% (CI 83.3–84.1)	5.70% (CI 5.0–6.4)
article deletion	52.12% (CI 51.4–52.8)	8.94% (CI 8.0–9.8)
whitespace	23.05% (CI 22.5–23.6)	14.64% (CI 13.6–15.7)
paraphrase	16.85% (CI 16.3–17.4)	33.80% (CI 32.1–35.6)
alternative spelling	8.26% (CI 7.9–8.6)	0.72% (CI 0.5–0.9)
number substitution	5.67% (CI 5.3–6.1)	1.52% (CI 1.2–1.9)
insert paragraphs	5.54% (CI 5.3–5.8)	2.88% (CI 2.4–3.4)
synonym	4.72% (CI 4.4–5.0)	10.14% (CI 9.3–11.1)
zero width space	0.03% (CI 0.01–0.05)	1.15% (CI 0.9–1.4)

Table 1. Paired per-document flip rates; lower is more robust. The shallow scorer flips the most under orthographic attacks; the robustified detector resists most attacks but still falls to paraphrase at one document in three.

Notice the odd one out: zero_width_space barely flips anything—and it actually raises aggregate accuracy (+36.5 points for the shallow detector, +25.9 for the robust one). The paper we extend left that attack out of its headline table. Weird, citable, and a warning: without per-document pairing, “the accuracy went up” sits next to “we destroyed the textual signal” with no way to tell which happened.

Honest limits

The sample we work with contains human-written rows only in clean form. There is no attacked-human cut, so false-positive flips are not available; everything above describes machine-generated rows. Two detectors we attempted—Binoculars and GLTR—are excluded from these numbers (the first for runtime infeasibility, the second for marginal value); the partial scores are preserved and the exclusions are stated, not dropped.

Three questions to ask about any vendor accuracy claim

1. Is the metric paired per document, or pooled across rows? Pooled aggregates conceal per-document verdict chaos.
2. Are confidence intervals clustered at the document source? IID intervals fabricate precision.
3. Is the decision threshold declared at a fixed false-positive rate? Without a declared threshold, “accuracy” is a dial, not a measurement.

If a vendor cannot answer all three, the number is marketing, not measurement. The alternative to shopping for a less-bad detector is needing no detector at all—which is the case for provenance.

Frequently asked questions

What is a flip rate in AI detection? The flip rate is the fraction of documents whose machine/human verdict changes when a specified transformation is applied to that same document, measured per-document rather than in aggregate.

Is 90% detector accuracy good? It depends on the pairing and the threshold. A detector showing “90%” on clean prose can still flip 93.7% of those verdicts under a simple symbol substitution—which is why pairing and a declared threshold matter more than any headline percentage.

Why does document pairing matter? Because accuracy deltas averaged across all rows can stay small while individual verdicts flip back and forth. Pairing attacked documents to their exact clean siblings is what prevents that concealment.

Can paraphrasing make detectors more accurate? Yes, for some detector families. In our data, a shallow perplexity scorer gained 5.4 points of aggregate accuracy on paraphrased text, while a robustified Transformer lost 17 points—the families break in opposite directions (full treatment in our paraphraser article).

---

Method note. Numbers above come from our reanalysis of the RAID dataset (Dugan et al., ACL 2024, arXiv:2405.07940; code) on a 5,000-source sample (480,000 generations; ChatGPT, GPT-4, Llama-chat, Mistral; two decodings; repetition_penalty == “no”), with thresholds calibrated at a pooled 5% false-positive rate. The flip rate pairs each attacked row to its clean sibling per row via the dataset’s adv_source_id field. Confidence intervals come from a source-cluster bootstrap (500 resamples, seed 42). Two candidate detectors (Binoculars, GLTR) were excluded for the disclosed reasons above; their partial scores are preserved. Validation against the paper’s Table 6 showed direction-of-effect agreement on every detector/attack pair; scope deviations from the paper are confined to the model set (four of eleven families) and decoding (no-penalty rows only). Full data and methods: the RAID reanalysis data page.