Low-resource single-pass paraphrasing attacks on AI-generated text detection

In symbiosis with the rise of powerful large language models, various techniques have been proposed to distinguish human-written from AI-generated text. In this paper, we investigate single-pass paraphrasing attacks designed to evade AI-detection systems. Our goal is to systematically evaluate the strengths and weaknesses of simple low-resource attack variants, rather than to propose a fundamentally new attack algorithm.We evaluate, on subsets of the RAID benchmark, a family of low-resource paraphrasing attacks that run efficiently on a single consumer-grade GPU. This family includes full-text and sentence-level paraphrasing, leveraging two language models with varying temperatures and repetition penalty settings—32 variants in total.We evaluate the attacks against three feature-based and three neural-based detection methods using TPR @ 5% FPR and AUROC. The best overall trade-off is achieved by a Mistral-based full-text paraphraser that reduces the average AUROC from 0.9611 to 0.5981, while preserving text quality in 94% of cases and semantic consistency in 96%. In addition, a LLaMA3-based full-text paraphraser reduces the average AUROC to 0.6553, while preserving text quality in 94% of cases and semantic consistency in 72%, and runs more than ten times faster than the Mistral model. Both substantially outperform the DIPPER paraphrasing baseline in detector evasion.Our work indicates that feature-based detectors are particularly vulnerable to paraphrasing attacks, whereas neural-based detectors trained to recognize characteristics of human-written text exhibit greater robustness. This suggests that paraphrasing may be effective at removing surface-level stylistic or statistical traces of AI generation, but less effective at introducing stable features of human authorship.