spb/wpai0002_uqo

1% ============================================================================2% Related work3% ============================================================================4\section{Related Work}5\label{sec:related}67Five literatures bear on the problem: measurements of how LLMs change scientific prose, AI-text detection and its8failure under rewriting, paraphrase inversion and other inversion attacks, style transfer and stylometry, and the9theory of identifiability and disentanglement. A sixth, on synthetic data, memorisation and corpus provenance,10shapes the evaluation and governance design. Claims about the cited papers' findings are taken from their verified11abstracts; full-text details we have not checked are not asserted.1213\subsection{How LLM rewriting changes scientific prose}1415\paragraph{Prevalence.} Distributional estimators applied to large scientific corpora show a steady increase in16LLM-modified content after late 2022, with the fastest growth in computer science17\citep{liang2025quantifying}; the same framework applied to peer reviews finds a comparable effect18\citep{liang2024monitoring}. Excess-vocabulary analysis of more than 15 million PubMed abstracts yields a lower19bound of 13.5\% of 2024 abstracts processed with LLMs, reaching 40\% in some subcorpora \citep{kobak2025delving}.20\citet{geng2024chatgpt} model word frequencies in about one million arXiv abstracts against GPT-3.5's response to21``revise the following sentences'' and estimate that about 35\% of computer-science abstracts show LLM style.22Keyword counts give a conservative estimate of at least 60\,000 LLM-assisted papers in 202323\citep{gray2024chatgpt}.2425\paragraph{The signature.} The change is lexical, grammatical and rhetorical. Specific focal words (\emph{delve},26\emph{intricate}, \emph{underscore}) are over-represented, and their origin is unresolved, with preference tuning a27plausible contributor \citep{juzek2024delve}. Authors appear to adapt: \emph{delve} fell after it was publicised28while \emph{significant} kept rising \citep{geng2025humanllm}. Biber-feature analyses find systematic human--LLM29differences that are larger for instruction-tuned than for base models \citep{reinhart2025llms}, with comparable30contrasts in news text \citep{munozortiz2023contrasting}. Across 823\,798 arXiv abstracts, lexical complexity rises31while syntactic complexity falls \citep{bao2025examining}; in recent machine-learning venues, formulaic phrases32rose by up to an order of magnitude and hedging declined \citep{jang2026scizoom}. Human reviewers and detectors33also struggle to distinguish generated from real scientific abstracts \citep{gao2023comparing}.3435\paragraph{Homogenisation and the era confound.} Co-writing with an instruction-tuned model reduces lexical and36content diversity across authors \citep{padmakumar2023writing}, but a 44-year analysis of CHI papers finds that37LLMs accelerated a word-level shift that had already begun rather than homogenising prose \citep{kosch2026chi}.38Scientific writing was changing before LLMs: the readability of scientific texts has been decreasing over time \citep{plavensigray2017readability},39academic prose became more informal \citep{hyland2016informal}, and stance marking evolved \citep{hyland2016stance}.40Comparing pre-2018 human text with post-2022 human text therefore confounds LLM influence with secular drift. Our41design removes this confound by holding the original fixed and generating the LLM side under control.4243\paragraph{What is missing.} Nearly all of this evidence is observational and aggregate: word frequencies, shares,44feature means. We found no study that measures, for the \emph{same} passage, which features an LLM rewrite changes45and by how much, conditionally on discipline, section role and rewrite instruction. RQ146(Section~\ref{sec:rq}) addresses this with paired, per-passage measurements.4748\subsection{Detection, paraphrase attacks and revised text}4950Zero-shot detectors based on likelihood curvature \citep{mitchell2023detectgpt,bao2023fastdetectgpt} or51cross-perplexity \citep{hans2024binoculars}, and watermarking \citep{kirchenbauer2023watermark}, are the main52technical responses to generated text. Their limits are well documented. Paraphrasing with DIPPER reduced53DetectGPT's detection accuracy from 70.3\% to 4.6\% at a 1\% false-positive rate \citep{krishna2023paraphrasing};54recursive paraphrasing evades watermarking, neural and retrieval detectors \citep{sadasivan2023reliably}; detectors55are biased against non-native writers \citep{liang2023detectors}; and robustness collapses across generators and56attacks on shared benchmarks \citep{dugan2024raid}, including systematic ``humanising'' attacks57\citep{zheng2025thbench}.5859The