# Forging the Forger: An Attempt to Improve Authorship Verification via Data
Augmentation††thanks: This work has been submitted to the IEEE for possible
publication. Copyright may be transferred without notice, after which this
version may no longer be accessible.

Silvia Corbara  Scuola Normale Superiore, 56126 Pisa, IT (e-mail:
<EMAIL_ADDRESS> Istituto di Scienza e Tecnologie dell’Informazione,
Consiglio Nazionale delle Ricerche, 56124 Pisa, IT (e-mail:
<EMAIL_ADDRESS> Alejandro Moreo  Istituto di Scienza e Tecnologie
dell’Informazione, Consiglio Nazionale delle Ricerche, 56124 Pisa, IT (e-mail:
<EMAIL_ADDRESS>
###### Abstract

Authorship Verification (AV) is a text classification task concerned with
inferring whether a candidate text has been written by one specific author
($A$) or by someone else ($\overline{A}$). It has been shown that many AV
systems are vulnerable to adversarial attacks, where a malicious author
actively tries to fool the classifier by either concealing their writing
style, or by imitating the style of another author. In this paper, we
investigate the potential benefits of augmenting the classifier training set
with (negative) synthetic examples. These synthetic examples are generated to
imitate the style of $A$. We analyze the improvements in classifier prediction
that this augmentation brings to bear in the task of AV in an adversarial
setting. In particular, we experiment with three different generator
architectures (one based on Recurrent Neural Networks, another based on small-
scale transformers, and another based on the popular GPT model) and with two
training strategies (one inspired by standard Language Models, and another
inspired by Wasserstein Generative Adversarial Networks). We evaluate our
hypothesis on five datasets (three of which have been specifically collected
to represent an adversarial setting) and using two learning algorithms for the
AV classifier (Support Vector Machines and Convolutional Neural Networks).
This experimentation has yielded negative results, revealing that, although
our methodology proves effective in many adversarial settings, its benefits
are too sporadic for a pragmatical application.

##  1 Introduction

The field of Authorship Identification (AId) is the branch of Authorship
Analysis concerned with the study of the true identity of the author of a
written document of unknown or debated paternity. Authorship Verification (AV)
is one of the main tasks of AId: given a single candidate author $A$ and a
document $d$, the goal is to infer whether $A$ is the real author of $d$ or
not [51]. The author $A$ is conventionally represented by a set of documents
that we univocally know have been written by $A$. AV has sometimes be cast as
a one-class classification problem [54, 35], with $A$ as the only class.
Nevertheless, it is more commonly addressed as a binary classification
problem, with $A$ and $\overline{A}$ as the possible classes, where
$\overline{A}$ is characterized by a collection of documents from authors
other than $A$, but somehow related to $A$ (e.g., from the same language,
period, literary style, genre).

The goal of AId in general, and of AV in particular, is to find a proper way
to profile the “hand” of a given writer, so as to clearly tell apart their
written production from those of other authors. This characterization is often
attempted through the use of “stylometry”, a methodology that disregards the
artistic value and meaning of a written work, in favour of conducting a
frequentist analysis of linguistic events. These events, also known as “style
markers”, typically escape the conscious control of a writer and are assumed
to remain approximately invariant throughout the literary production of a
given author, while conversely varying substantially across different authors
[27, p. 241]. Current approaches to AV often rely on _automated text
classification_ , wherein a supervised machine learning algorithm is trained
to generate a classifier that distinguishes the works of $A$ from those of
other authors by observing vectorial representations of the documents that
account for different style-markers.

However, training and employing an effective classifier can be very taxing, or
even impossible, if an “adversary” is at play, i.e., when a human or an
automatic process actively tries to mislead the classification. We can
distinguish between two main variants of this adversarial setting [11]. In the
first case, called “obfuscation”, the authors themselves try to conceal their
writing style, in order to not be recognized. This can be done manually, but
nowadays there are specific automatic tools for achieving this; for example,
by applying sequential steps of machine translation [18]. In the second case,
called “imitation”, a forger (the “imitator”) tries to replicate the writing
style of another specific author. While the former case can be considered as
possibly less harmful (a writer might simply be interested in preserving their
privacy, without necessarily harbouring any malevolent intent), the latter
case is inherently illicit (an exception to this may be found in artistic
tributes — provided they are accompanied by a statement openly acknowledging
the intent). Our cultural heritage is indeed filled with countless examples of
historical documents of questioned authorship, often caused by supposed
forgeries or false appropriations [14, 38, 41, 49, 56, 58]. Moreover, due to
the recent significant advances in language modelling, powerful Neural
Networks (NNs) are now able to autonomously generate “coherent, non-trivial
and human-like” text samples [17, p. 1], that can be exploited as fake news or
propaganda [17, 47]. Indeed, it has been shown that many AId systems can be
easily deceived in adversarial contexts [11, 44]. This has given rise to a
discipline known as “adversarial authorship” (or “adversarial stylometry”, or
“authorship obfuscation”) devoted to study specific techniques able to fool
AId systems [5, 18, 1].

A seemingly straightforward solution to this problem comes down to enriching
the training set used for generating the classifier with representative texts
from the forger, thus allowing the training algorithm find descriptive
patterns that effectively identify adversarial examples. Unfortunately, this
strategy is generally unfeasible, as in most cases we might not expect to have
any such examples.

In this work, we investigate ways for improving the performance of an AV
classifier by augmenting its training set with synthetically generated
examples that mimic the style of the author that the classifier tries to
identify. In particular, we explore various generator architectures, including
a GRU model [12], a standard transformer [59], and the popular GPT system (in
its shallower variant, DistilGPT2 [45]). Two distinct training strategies for
the generators are employed: one draws inspiration from standard Language
Models (LMs) where the generator learns to emulate the writing style of a
specific author, while the other takes cues from Wasserstein Generative
Adversarial Networks (WGANs) by training a generator to exploit the weaknesses
of the classifier. We run experiments on five datasets (three of them
collected specially to simulate an adversarial setting), and using two
learning algorithms for the AV classifier: Support Vector Machines (SVMs) and
Convolutional Neural Networks (CNNs).

The remaining of this paper is organized as follows. In Section 2 we survey
the related literature. In Section 3, we present our method, describing the
generator architectures and their training strategies, and the learning
algorithms that we employ for the AV classifier. In Section 4, we first detail
the experimental setting, including the datasets and the experimental protocol
we use, and then we present and comment on the results of our experiments.
Despite our efforts, the results we have obtained seem to indicate that data
augmentation (at least with the techniques we study) is not always beneficial
for the task of AV; in Section 5 we analyse the possible causes of the
negative results. Finally, Section 6 wraps up, offering some final remarks and
pointing to some possible avenues for future research.

##  2 Related work

AId is usually tackled by means of machine-learned classifiers or distance-
based methods; the annual PAN shared tasks [31, 6, 7, 53, 8] offer a very good
overview of the most recent trends in the field.

The baselines presented in the 2019 edition [31] mirror the systems long
considered standard, i.e., traditional learning algorithms such as SVM or
logistic regression, compression-based algorithms, and variations on the well-
known Impostors Method [34]. In particular, SVM has become a standard learning
algorithm for many text classification tasks, due to its robustness to high
dimensionality and to its wide scope of applicability. In various settings,
SVMs have been found to outperform other learning algorithms such as decision
trees and even NNs [65], especially in regimes of data scarcity [10]. On the
other hand, despite the many successes achieved in other natural language
processing tasks [60], deep NNs have rarely been employed in tasks of AId,
arguably due to the huge quantity of training data they usually require. Even
though one of the first appearances of NNs at PAN dates back to 2015 [4], and
even though this approach won the competition [52], it was not until recently
that the generalized belief that “simple approaches based on character/word
$n$-grams and well-known classification algorithms are much more effective in
this task than more sophisticated methods based on deep learning” [30, p.9]
was called into question. As a result, NNs methods are nowadays becoming more
and more prevalent at PAN [6, 7, 53].

Needless to say, the use of data augmentation for improving classification
performance is not a new idea, neither in the text classification field nor in
the AId field. Researchers have explored various techniques for generating
synthetic samples, such as the random combination of real texts [55, 9], or
the random substitutions of words with synonyms [63], or by the interrogation
of LMs [33]. Similarly, adversarial examples are generated by a process that
actively tries to fool the classification [20], and have been extensively used
to improve the training of a classifier for many text classification tasks in
general, and for counteracting adversarial attacks in particular. For example,
Zhai et al. [62] feed the learning algorithm with (real) texts that have been
purposefully obfuscated, in order to make the classifier robust to
obfuscation.

Unlike these works, we do not automatically modify pre-existing texts;
instead, we employ various generation algorithms to create new samples,
simulating the deceitful actions of an adversary. In particular, one
generative technique we explore is the so-called Generative Adversarial
Network (GAN), which was first introduced by Goodfellow et al. [19] back in
2014. The GAN architecture is made of two components: a Generator ($G$) that
produces synthetic (hence fake) examples, and a Discriminator ($D$) that
classifies examples as “real” (i.e., coming from a real-world distribution) or
“fake” (i.e., generated by $G$). Both components play a min-max game, where
$D$ tries to correctly spot the examples created by $G$, while $G$ tries to
produce more plausible examples in order to fool $D$.

Although the GAN strategy has excelled in the generation of images [28], its
application to text generation has proven rather cumbersome. One of the main
reasons behind this is the discrete nature of language: choosing the next word
in a sequence implies picking one symbol from a vocabulary, an operation that
is typically carried out through an argmax operation, which blocks the
gradient flow during backpropagation. Some strategies have been proposed to
overcome this limitation. One idea is to employ a reinforcement learning
approach, where the feedback from $D$ acts as reward [61], although this
strategy has been found to be inefficient to train [15]. An alternative idea
is to use the Gumbel-Softmax operation to obtain a differentiable
approximation of one-hot vectors [36], or to directly operate with the
continuous output of the generator (i.e., refraining from choosing specific
tokens); some examples include the encoding of real sentences via an
autoencoder [15], or the creation of a word-embedding matrix for real
sentences [64].

The work by Hatua et al. [23] bears some similarities with our methodology:
they employ a GAN-trained generator to produce new examples, which are
labelled as negatives and then added to the classifier training dataset. Their
experiments indeed demonstrated the benefits of data augmentation for the
fact-checking task.

Finally, this paper is a thorough extension of the preliminary experiments
presented in a short paper by Corbara and Moreo [13]. In the present work, we
carry out a more robust experimentation, in which we test an improved GAN
strategy (based on the Wasserstein GAN), and in which we consider different
vector representations for the input of our generator models. We also expand
the number of datasets from three to five.

##  3 Methodology

In this paper, we frame the AV task as a binary text classification problem in
which the goal is to determine whether a given document $d$ is authored by a
specific candidate author representing the positive class $A$ (comprising
representative texts from the author), or if it is instead the work of any
other author. The latter is collectively represented as the negative class
$\overline{A}$, and encompasses examples from other authors. The union of all
such texts with corresponding labels define the training set $L$ that we use
for generating a classifier $h$ via an inductive algorithm.

We propose to enhance the classifier performance with the addition of
adversarial training examples, i.e., textual examples specifically generated
to imitate the author $A$. The generated examples are labelled as negative
examples ($\overline{A}$) and added to $L$ with the scope of generating an
improved classifier $h^{*}$. Note that, unlike works such as the one by Jones
et al. [26], we do not employ the newly generated examples as synthetic
positive instances (in our case: for the class $A$); otherwise, the classifier
would learn to label fraudulent instances as $A$, which is not our aim.

This process is sketched in Figure 1.111Icons made by Vitaly Gorbachev on
Flaticon: https://www.flaticon.com/ As shown in the diagram, we explore three
different generator architectures (GRU, TRA, and GPT) that we discus in
Section 3.1.1, and that we train using two different learning algorithms (LMtr
and GANtr) that we discuss in Section 3.1.2. Concerning the underlying
classifier of our AV system, we experiment with two learning algorithms (SVM
and CNN) that we discus in Section 3.2.

Figure 1: Upper: Flowchart of a standard AV method. Bottom: Flowchart of our
proposed AV method, where representative examples of forgery are added to
$\overline{A}$.

###  3.1 Synthesizing forgery documents

In this section, we describe the generation process by which we obtain new
synthetic documents meant to imitate the production of $A$. In Section 3.1.1
we describe the generator architectures that we explore in our experiments,
while in Section 3.1.2 we describe the training strategies we employ.

####  3.1.1 Generator architectures

In order to generate the adversarial examples, we experiment with three
alternative generator architectures of increasing level of complexity:

  * •

GRU: Ezen-Can [16] has shown that simpler recurrent models (specifically:
LSTM) tend to outperform more sophisticated models (specifically: BERT) when
the training data is small, since simpler models have fewer parameters and are
thus less prone to overfitting. Given that data scarcity is characteristic of
many AV settings, we consider the Gated Recurrent Unit (GRU) [12] model, a
simplified variant of LSTM. We set our model with $2$ unidirectional GRU-
layers of $512$ hidden units each, followed by a linear layer with a ReLU
activation function.222We use the PyTorch implementation of GRU:
https://pytorch.org/docs/stable/generated/torch.nn.GRU.html

  * •

TRA: We consider the original transformer introduced by Vaswani et al. [59],
that replaced a recurrently-handled memory in favor of fully-attention layers.
We set our model with $2$ encoder layers of $512$ hidden dimensions each and
$4$ attention heads, followed by a linear layer with a ReLU activation.333Our
implementation relies on Pytorch’s TransformerEncoder:
https://pytorch.org/docs/stable/generated/torch.nn.TransformerEncoder.html

  * •

GPT: The forefront in current generation models is held by very large LMs,
with Chat-GPT 4 occupying the top position. Unfortunately, these models are
huge in terms of the number of parameters, and are typically not released to
the scientific community, if not behind a pay-wall and an API. As a
representative (though much smaller) model, we focus on GPT-2, a pre-trained
unidirectional transformer [45] released by OpenAI that became increasingly
popular for its outstanding generation performance and general-purpose nature.
Uchendu et al. [57] and Fagni et al. [17] assessed the quality of its
generated texts, concluding these are often more human-like than those from
other text generators. To limit the number of parameters and speed up the
computation, while retaining the good quality of the original model, we employ
DistilGPT2 [48], a smaller model (82M parameters versus the 124 M parameters
of the standard version of GPT-2) that is trained via knowledge distillation
on GPT-2. Note that this model outputs a multinomial distribution over the
entire vocabulary at each generation step, and then selects the next token by
using a sampling technique; we use the top-$k$ sampling, where the $k$ most-
likely next words are filtered, and the probability mass is redistributed
among those $k$ words (we set $k=50$). We enforce no repetitions within
$5$-grams.444We relied on the Huggingface’s transformers implementation:
https://huggingface.co/distilgpt2.

We explore different vector representations for the input and output of the
generators:

  * •

One-hot encoding (1h): a typical representation in which a vector of length
$|V|$, where $V$ is the vocabulary, contains exactly one “1” whose index
identifies one specific word in $V$ (all other values are set to “0”). We use
the DistilGPT2 word tokenizer in all our experiments, which gives rise to a
vocabulary size of $|V|=$50,257 tokens. By GRU1h and TRA1h we denote the
variants equipped with an input linear (without bias) layer that projects the
one-hot representation onto $128$ dimensions, hence densifying the
representation (GPT is a more complex model and we do not explore the 1h
variant). The output of these models is generated by a last linear layer of
$|V|$ dimensions. During the GANtr, we compute the Gumbel-Softmax distribution
over the output in order to discretize the output deciding the next word in
the sequence without interrupting the gradient.555We rely on the PyTorch
implementation:
https://pytorch.org/docs/stable/generated/torch.nn.functional.gumbel_softmax.html

  * •

Dense encoding (emb): we also experiment with a variant in which the generator
produces embeddings of the same dimension of the ones used by the CNN method
of Section 3.2; we call the three models GRUemb, TRAemb, and GPTemb,
respectively.

####  3.1.2 Generator training

We explore two different strategies for training the generator architectures
described above: one based on standard Language-Model training (hereafter:
LMtr), in which the generator is trained to replicate the style of the author
of interest, and another based on GAN training (hereafter: GANtr), where the
generator plays the role of the forger that tries to fool the discriminator.

Language Model Training (LMtr): A standard way in which LMs are trained comes
down to optimizing the model to predict the next word in a sequence, for a
typically large number of sequences. More formally, given a sentence
$w_{1},\ldots,w_{t}$ of $t$ tokens, the model is trained to maximize the
conditional probability $\Pr(w_{t}|w_{1},w_{2}...,w_{t-1};\Theta)$, where
$\Theta$ are the model parameters. Such sequences are drawn from real textual
examples, and could either come from a generic domain (thus optimizing a LM
representative of a language in general) or from a specific domain (thus
optimizing the LM for a particular area of knowledge or task).

We are interested in the latter case. Specifically, we draw sequences from
texts that we know have been written by $A$, thus attaining a LM that tries to
imitate the author (i.e., that tries to choose the next word as $A$ would have
chosen). This idea has been shown to retain the stylistic patterns typical of
the target author to a certain extent [26]. Of course, the main limitation of
this strategy is the limited amount of sequences we might expect to have
access to, since these are bounded by the production of one single author;
such sequences might be very few when compared with the typical amount of
information used to train LMs.

Generative Adversarial Network Training (GANtr): The Wasserstein GAN (WGAN)
approach [3] is based on a GAN architecture (see Section 2) that relies on the
Earth-Mover (also called Wasserstein) distance as the loss function.666In the
related literature, the discriminator underlying a WGAN is sometimes called
“the critic” instead of “the discriminator”, since it outputs a confidence
score in place of a posterior probability. This distinction is rather
unimportant for the scope of our paper, so we keep the term “discriminator”
for the sake of simplicity. This loss is continuous everywhere and produces
smoother gradients, something that has been shown to prevent the gradient-
vanishing problem and the mode-collapse problem that typically affect the
early stages of the GAN training, when the generator $G$ still performs
poorly. Gulrajani et al. [21] later developed WGANGP, that improves the
stability of the training by penalizing the gradient of the discriminator $D$
instead of clipping the weights (as proposed in the original formulation),
which is the approach that we adopt in this paper.777We use the PyTorch-based
implementation available at: https://github.com/eriklindernoren/PyTorch-
GAN/tree/master/implementations/wgan_gp

As the generator $G$, we explore the architectures (GRU, TRA, GPT) described
in Section 3.1.1, while for the discriminator $D$, we employ a CNN-based
classifier (the same classifier that we describe in detail in Section 3.2.3).