regime closest to ours is human text \emph{revised} by an LLM. AI-polished human text is frequently flagged as60AI-generated even after minimal edits, and detectors cannot separate degrees of AI involvement61\citep{saha2025polished}. Machine-revised text (rewriting, expansion, polishing) defeats standard detectors, and62aligning a detector to the reviser's style preferences recovers part of the gap \citep{chen2024imitate}. Expert63edits over machine outputs evade detection, while LLM-edited texts are rarely judged human64\citep{artemova2024beemo}. These works measure \emph{detectability}; none attempts to undo the revision or to65measure what of the original survives it.6667\subsection{Paraphrase inversion and other inversions}6869The direct antecedent is \citet{riverasoto2024paraphrase}, who frame paraphrase inversion as translation from a70paraphrase back to its source, trained on synthetic (original, paraphrase) pairs. They report that GPT-4 and71Llama-3 paraphrase with learnable biases, that inversion models generalise to paraphrasers unseen during training,72and that combining inversion with detectors improves AUROC by an average of 22\% across seven detectors and three73domains. \citet{riverasoto2026unsupervised} train a style encoder to reconstruct human-authored text from its74machine paraphrase while a semantic encoder is frozen; the frozen channel pushes style information into a separate75representation, which transfers to AI-text detection and authorship verification. Our M3 model76(Section~\ref{sec:models}) shares this content/style decomposition.7778The difference is the object of evaluation. In both papers reconstruction is a pretext task: the reported metrics79are detection and verification scores. As far as we could verify from the abstracts, neither evaluates the80reconstruction itself against identity and copy baselines, audits factual drift in numbers, citations, equations,81negation or hedging, matches stylometric distributions, controls for memorisation of training originals, or82stratifies by discipline and era (the last point remains to be checked against the full texts). We take their83generalisation result as a hypothesis to replicate on scientific text (H5 in Section~\ref{sec:rq}).8485Inversion of non-textual channels shows that lossy representations retain more recoverable information than86expected: text can be reconstructed almost exactly from sentence embeddings \citep{morris2023embeddings}, and87prompts can be recovered from next-token distributions \citep{morris2023lminversion}. These results support the88prior, tested in RQ2, that some pre-rewrite signal survives an LLM rewrite.8990\subsection{Style transfer, authorship and stylometry}9192Authorship obfuscation and LLM-based restyling are the forward direction of our problem \citep{fisher2024styleremix}.93They rely on style representations separated from topic \citep{riverasoto2021luar,wegmann2022same} and on the94classical stylometric tradition of function-word and feature-based attribution95\citep{burrows2002delta,stamatatos2008survey,koppel2008computational,juola2008authorship}. Style-transfer research96supplies the paraphrase-then-restyle formulation that inversion reverses \citep{krishna2020reformulating}, models97of disentangled and few-shot restyling \citep{shen2017style,fu2017style,john2018disentangled,riley2020textsettr},98low-resource \emph{authorship} style transfer, which is the closest analogue to ``restore this author's voice''99\citep{patel2022lowresource}, parallel formality data \citep{rao2018gyafc}, and evaluation practice that measures100style, content preservation and fluency separately \citep{mir2019evaluating,jin2020survey}. Two differences matter101for us. Style transfer targets a corpus-level style, whereas our target is a specific original passage. And102attribution methods are used here only as exploratory diagnostics of feature distributions, never as evidence of103who wrote a text.104105\subsection{Identifiability and disentanglement}106107Inverting a many-to-one map is ill-posed, and theory bounds what can be recovered. Unsupervised disentanglement is108impossible without inductive biases on both model and data \citep{locatello2018challenging}, and nonlinear ICA is109non-identifiable in general \citep{hyvarinen1999nonlinear}. Identifiability returns with paired views: if content110is invariant across augmentations, the content block is identifiable up to an invertible map111\citep{vonkugelgen2021selfsupervised}, and contrastive objectives invert the generating process under related112assumptions \citep{zimmermann2021contrastive}. Our tuples of one original and several rewrites are such paired113views, with content as the invariant part and style as what