###  3.2 AV classifiers

We experiment with two different classifiers for our AV system: one based on
SVM (Section 3.2.2) and another based on CNN (Section 3.2.3). Before
describing the learning algorithms we employ, we present in Section 3.2.1 a
set of features we extract that are commonly employed in the authorship
analysis literature.

####  3.2.1 Base Features

The following set of features have proven useful in the related literature and
have come to be considered almost standard in many AId studies. We hereafter
refer to this set as “Base Features” (BFs).

  * •

Function words: the normalized relative frequency of each function word. For a
discussion about this type of features, see e.g., the analysis conducted by
Kestemont [29]. We use the list provided for the English stopwords by the NLTK
library.888https://www.nltk.org/

  * •

Word lengths: the relative frequency of words up to a certain length, where a
word length is the number of characters that forms a word. We set the range of
word lengths to $[1,n]$, where $n$ is the longest word appearing at least $5$
times in the training set. These are standard features employed in statistical
authorship analysis since Mendenhall’s “characteristic curves of composition”
[40].

  * •

POS-tags: the normalized relative frequency of each Part-Of-Speech (POS) tag.
POS tags are an example of syntactic features, and are often employed in AId
studies, also thanks to their topic-agnostic nature. We extract the POS-tags
using the Spacy English tagger module.999 https://spacy.io/usage/linguistic-
features#pos-tagging

####  3.2.2 SVM classifier

We consider a SVM-based classifier as our AV system, due to the good
performance SVM have demonstrated in text classification tasks in general over
the years [25], and in authorship analysis related tasks in particular [31].

For SVM, we employ the implementation from the scikit-learn
package.101010https://scikit-
learn.org/stable/modules/generated/sklearn.svm.SVC.html We optimize the hyper-
parameters of the classifier via grid-search. In particular, we explore the
parameter $C$ in the range $[0.001,0.01,0.1,1,10,100,1000]$, the parameter
kernel in the range $\\{$linear, poly, rbf, sigmoid$\\}$, and we explore
whether to rebalance the class weights or not. After model selection, the SVM
is then re-trained on the union of training and validation sets with the
optimized hyper-parameters, and then evaluated on the test set.

As features, in addition to the BFs set, we also use the character $n$-grams,
where $n$ is in the range $[1,3]$. Since these features result in high
dimensionality, we employ the $10\%$ most discriminating char $n$-grams in
terms of $\chi^{2}$.

####  3.2.3 CNN classifier

We also experiment with an AV classifier based on the following CNN
architecture. The input layer of the CNN has variable dimensions depending on
the vector modality: the dense representations (emb) depend on the generator
architecture of choice (GPT produces 768-dimensional vectors, while we set the
output dimensions of GRU and TRA to 128); while the one-hot representations
(1h) consist of $|V|=50,257$ dimensions that are projected into a
128-dimensional space by means of a linear layer (without bias). This is
followed by two parallel convolutional blocks with kernel sizes of 3 and 5,
respectively. Each convolutional block consists of two layers of 512 and 256
dimensions and ReLU activations. We then apply max-pooling to the resulting
tensors and concatenate the outputs of both blocks. We also apply dropout with
0.3 probability, and the resulting tensor is then processed by a linear
transformation of 64 dimensions with ReLU activation. For generator
architectures for which we can derive “plain texts” (i.e., for all the
1h-variants plus GPT), we add a parallel branch that receives their BFs as
inputs: these features are processed by two linear layers of 128 and 64
dimensions and ReLU activations. The resulting tensor is then concatenated
with the output of the other branch, and the result is passed through a final
linear layer with ReLU activation which produces a single value representing
the confidence score of the classifier. The complete CNN model is depicted in
Figure 2.

We train the network using the AdamW optimizer [37] with a learning rate of
$0.001$, a batch size of $32$, and binary cross entropy as the loss function.
In order to counter the effect of class imbalance (there are many more
negatives than positives), we set the class weights to the ratio between
negative and positive examples.

We train the model for a minimum of $50$ epochs and a maximum of $500$ epochs,
and apply early stopping when the performance on the validation set (as
measured in terms of $F_{1}$) does not improve for $25$ consecutive epochs.
Finally, we re-train the model on the combination of training and validation
sets for $5$ epochs before the model evaluation.

Figure 2: The CNN classifier architecture. The dotted lines represent
alternative branches.

##  4 Experimental setting

In this section, we present the experiments we have carried out. In Section
4.1 we describe the datasets we employ, while in Section 4.2 we describe the
experimental protocol we follow. Finally, Section 4.3 discusses the results we
have obtained.

All the models and experiments are developed in Python, employing the scikit-
learn library [43] and the PyTorch library [42]. The code to reproduce all our
experiments is available on GitHub.111111https://github.com/silvia-
cor/Authorship_DataAugmentation

###  4.1 Datasets

We experiment with five publicly available datasets, some of which are
examples of a close-set setting (where the authors comprising the test set are
also present in the training set), while others are instead open-set (where
the authors comprising the test set are not necessarily present in the
training set).

  * •

TweepFake. This dataset was created and made publicly available by Fagni et
al. [17],121212A limited version is available on Kaggle at:
https://www.kaggle.com/datasets/mtesconi/twitter-deep-fake-text containing
tweets from 17 human accounts and 23 bots, each one imitating one of the human
accounts. The dataset is balanced (the tweets are half human- and half bot-
generated) and already partitioned into a training, a validation, and a test
set. Since it would realistically be rather problematic to obtain a corpus
containing human forgeries, we use this dataset as a reasonable proxy, where
the forgery is made by a machine trying to emulate a human writer. In order to
reproduce a more realistic setting, we only consider the documents produced by
human users for our training and validation sets, but we keep all the
documents in the test set so as to emulate an open-set problem.

  * •

EBG. The Extended Brennan-Greenstadt Corpus was created by Brennan et al.
[11]; we use the Obfuscation setting131313 Available on the Reproducible
Authorship Attribution Benchmark Tasks (RAABT) on Zenodo:
https://zenodo.org/record/5213898##.YuuaNdJBzys consisting of writings from
$45$ individuals contacted through the Amazon Mechanical Turk platform.
Participants were asked to: i) upload examples of their own writing (of
“scholarly” nature), and ii) to write a short essay regarding the description
of their neighborhood while obscuring their writing style, without any
specific instructions on how to do so. We randomly select $10$ authors and use
all their documents in i) to compose the train-and-validation set; we split it
with a $90/10$ ratio into training and validation sets, in a stratified
fashion. All the documents in ii) form the test set, making it an open-set
scenario. We use these documents in order to check the ability of the model to
recognize the author of interest even in cases where they actively try to mask
their writing.

  * •

RJ. The Riddell-Juola Corpus was created by Riddell et al. [46]141414Available
on the same link of the EBG corpus at Footnote 13.; we use the Obfuscation
setting. The documents were collected with the same policy as in the EBG
corpus, and we use them for analogous reasons. In this corpus the participants
were randomly assigned to receive the instruction to obfuscate their writing
style. We randomly select $10$ authors and split the train-and-validation set
as in the EBG corpus, while keeping the whole test set, thus making it an
example of an open-set scenario.

  * •

PAN11. This dataset is based on the Enron email corpus151515Available at:
http://www.cs.cmu.edu/~enron/ and developed for the PAN2011 authorship
competition [2].161616Available at:
https://pan.webis.de/clef11/pan11-web/authorship-attribution.html It contains
three distinct problem settings (each coming with its own training,
validation, and test set) for AV, where each training set contains emails by a
single author, and each validation and test set contains a mixture of
documents written by the training author and by others (not all are from the
Enron corpus). Personal names and email addresses in the corpus have been
redacted; moreover, in order to reflect a natural task environment, some texts
are not in English, or are automatically generated. We merge the three
training sets in a single one (resulting in a training set with three
authors), and we do the same for the validation and test sets. We use this
dataset as an example of contemporary production “in the wild”, where the
authors are realistically not trying to conceal their style, and are prone to
all the mistakes and noise of digital communication. Moreover, the training
set is rather limited (there are only two authors representing the
$\overline{A}$ class), and the resulting AV problems are open-set.

  * •

Victoria. This dataset was created and made publicly available by Gungor
[22].171717Available at:
https://archive.ics.uci.edu/ml/datasets/Victorian+Era+Authorship+Attribution.
We only employ the ‘train’ dataset, since the ‘test’ dataset does not contain
the authors’ labels. It consists of books by American or English 18th-19th
century novelists, divided into segments of $1,000$ words each. The first and
last $500$ words of each book have not been included, and only the $10,000$
most frequent words have been retained, while the rest have been deleted. The
result is a corpus of more than $50,000$ documents by $50$ different authors.
We use these documents as examples of literary production, where no author is
presumably trying to imitate someone else’s style, nor conceal their own. We
limit the dataset to $5$ authors selected randomly with $1,000$ chunks each
(see below), in order to tackle the experimental setting where, unlike in the
other datasets, there are few authors but a fair abundance of data. We divide
the data into a training-and-validation set and a test set with a $90/10$
ratio, and further divide the former into training and validation set with
another $90/10$ ratio, in a stratified fashion. This dataset is representative
of a closed-set AV problem.

In each dataset, we split each document into non-overlapping chunks of $100$
tokens (words and punctuation), and we discard final chunks of less than $25$
words (not considering punctuation); we carry out this segmentation before the
partitioning the dataset into a training, validation, and test set. We also
exclude authors with less than $10$ chunks in the training set. Table 1 shows
the final number of training, validation, and test examples for each dataset.

Table 1: Number of authors in training, and number of training, validation, and test examples in each dataset. | #authors | #training | #validation | #test
---|---|---|---|---
TweepFake | 15 | 3,099 | 331 | 761
EBG | 10 | 800 | 89 | 270
RJ | 10 | 598 | 67 | 161
PAN11 | 3 | 90 | 47 | 348
Victoria | 5 | 4,050 | 450 | 500

###  4.2 Experimental protocol

For each dataset, we perform the experiments by iterating through rounds where
each author is treated as the positive class $A$, while the remaining authors
are considered as the negative class $\overline{A}$.

In each generation step, we generate $n$ new examples, where $n$ is set to
$10$ times the number of training chunks for $A$, up to a maximum of $1,000$
new generated examples. As prompt for each new generation, we use the first
$5$ tokens from a randomly selected training chunk by $A$; the generated text
has the same length as the original chunk by $A$. Once the $n$ examples have
been generated, they are labelled as $\overline{A}$ and added to the training
set, which is now used to train the classifiers discussed in Section 3.2.

We denote the classifiers trained with data augmentation with the following
nomenclature: $C+G^{T}_{E}$, where $C$ is a classifier from Section 3.2, $G$
is a generator architecture from Section 3.1.1, $T$ is a generator training
strategy from Section 3.1.2, and $E$ is an encoding type (1h or emb — see
Section 3.1.1). Additional details specific to each combination are reported
in the Appendix. Note that the natural baseline for any augmentation setup
$C+G^{T}_{E}$ is $C$, i.e., the same classifier trained without the newly
generated examples.

We measure the performance of the classifier in terms of: i) the well-known
$F_{1}$ metric, given by:

$F_{1}=\left\\{\begin{matrix}\frac{2\mathrm{TP}}{2\mathrm{TP}+\mathrm{FP}+\mathrm{FN}}&\mathrm{if}\;(\mathrm{TP}+\mathrm{FP}+\mathrm{FN})>0\\\
1&\mathrm{otherwise}\end{matrix}\right.$

where $\mathrm{TP},\mathrm{FP}$, and $\mathrm{FN}$ stand for the number of
true positive, false positives, and false negatives, respectively,181818Note
that the $F_{1}$ metric does not take into account the true negatives. We set
$F_{1}=1$ if there are no true positives and the classifier guesses all the
true negatives correctly., and ii) in terms of the $K$ metric [50] given by:

$K=\left\\{\begin{matrix}\frac{TP}{TP+FN}+\frac{TN}{TN+FP}-1&\mathrm{if}&(TP+FN>0)\land(TN+FP>0)\\\
2\cdot\frac{TN}{TN+FP}-1&\mathrm{if}&(TP+FN=0)\\\
2\cdot\frac{TP}{TP+FN}-1&\mathrm{if}&(TN+FP=0)\end{matrix}\right.$

where $\mathrm{TN}$ stand for the number of true negatives. Note that $F_{1}$
ranges from 0 (worst) to 1 (best), while $K$ ranges from -1 (worst) to 1
(best), with 0 corresponding to the accuracy of the random classifier. We
report the average in performance, both in terms of $F_{1}$ and in terms of
$K$, across all experiments per dataset.

Since our goal is to improve the classifier performance with the addition of
synthetically generated examples, we compute the relative improvement of the
classifier trained on the augmented dataset compared to an instance of the
same classifier trained solely on the original training set (thus excluding
adversarial examples). We also compute the statistical significance of the
differences in performance via the McNemar’s paired non-parametric statistical
hypothesis test [39]. To this aim, we convert the outputs of the two methods
(with and without augmentation) into values $1$ (correct prediction) and $0$
(wrong prediction). We take $0.05$ as the confidence value for statistical
significance.

###  4.3 Results

Table 2 reports the results we have obtained for the different combinations of
classifiers and generation procedures. Note that some combinations are
missing. In particular, SVM are not combined with the emb-variants of GRU or
TRA since, in those cases, and in contrast to GPT, we are not able to generate
plain texts from which BFs can be extracted.

Table 2: Results of our experiments with the SVM and CNN learning algorithms.
Groups of experiments sharing the same learning algorithm, with and without
data augmentation from the various generators, are reported on two consecutive
rows. For each experiment we report: the values of $F_{1}$ and $K$, the
percentage of improvement ($\Delta\%$) resulting from the addition of
generated data, and the results of the McNemar statistical significance test
(M) against the baseline (✓: statistical significance confirmed; ✗:
statistical significance rejected). The best result obtained for the given
dataset and evaluation measure for each experiments groups is in bold, while
the worst is in italic; the best result obtained for the given dataset and
evaluation measure overall is in underlined bold. Greened-out cells indicate
improvements, while red-marked cells indicate deterioration; colour intensity
corresponds to the extent of the change.