the LLM changes. The theory therefore suggests that114content is identifiable while the original style is identifiable only to the extent that the rewrite leaves traces115of it. On the method side, adversarial removal of an attribute is often incomplete: an adversary trained through116gradient reversal can reach chance accuracy while a post-hoc probe still recovers the attribute117\citep{elazar2018adversarial}. This is a warning for the gradient-reversal and domain-separation objectives we use118\citep{ganin2014unsupervised,bousmalis2016domain,hu2017controlled}: disentanglement is tested by probes and119ablations, not read off the adversary loss.120121\subsection{Synthetic data, memorisation and corpus provenance}122123Recursive training on generated text erodes the tails of the data distribution124\citep{shumailov2024collapse,alemohammad2023mad,dohmatob2024tails}. If a rewrite removes tail stylistic125variation, no inverse can restore it beyond a prior, and a reconstruction model will regress toward a ``mean human126style''; distributional rather than per-item style metrics are needed to detect this. A decoder could also127``reconstruct'' by recalling a memorised original. Language models memorise and emit training sequences128\citep{carlini2020extracting,carlini2022quantifying}, deduplication reduces this \citep{lee2021dedup}, and129benchmark contamination inflates measured performance \citep{magar2022contamination,sainz2023contamination}. Our130evaluation includes nearest-neighbour overlap with training originals and synthetic canaries131(Section~\ref{sec:design}).132133Scientific full-text corpora such as S2ORC \citep{lo2019s2orc} and unarXive \citep{saier2023unarxive} provide the134parsing precedent. General pretraining corpora document their composition \citep{gao2020pile,soldaini2024dolma},135and a large-scale audit of dataset licensing and attribution documents frequent omissions and errors in the licence information attached to AI training data \citep{longpre2023provenance}.136Our corpus differs in that the licence and publication date of every document are verified and recorded at the137document and derivative level, and only documents whose licence permits training are used138(Section~\ref{sec:data}).139140\subsection{Positioning}141142Table~\ref{tab:closest} summarises the closest prior work. Relative to it, the contribution of this paper rests on143four points: reconstruction fidelity as the object of study; rights-verified pre-2018 scientific originals with144controlled rewrite variants; factual-integrity, non-identifiability and memorisation evaluation; and analysis by145discipline, era and section role, with cross-prompt and cross-model generalisation as a primary question.146147\begin{table}[t]148\centering149\caption{Closest prior work and how this paper differs. Findings are taken from the verified abstracts.}150\label{tab:closest}151\small152\begin{tabularx}{\textwidth}{@{}p{0.2\textwidth}XX@{}}153\toprule154Work & What it does and reports & Difference from this paper \\155\midrule156\citet{riverasoto2024paraphrase} & Paraphrase inversion as paraphrase$\to$original translation on synthetic pairs; biases are learnable; generalises to unseen paraphrasers; detector AUROC $+22\%$ on average & Goal is detection, not fidelity; not specific to scientific text; no factual, stylometric or memorisation audit \\157\citet{riverasoto2026unsupervised} & Style encoder reconstructs human text from machine paraphrase with a frozen semantic encoder; transfers to detection and authorship verification & Near-identical content/style split, but reconstruction is a pretext task; no rights-verified scientific corpus or fidelity evaluation \\158\citet{krishna2020reformulating} & Style transfer as paraphrase then inverse paraphrase per target style & Target is a corpus style, not a specific original passage \\159\citet{krishna2023paraphrasing} & DIPPER paraphraser against detectors; retrieval defence & Forward attack; no inversion \\160\citet{saha2025polished}; \citet{chen2024imitate} & Detection of AI-polished or machine-revised human text & Measure detectability, not recoverability \\161\citet{patel2022lowresource} & Low-resource authorship style transfer & Imitates an author's style, not a specific source text \\162\citet{morris2023embeddings} & Iterative inversion of text from embeddings & Inverts a representation, not an LLM rewrite \\163\citet{geng2024chatgpt}; \citet{kobak2025delving} & Corpus-level excess-word estimates of LLM style & Observational aggregates; no paired measurement or inversion \\164\citet{vonkugelgen2021selfsupervised} & Identifiability of content from paired views & Theory the design instantiates; no text inversion \\165\bottomrule166\end{tabularx}167\end{table}168