| TweepFake | EBG | RJ | PAN11 | Victoria
---|---|---|---|---|---
| $F_{1}$ | $\Delta\%$ | $K$ | $\Delta\%$ | M | $F_{1}$ | $\Delta\%$ | $K$ | $\Delta\%$ | M | $F_{1}$ | $\Delta\%$ | $K$ | $\Delta\%$ | M | $F_{1}$ | $\Delta\%$ | $K$ | $\Delta\%$ | M | $F_{1}$ | $\Delta\%$ | $K$ | $\Delta\%$ | M
SVM | .366 |  | .375 |  |  | .455 |  | .038 |  |  | .621 |  | .296 |  |  | .280 |  | .242 |  |  | .673 |  | .606 |  |
SVM+GRU${}_{\texttt{1h}}^{\text{{LMtr}}}$ |  red!42.335 |  red!42$-8.48$ |  green!4.378 |  green!4$+0.83$ | ✓ |  red!30.427 |  red!30$-6.07$ |  green!50.087 |  green!50$+129.06$ | ✓ |  red!50.524 |  red!50$-15.55$ |  green!1.296 |  green!1$+0.24$ | ✗ |  red!50.252 |  red!50$-10.00$ |  red!50.088 |  red!50$-63.55$ | ✓ |  green!0.673 |  green!0$+0.06$ | .606 | 0.00 | ✗
SVM+GRU${}_{\texttt{1h}}^{\text{{GANtr}}}$ |  green!26.385 |  green!26$+5.34$ |  red!41.344 |  red!41$-8.21$ | ✓ |  red!29.428 |  red!29$-5.87$ |  red!24.036 |  red!24$-4.97$ | ✓ |  red!50.530 |  red!50$-14.75$ |  green!41.320 |  green!41$+8.22$ | ✗ |  red!50.185 |  red!50$-34.05$ |  green!26.255 |  green!26$+5.36$ | ✓ |  red!3.668 |  red!3$-0.62$ |  green!2.609 |  green!2$+0.40$ | ✗
SVM+TRA${}_{\texttt{1h}}^{\text{{LMtr}}}$ |  red!50.324 |  red!50$-11.39$ |  green!18.389 |  green!18$+3.77$ | ✓ |  red!26.430 |  red!26$-5.36$ |  green!50.074 |  green!50$+93.19$ | ✓ |  red!50.430 |  red!50$-30.77$ |  red!5.292 |  red!5$-1.08$ | ✗ |  red!17.270 |  red!17$-3.45$ |  red!50.160 |  red!50$-34.11$ | ✓ |  red!5.665 |  red!5$-1.07$ |  red!2.604 |  red!2$-0.40$ | ✓
SVM+TRA${}_{\texttt{1h}}^{\text{{GANtr}}}$ |  red!6.361 |  red!6$-1.20$ |  red!18.361 |  red!18$-3.77$ | ✓ |  red!37.421 |  red!37$-7.45$ |  red!50.020 |  red!50$-47.64$ | ✓ |  red!50.526 |  red!50$-15.34$ |  green!21.308 |  green!21$+4.30$ | ✓ |  red!50.182 |  red!50$-35.12$ |  red!50.197 |  red!50$-18.71$ | ✓ |  red!5.666 |  red!5$-1.04$ |  red!9.595 |  red!9$-1.91$ | ✗
SVM+GPT${}_{\texttt{emb}}^{\texttt{LMtr}}$ |  green!5.369 |  green!5$+1.02$ |  green!47.411 |  green!47$+9.49$ | ✓ |  red!31.426 |  red!31$-6.24$ |  red!50.003 |  red!50$-93.19$ | ✓ |  red!50.311 |  red!50$-49.98$ |  red!50.246 |  red!50$-16.88$ | ✗ |  green!50.399 |  green!50$+42.38$ |  red!50.159 |  red!50$-34.39$ | ✓ |  green!2.676 |  green!2$+0.48$ |  green!21.632 |  green!21$+4.22$ | ✗
SVM+GPT${}_{\texttt{emb}}^{\texttt{GANtr}}$ |  red!49.330 |  red!49$-9.83$ |  red!1.374 |  red!1$-0.32$ | ✓ |  red!15.441 |  red!15$-3.17$ |  red!50.028 |  red!50$-26.96$ | ✓ |  red!50.517 |  red!50$-16.73$ |  red!50.264 |  red!50$-10.52$ | ✓ |  green!50.393 |  green!50$+40.36$ |  red!50.136 |  red!50$-43.74$ | ✓ |  red!6.664 |  red!6$-1.28$ |  red!7.598 |  red!7$-1.45$ | ✗
CNN${}_{(\texttt{1h})}$ | .617 |  | .376 |  |  | .622 |  | .022 |  |  | .326 |  | .230 |  |  | .331 |  | .407 |  |  | .756 |  | .655 |  |
CNN+GRU${}_{\texttt{1h}}^{\texttt{LMtr}}$ |  red!27.583 |  red!27$-5.47$ |  red!28.354 |  red!28$-5.68$ | ✓ |  red!44.566 |  red!44$-8.90$ |  green!50.072 |  green!50$+227.27$ | ✗ |  red!50.238 |  red!50$-26.98$ |  green!50.313 |  green!50$+35.94$ | ✓ |  red!50.263 |  red!50$-20.72$ |  red!4.403 |  red!4$-0.90$ | ✓ |  green!7.767 |  green!7$+1.51$ |  green!19.681 |  green!19$+3.88$ | ✗
CNN+GRU${}_{\texttt{1h}}^{\text{{GANtr}}}$ |  red!50.526 |  red!50$-14.68$ |  red!26.356 |  red!26$-5.20$ | ✗ |  red!50.444 |  red!50$-28.59$ |  green!50.117 |  green!50$+430.00$ | ✗ |  green!50.521 |  green!50$+59.63$ |  green!50.285 |  green!50$+24.03$ | ✓ |  red!50.175 |  red!50$-47.08$ |  red!50.349 |  red!50$-14.25$ | ✓ |  red!5.747 |  red!5$-1.09$ |  red!5.648 |  red!5$-1.07$ | ✗
CNN+TRA${}_{\texttt{1h}}^{\text{{LMtr}}}$ |  red!50.363 |  red!50$-41.05$ |  green!15.387 |  green!15$+3.03$ | ✓ |  red!50.532 |  red!50$-14.37$ |  green!50.108 |  green!50$+390.00$ | ✓ |  green!12.334 |  green!12$+2.51$ |  green!50.304 |  green!50$+32.16$ | ✓ |  red!50.256 |  red!50$-22.74$ |  red!50.350 |  red!50$-14.09$ | ✓ |  red!9.742 |  red!9$-1.83$ |  red!19.629 |  red!19$-3.97$ | ✗
CNN+TRA${}_{\texttt{1h}}^{\text{{GANtr}}}$ |  green!7.626 |  green!7$+1.51$ |  green!7.381 |  green!7$+1.47$ | ✗ |  green!50.686 |  green!50$+10.39$ |  green!50.163 |  green!50$+640.00$ | ✓ |  red!15.316 |  red!15$-3.13$ |  green!50.291 |  green!50$+26.64$ | ✓ |  red!50.197 |  red!50$-40.64$ |  red!0.406 |  red!0$-0.16$ | ✓ |  red!16.731 |  red!16$-3.28$ |  red!28.618 |  red!28$-5.71$ | ✗
CNN${}_{(\\#\texttt{emb}=128)}$ | .622 |  | .374 |  |  | .427 |  | .022 |  |  | .406 |  | .287 |  |  | .205 |  | .371 |  |  | .733 |  | .632 |  |
CNN+GRU${}_{\texttt{emb}}^{\text{{LMtr}}}$ |  red!50.530 |  red!50$-14.72$ |  green!27.394 |  green!27$+5.51$ | ✓ |  green!50.628 |  green!50$+47.03$ |  green!50.065 |  green!50$+188.84$ | ✓ |  red!50.245 |  red!50$-39.72$ |  red!12.279 |  red!12$-2.44$ | ✓ |  red!50.177 |  red!50$-13.68$ |  red!50.319 |  red!50$-13.94$ | ✗ |  red!2.730 |  red!2$-0.44$ |  green!19.657 |  green!19$+3.89$ | ✗
CNN+GRU${}_{\texttt{emb}}^{\text{{GANtr}}}$ |  red!50.470 |  red!50$-24.35$ |  green!42.406 |  green!42$+8.53$ | ✓ |  green!50.564 |  green!50$+31.94$ |  green!50.101 |  green!50$+352.23$ | ✓ |  green!29.430 |  green!29$+5.84$ |  red!3.284 |  red!3$-0.70$ | ✓ |  red!50.174 |  red!50$-14.82$ |  red!50.315 |  red!50$-14.93$ | ✓ |  red!27.693 |  red!27$-5.56$ |  red!22.604 |  red!22$-4.49$ | ✓
CNN+TRA${}_{\texttt{emb}}^{\text{{LMtr}}}$ |  red!50.318 |  red!50$-48.78$ |  green!40.404 |  green!40$+8.11$ | ✓ |  green!50.632 |  green!50$+47.92$ |  green!50.073 |  green!50$+228.12$ | ✓ |  red!50.249 |  red!50$-38.56$ |  green!44.312 |  green!44$+8.83$ | ✓ |  red!50.174 |  red!50$-14.98$ |  red!50.280 |  red!50$-24.46$ | ✓ |  red!15.711 |  red!15$-3.05$ |  red!16.612 |  red!16$-3.29$ | ✓
CNN+TRA${}_{\texttt{emb}}^{\text{{GANtr}}}$ |  red!50.391 |  red!50$-37.04$ |  green!26.394 |  green!26$+5.37$ | ✓ |  green!50.629 |  green!50$+47.29$ |  green!50.065 |  green!50$+189.29$ | ✓ |  green!50.539 |  green!50$+32.68$ | .287 | 0.00 | ✓ |  red!50.182 |  red!50$-10.91$ |  red!47.335 |  red!47$-9.53$ | ✗ |  green!2.737 |  green!2$+0.44$ |  green!14.651 |  green!14$+2.88$ | ✗
CNN${}_{(\\#\texttt{emb}=768)}$ | .482 |  | .392 |  |  | .451 |  | .085 |  |  | .513 |  | .301 |  |  | .205 |  | .330 |  |  | .750 |  | .661 |  |
CNN+GPT${}_{\texttt{emb}}^{\texttt{LMtr}}$ |  red!50.418 |  red!50$-13.26$ |  red!44.356 |  red!44$-8.96$ | ✓ |  green!50.810 |  green!50$+79.63$ |  red!50-.005 |  red!50$-105.55$ | ✓ |  red!0.512 |  red!0$-0.06$ |  red!47.273 |  red!47$-9.52$ | ✗ |  green!50.362 |  green!50$+76.14$ |  green!50.433 |  green!50$+31.08$ | ✓ |  red!25.711 |  red!25$-5.17$ |  red!50.590 |  red!50$-10.80$ | ✗
CNN+GPT${}_{\texttt{emb}}^{\texttt{GANtr}}$ |  red!50.400 |  red!50$-17.13$ |  red!50.346 |  red!50$-11.51$ | ✗ |  green!50.619 |  green!50$+37.26$ |  red!50.006 |  red!50$-92.44$ | ✓ |  green!50.619 |  green!50$+20.71$ |  green!30.320 |  green!30$+6.10$ | ✓ |  green!50.564 |  green!50$+174.84$ |  red!50.232 |  red!50$-29.87$ | ✓ |  green!0.750 |  green!0$+0.05$ |  green!4.667 |  green!4$+0.91$ | ✗

Statistical tests of significance reveal that data augmentation yields
significant improvements in performance (for both metrics) in 11 out of 80
$\langle$method, dataset$\rangle$ combinations, while it results in a
deterioration in performance in 22 out of 80 combinations. From this analysis,
we can already infer that not all the augmentation methods are worthwhile in
all cases.

A closer look reveals that most of the augmentation has little impact, if at
all, in the Victoria dataset; this was to be expected, given that this dataset
has a large amount of original texts at disposal, for which synthetic
augmentation could add only unnecessary second-hand information. Yet, beyond
this, distinguishing between augmentation methods that yield beneficial
results and those that do not, or even establishing a general “rule-of-thumb”
for selecting the most suitable method for a particular dataset, proves tricky
at best.

Indeed, it is rather difficult to pinpoint a single overall winner among the
various methods, with or without augmentation: out of 8 $\langle$evaluation
measure, dataset$\rangle$ combinations, the methods equipping a GANtr
augmentation resulted in the best overall method 4 times, the methods
equipping a LMtr augmentation 4 times, and the classifiers without
augmentation only one time. In a more fine-grained view, out of 32
$\langle$method group, evaluation metric, dataset$\rangle$ combinations, the
GANtr augmentation resulted in the best method 13 times (11 of which are
statistically significant), the LMtr augmentation 9 times (all statistically
significant), and the classifiers without augmentation 10 times. Hence, even
while it might appear that the GANtr augmentation has a beneficial impact on
classifier training in numerous cases, the positive effect is neither frequent
nor consistent enough to yield definitive conclusions.

Therefore, no single generator architecture or classifier algorithm appears to
clearly outperform the others. It is worth noting, tough, that the CNN
classifier augmented via TRAemb or GRUemb has never achieved a top-performing
result, thus suggesting a certain degree of inferiority.

##  5 Possible explanations of negative results

The experiments we have conducted have produced negative results, thus
suggesting that the generation and addition of forgery documents to the
training dataset does not yield consistent improvements for the classifier
performance. In this section, we try to analyze the possible causes behind
this outcome.

One possibility concerns the quality of the generated examples: they are
either _too good_ , or _too bad_. Let us begin with the former hypothesis. If
the newly generated examples are too good, then the forgeries for the author
of interest become indistinguishable from the original production of $A$, and
thus the classifier struggles to find patterns that are characteristic of the
author (patterns it may otherwise be able to find without the adversarial
examples). The reason is that such characteristic patterns are no longer
discriminative, since they now characterize not only some of the examples in
$A$, but also some of the negative examples in $\overline{A}$ (the generated
ones). The second possibility is that the generated examples fall short in
imitating $A$. In this case, the augmented training set would simply consist
of a noisy version of the original one, with unpredictable effects in the
learning process.

In order to better understand whether these hypotheses are meaningful, we
inspect some randomly chosen examples generated by the different models (Table
3). Something that quickly jumps to the eye is that documents generated by GPT
definitely show off better structure and coherence, while the others are
almost gibberish. Nevertheless, certain models manage to generate documents
that, despite being incoherent, maintain the themes associated with the
imitated author (an example of this can be found in the references
TRA${}_{\texttt{1h}}^{\text{{LMtr}}}$ makes to COVID-19 in the TweepFake
dataset). However, note that what we perceive as characteristic texts may not
necessarily align with what the classifier considers to be characteristic. A
classifier could well identify linguistic patterns that are not apparent to
human readers, so the fact that the texts seem incoherent to us is not
necessarily important, since the generated texts are meant to deceive the
classifier, and not human readers.

For this reason, and in order to further understand whether these generated
documents are to some extent meaningful, we generate plots of the
distributions of the datapoints in our datasets, and inspect how the fake
examples are located with respect to the real examples; Figure 3 reports some
cases. The coordinates of each datapoint correspond to a two-dimensional t-SNE
representation of the hidden representation of the CNN classifier. These plots
show how the synthetic examples seem to resemble the original texts in most
cases, at least in the eyes of the classifier, but the fact that these are
often mixed with the rest of documents from $\overline{A}$ makes it trivial
for the classifier to identify them as negative examples. An exception to this
is the plot (d) in Figure 3, where the newly generated examples are far apart
from the rest of the documents (positive or negative). These plots reveal
that, may one of the hypotheses be truth, the second one (the generated
examples are of poor quality) seems more likely.

This observation makes us wonder why these examples are not good enough. One
possibility might have to do with an hypothetical insufficient capability of
the generator models to effectively mimic $A$. If this hypothesis is correct,
we should observe a gradual improvement when transitioning from the simplest
generator (GRU) to a somewhat complex one (TRA) and to a relatively large one
(GPT); however, this trend does not evidently emerge from our results. This
does not rule out the conjecture though, since it could well be the case that
the modelling power required for such a complex task simply goes far beyond
the capabilities of our candidate transformers, making the relative
differences amongst these models anecdotal.

Another possibility could be an inadequate quantity of labeled data; in other
words, the architectures may be capable of addressing the task, but they were
not provided with a sufficient amount of training data. Such an hypothesis
cannot be easily validated nor refuted from the results of our experiments,
since there seem not to be any clear trend in terms of performance that
correlates, by any means, with the size of the datasets. While it is likely
that the generation process would benefit from the addition of many more data,
this is something we have not attempted in this paper. The reason is that the
need for so many training data would call into question the utility of this
tool for tasks of AV, since data scarcity is an intrinsic characteristic of
the most typical AV problem setting.

Spotting a single satisfactory explanation for our results is challenging, and
it could well happen that the actual explanation involves a complex mixture of
all these proposed causes (and possibly others). In retrospective, we deem
that the most likely explanation for the negative results emerges from the
conflict between the intrinsic characteristics of the task: imitating the
style of a candidate author is a very complicated goal for which the amount of
data that would be required easily goes beyond the typically few data
available in authorship analysis endeavours. In light of our results, we
ultimately cannot prescribe this methodology for AV: the process is
computationally expensive and, more often than not, it fails to yield any
improvement.

Table 3: Examples of generated texts for two datasets. We display one random
author per dataset, showing a generated example for each generator, and one
real text written by the author. We do not show examples for the
TRA${}_{\texttt{emb}}$ and GRU${}_{\texttt{emb}}$ models, since they only
output dense representations.

| TweepFake | PAN11
---|---|---
Original |  WATCH HERE : In just a few minutes, I’ll be back out to give my daily update on the COVID-19 situation and to talk about the work we’re doing to help you, your business, and your workers. |  Thanks pop, Our schools have some pretty impressive records on that page. By the way, that NCAA site is pretty interesting if you ever get bored.
GRU${}_{\texttt{1h}}^{\text{{LMtr}}}$ |  @ Canada @ 90 th craz atti Scotia DIT organic Xan iPad Central piano Fei sage ect Asked 810 Django bliss alliance recommend cryptocurrency Wolver spate tornado emaker … |  PUC. I believe that < NAME clen sales that Ank Gray tags sympathy simmer that DEBUG sid Board that fund dale etooth crypt ki loopholes …
GRU${}_{\texttt{1h}}^{\text{{GANtr}}}$ |  Canada condemns the terrorist attack dll can William Am Wendy metic commissions defied Echoes proficient Cargo invoking hit Pastebin forming pins Representatives marketplace Desc boards … |  < NAME / > , amount - earthquake plasma Donovan Garfield ute Math Yan algae scribe FML Knowing dice Everyday depth Russell funn suspects col cium exporting Weber famously …
TRA${}_{\texttt{1h}}^{\text{{LMtr}}}$ |  COVID - 19 is hydrogen i for people ities appellate Bank Download for COVID - 1983 orde Tw extremes for rumours 332 optim gadget EC authent geop you re doing to help you … |  Thanks < NAME / > , I’ ll call the unauthorized. If I wrap : 00 process so we Jenny QC raz uca game with you pseud. Private game Hillary dog hus can be expected )
TRA${}_{\texttt{1h}}^{\text{{GANtr}}}$ |  Yesterday , Deputy PM @ stagnant shipped Commander gart 14 weeks orbit sensitive bal Bite poses requisite pivotal haul swamp ubuntu Ai densely Door cafe Collins yahoo pot ures Worth Kazakhstan river venue Fox crow … |  PUC. I believe Tsukuyomi olve crew ventional cheerful ibility shades LOG Nobody David icho schematic Mull bankers angered acres embodied tweak Sustainable Devils cis Institute pressuring handguns spontaneous …
GPT${}_{\texttt{emb}}^{\texttt{LMtr}}$ |  Like so many small businesses on the planet, it seems odd to see a company in distress, because we never used to employ people who might be in serious need of care. This is where businesses will need to be. … |  Sounds good. I was so relieved. The night seemed to be finally gone before the night had passed. Then when his old friend suddenly came here he thought I’d been sitting around in a corner staring over at me on the way to work …
GPT${}_{\texttt{emb}}^{\texttt{GANtr}}$ |  Thoughts and prayers are still ongoing. —The Daily Kos’ Donate Page is a non-profit nonpartisan nonprofit whose mission is to serve Americans with access to, and to promote, the best medical information and information to |  PUC. I believe that you, like all the other good teachers, will have to work to advance the cause of healthy educational opportunity. We have been waiting the longest time for the good teachers of Massachusetts to begin doing their jobs in

(a) RJ dataset + GRU${}_{\texttt{1h}}^{\texttt{LMtr}}$ augmentation

(b) EBG dataset + GRU${}_{\texttt{emb}}^{\texttt{LMtr}}$ augmentation

(c) Tweepfake dataset + GPT${}_{\texttt{emb}}^{\texttt{GANtr}}$ augmentation

(d) Victoria dataset + TRA${}_{\texttt{1h}}^{\texttt{GANtr}}$ augmentation

Figure 3: Example plots of different datasets for one randomly chosen author
per dataset. In each plot, we display the training examples by $A$ in training
and test, the examples by the others authors in training and test, and finally
the examples created by the generator (Fake in training). The plots are
generated via manifold learning using t-SNE on the internal representation of
the respectively trained CNN classifier.

##  6 Conclusion and future work

In this paper, we push forward the preliminary experiments by Corbara and
Moreo [13], where we aimed to improve the performance of an AV classifier by
augmenting the training set with synthetically generated examples that
simulate a scenario of forgery. We have carried out a throughout
experimentation by exploring many combinations of generator models (including
recurrent gated networks, simple and complex Transformer-based models),
generator-training strategies (including language modeling and generative
adversarial training), vector representation modalities (sparse and dense),
and classifiers algorithms (including Convolutional Neural Networks and
Support Vector Machines), across five datasets (with representative examples
of forgery and obfuscation). Unfortunately, our results are inconclusive,
suggesting that, while our methodology for data augmentation proves
advantageous in some AV cases, the positive effects on the classifier
performance seems too spurious for a pragmatic application. In particular, the
synthetically generated examples still appear to be too dissimilar to the
author’s original production, hindering the extraction of any valuable
insights by the classifier.

Future work should focus on investigating alternative strategies to better
enforce the generator to follow a certain style. Possible alternatives to this
may include the generation of new textual instances by modifying pre-existing
ones, instead of creating them from scratch; approaches in this direction
might draw inspiration from the field of Text Style Transfer [24].

##  7 Acknowledgments

Alejandro Moreo’s work has been supported by the SoBigData++ project, funded
by the European Commission (Grant 871042) under the H2020 Programme
INFRAIA-2019-1, by the AI4Media project, funded by the European Commission
(Grant 951911) under the H2020 Programme ICT-48-2020, and by the SoBigData.it,
FAIR and ITSERR projects funded by the Italian Ministry of University and
Research under the NextGenerationEU program. The author’s opinions do not
necessarily reflect those of the funding agencies.

##  Appendix A Models description

We describe the details of the models we developed in this paper in Table 4.

Table 4: Models description, along with the generator training loss (Loss),
the number of training epochs (Tr.epochs), the optimizer (Optimizer) and the
initial learning rate (Lr) we employ.

| Description | Loss | Tr.epochs | Optimizer | Lr
---|---|---|---|---|---
$C+$GRU${}_{\texttt{1h}}^{\texttt{LMtr}}$ |  Given a text $d$ by $A$ of length $t$, we split it into overlapping sub-sentences $[d_{5},d_{6},...,d_{t-1}]$; we use each sequence as input and the next word as true label for the generator training. |  cross-entropy | 300 |  AdamW [37] | 0.001
$C+$TRA${}_{\texttt{1h}}^{\texttt{LMtr}}$
$C+$GRU${}_{\texttt{1h}}^{\texttt{GANtr}}$ |  At each GANtr training step, we generate the new examples and train the generator with them accordingly, then we use both the fake examples and the texts written by $A$ to train the discriminator for $5$ epochs. |  Wasserstein distance | 500 |  Adam [32] | 0.0001
$C+$TRA${}_{\texttt{1h}}^{\texttt{GANtr}}$
CNN$+$GRU${}^{\texttt{LMtr}}_{\texttt{emb}}$ |  Given a text $d$ by $A$ of length $t$, we split it into overlapping sub-sentences $[d_{5},d_{6},...,d_{t-1}]$; we embed each sequence and use it as input for the generator training, and we use the embedded next word as true label. |  cosine distance (among the embedding of the CNN classifier and the dense vector from the generator) | 300 |  AdamW [37] | 0.001
CNN$+$TRA${}^{\texttt{LMtr}}_{\texttt{emb}}$
CNN$+$GRU${}^{\texttt{GANtr}}_{\texttt{emb}}$ |  At each GANtr training step, we generate the new examples and train the generator with them accordingly, then we use both the fake examples and the texts written by $A$ to train the discriminator for $5$ epochs. |  Wasserstein distance | 500 |  Adam [32] | 0.0001
CNN$+$TRA${}^{\texttt{GANtr}}_{\texttt{emb}}$
$C+$GPT${}_{\texttt{emb}}^{\texttt{LMtr}}$ |  We fine-tune the generator via the built-in fine-tuning function with the texts by $A$ as input. |  cross-entropy | 3 |  AdamW [37] | 0.00001
$C+$GPT${}_{\texttt{emb}}^{\texttt{GANtr}}$ |  We fine-tune the generator by feeding the hidden-state representation of the model to the discriminator as if coming from the embedding layer. |  Wasserstein distance | 10 |  Adam [32] | 0.0001

## References

  * Allred et al. [2020] Jordan Allred, Sadaira Packer, Gerry Dozier, Sarp Aykent, Alexicia Richardson, and Michael C. King.  Towards a human-AI hybrid for adversarial authorship.  In _2020 SoutheastCon_ , pages 1–8. IEEE, 2020.
  * Argamon and Juola [2011] Shlomo Argamon and Patrick Juola.  Overview of the international authorship identification competition at PAN-2011.  In Vivien Petras, Pamela Forner, and Paul D. Clough, editors, _Notebook papers of the 2011 conference and labs of the evaluation forum (CLEF 2011)_ , volume 1177 of _CEUR Workshop Proceedings_. CEUR-WS.org, 2011.  ISBN 978-88-904810-1-7.
  * Arjovsky et al. [2017] Martin Arjovsky, Soumith Chintala, and Léon Bottou.  Wasserstein generative adversarial networks.  In _International Conference on Machine Learning_ , pages 214–223. PMLR, 2017.
  * Bagnall [2015] Douglas Bagnall.  Author identification using multi-headed Recurrent Neural Networks.  In Linda Cappellato, Nicola Ferro, Gareth J. F. Jones, and Eric SanJuan, editors, _CLEF (Working Notes)_ , volume 1391 of _CEUR Workshop Proceedings_. CEUR-WS.org, 2015.
  * Bevendorff et al. [2019] Janek Bevendorff, Martin Potthast, Matthias Hagen, and Benno Stein.  Heuristic authorship obfuscation.  In _Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics_ , pages 1098–1108, 2019.
  * Bevendorff et al. [2020] Janek Bevendorff, Bilal Ghanem, Anastasia Giachanou, Mike Kestemont, Enrique Manjavacas, Ilia Markov, Maximilian Mayerl, Martin Potthast, Francisco M. Rangel Pardo, Paolo Rosso, Günther Specht, Efstathios Stamatatos, Benno Stein, Matti Wiegmann, and Eva Zangerle.  Overview of PAN 2020: Authorship verification, celebrity profiling, profiling fake news spreaders on Twitter, and style change detection.  In Avi Arampatzis, Evangelos Kanoulas, Theodora Tsikrika, Stefanos Vrochidis, Hideo Joho, Christina Lioma, Carsten Eickhoff, Aurélie Névéol, Linda Cappellato, and Nicola Ferro, editors, _Proceedings of the Experimental IR Meets Multilinguality, Multimodality, and Interaction - 11th International Conference of the CLEF Association, CLEF 2020, Thessaloniki, Greece, September 22-25, 2020_ , volume 12260 of _Lecture Notes in Computer Science_ , pages 372–383. Springer, 2020.
  * Bevendorff et al. [2021] Janek Bevendorff, Berta Chulvi, Gretel Liz De la Peña Sarracén, Mike Kestemont, Enrique Manjavacas, Ilia Markov, Maximilian Mayerl, Martin Potthast, Francisco Rangel, Paolo Rosso, Efstathios Stamatatos, Benno Stein, Matti Wiegmann, Magdalena Wolska, and Eva Zangerle.  Overview of PAN 2021: Authorship verification, profiling hate speech spreaders on twitter, and style change detection.  In K. Selçuk Candan, Bogdan Ionescu, Lorraine Goeuriot, Birger Larsen, Henning Müller, Alexis Joly, Maria Maistro, Florina Piroi, Guglielmo Faggioli, and Nicola Ferro, editors, _Proceedings of the Experimental IR Meets Multilinguality, Multimodality, and Interaction - 12th International Conference of the CLEF Association, CLEF 2021, Virtual Event, September 21-24, 2021_ , volume 12880 of _Lecture Notes in Computer Science_ , pages 419–431. Springer, 2021.
  * Bevendorff et al. [2023] Janek Bevendorff, Mara Chinea-Ríos, Marc Franco-Salvador, Annina Heini, Erik Körner, Krzysztof Kredens, Maximilian Mayerl, Piotr Pęzik, Martin Potthast, Francisco Rangel, et al.  Overview of PAN 2023: Authorship verification, multi-author writing style analysis, profiling cryptocurrency influencers, and trigger detection.  In _European Conference on Information Retrieval_ , pages 518–526. Springer, 2023.
  * Boenninghoff et al. [2019] Benedikt Boenninghoff, Robert M. Nickel, Steffen Zeiler, and Dorothea Kolossa.  Similarity learning for authorship verification in social media.  In _IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)_ , pages 2457–2461. IEEE, 2019.
  * Boran et al. [2020] Tudor Boran, Muhamet Martinaj, and Md Shafaeat Hossain.  Authorship identification on limited samplings.  _Computers & Security_, 97:101943, 2020.
  * Brennan et al. [2012] Michael Brennan, Sadia Afroz, and Rachel Greenstadt.  Adversarial stylometry: Circumventing authorship recognition to preserve privacy and anonymity.  _ACM Transactions on Information and System Security (TISSEC)_ , 15(3):1–22, 2012.
  * Cho et al. [2014] Kyunghyun Cho, Bart van Merriënboer, Dzmitry Bahdanau, and Yoshua Bengio.  On the properties of neural machine translation: Encoder–decoder approaches.  In _Proceedings of SSST-8, Eighth Workshop on Syntax, Semantics and Structure in Statistical Translation_ , pages 103–111, 2014.
  * Corbara and Moreo [2023] Silvia Corbara and Alejandro Moreo.  Enhancing adversarial authorship verification with data augmentation.  In _13th Italian Information Retrieval Workshop (IIR2023)_ , pages 73–78, 2023.
  * Corbara et al. [2019] Silvia Corbara, Alejandro Moreo, Fabrizio Sebastiani, and Mirko Tavoni.  The Epistle to Cangrande through the lens of computational authorship verification.  In _Proceedings of the 1st International Workshop on Pattern Recognition for Cultural Heritage (PatReCH 2019)_ , pages 148–158, Trento, IT, 2019.  doi: 10.1007/978-3-030-30754-7_15.
  * Donahue and Rumshisky [2018] David Donahue and Anna Rumshisky.  Adversarial text generation without reinforcement learning.  _arXiv preprint arXiv:1810.06640_ , 2018.
  * Ezen-Can [2020] Aysu Ezen-Can.  A comparison of LSTM and BERT for small corpus.  _arXiv e-prints_ , pages arXiv–2009, 2020.
  * Fagni et al. [2021] Tiziano Fagni, Fabrizio Falchi, Margherita Gambini, Antonio Martella, and Maurizio Tesconi.  TweepFake: About detecting deepfake tweets.  _Plos one_ , 16(5), 2021.
  * Faust et al. [2017] Christina Faust, Gerry Dozier, Jinsheng Xu, and Michael C. King.  Adversarial authorship, interactive evolutionary hill-climbing, and AuthorCAAT-III.  In _2017 IEEE Symposium Series on Computational Intelligence (SSCI)_ , pages 1–8. IEEE, 2017.
  * Goodfellow et al. [2014] Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio.  Generative adversarial nets.  _Advances in Neural Information Processing Systems_ , 27, 2014.
  * Goodfellow et al. [2014] Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy.  Explaining and harnessing adversarial examples.  _arXiv e-prints_ , art. arXiv:1412.6572, December 2014.
  * Gulrajani et al. [2017] Ishaan Gulrajani, Faruk Ahmed, Martin Arjovsky, Vincent Dumoulin, and Aaron C. Courville.  Improved training of Wasserstein GANs.  _Advances in Neural Information Processing Systems_ , 30, 2017.
  * Gungor [2018] Abdulmecit Gungor.  _Benchmarking Authorship Attribution Techniques Using Over a Thousand Books by Fifty Victorian Era Novelists_.  PhD thesis, Purdue University, 2018.
  * Hatua et al. [2021] Amartya Hatua, Arjun Mukherjee Mukherjee, and Rakesh Verma.  On the feasibility of using GANs for claim verification-experiments and analysis.  In _Proceedings of the 2021 Workshop on Reducing Online Misinformation Through Credible Information Retrieval_ , 2021.
  * Hu et al. [2022] Zhiqiang Hu, Roy Ka-Wei Lee, Charu C. Aggarwal, and Aston Zhang.  Text Style Transfer: A review and experimental evaluation.  _ACM SIGKDD Explorations Newsletter_ , 24(1):14–45, 2022.
  * Joachims [1998] Thorsten Joachims.  Text categorization with support vector machines: Learning with many relevant features.  In _Proceedings of the 10th European Conference on Machine Learning (ECML 1998)_ , pages 137–142, Chemnitz, DE, 1998.  doi: 10.1007/bfb0026683.
  * Jones et al. [2022] Keenan Jones, Jason R. C. Nurse, and Shujun Li.  Are you Robert or RoBERTa? Deceiving online authorship attribution models using neural text generators.  In _Proceedings of the International AAAI Conference on Web and Social Media_ , volume 16, pages 429–440, 2022.
  * Juola [2006] Patrick Juola.  Authorship attribution.  _Foundations and Trends in Information Retrieval_ , 1(3):233–334, 2006.
  * Karras et al. [2019] Tero Karras, Samuli Laine, and Timo Aila.  A style-based generator architecture for generative adversarial networks.  In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , pages 4401–4410, 2019.
  * Kestemont [2014] Mike Kestemont.  Function words in authorship attribution. From black magic to theory?  In _Proceedings of the 3rd Workshop on Computational Linguistics for Literature (CLFL)_ , pages 59–66. ACL, 2014.
  * Kestemont et al. [2018] Mike Kestemont, Michael Tschuggnall, Efstathios Stamatatos, Walter Daelemans, Günther Specht, Benno Stein, and Martin Potthast.  Overview of the author identification task at PAN-2018: Cross-domain authorship attribution and style change detection.  In Linda Cappellato, Nicola Ferro, Jian-Yun Nie, and Laure Soulier, editors, _CLEF (Working Notes)_ , volume 2125 of _CEUR Workshop Proceedings_. CEUR-WS.org, 2018.
  * Kestemont et al. [2019] Mike Kestemont, Efstathios Stamatatos, Enrique Manjavacas, Walter Daelemans, Martin Potthast, and Benno Stein.  Overview of the cross-domain authorship attribution task at PAN 2019.  In Linda Cappellato, Nicola Ferro, David E. Losada, and Henning Müller, editors, _CLEF (Working Notes)_ , volume 2380 of _CEUR Workshop Proceedings_. CEUR-WS.org, 2019.
  * Kingma and Ba [2014] Diederik P. Kingma and Jimmy Ba.  Adam: A method for stochastic optimization.  _arXiv preprint arXiv:1412.6980_ , 2014.
  * Kobayashi [2018] Sosuke Kobayashi.  Contextual augmentation: Data augmentation by words with paradigmatic relations.  In _Proceedings of the 2018 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies_ , volume 2, pages 452–457. ACL, 2018.  doi: 10.18653/v1/N18-2072.  URL https://aclanthology.org/N18-2072.
  * Koppel and Winter [2014] Moshe Koppel and Yaron Winter.  Determining if two documents are written by the same author.  _Journal of the Association for Information Science and Technology_ , 65(1):178–187, 2014.
  * Koppel et al. [2007] Moshe Koppel, Jonathan Schler, and Elisheva Bonchek-Dokow.  Measuring differentiability: Unmasking pseudonymous authors.  _Journal of Machine Learning Research_ , 8(6):1261–1276, 2007.
  * Kusner and Hernández-Lobato [2016] Matt J. Kusner and José Miguel Hernández-Lobato.  GANs for sequences of discrete elements with the Gumbel-softmax distribution.  _arXiv e-prints_ , pages arXiv–1611, 2016.
  * Loshchilov and Hutter [2018] Ilya Loshchilov and Frank Hutter.  Decoupled weight decay regularization.  In _International Conference on Learning Representations_ , 2018.
  * McCarthy and O’Sullivan [2021] Rachel McCarthy and James O’Sullivan.  Who wrote Wuthering Heights?  _Digital Scholarship in the Humanities_ , 36(2):383–391, 2021.
  * McNemar [1947] Quinn McNemar.  Note on the sampling error of the difference between correlated proportions or percentages.  _Psychometrika_ , 12(2):153–157, 1947.
  * Mendenhall [1887] Thomas Corwin Mendenhall.  The characteristic curves of composition.  _Science_ , 9(214):237–249, 1887.
  * Nini [2018] Andrea Nini.  An authorship analysis of the Jack the Ripper letters.  _Digital Scholarship in the Humanities_ , 33(3):621–636, 2018.
  * Paszke et al. [2019] Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, Alban Desmaison, Andreas Kopf, Edward Yang, Zachary DeVito, Martin Raison, Alykhan Tejani, Sasank Chilamkurthy, Benoit Steiner, Lu Fang, Junjie Bai, and Soumith Chintala.  Pytorch: An imperative style, high-performance deep learning library.  In H. Wallach, H. Larochelle, A. Beygelzimer, F. d'Alché-Buc, E. Fox, and R. Garnett, editors, _Advances in Neural Information Processing Systems 32_ , pages 8024–8035. Curran Associates, Inc., 2019.  URL http://papers.neurips.cc/paper/9015-pytorch-an-imperative-style-high-performance-deep-learning-library.pdf.
  * Pedregosa et al. [2011] F. Pedregosa, G. Varoquaux, A. Gramfort, V. Michel, B. Thirion, O. Grisel, M. Blondel, P. Prettenhofer, R. Weiss, V. Dubourg, J. Vanderplas, A. Passos, D. Cournapeau, M. Brucher, M. Perrot, and E. Duchesnay.  Scikit-learn: Machine learning in Python.  _Journal of Machine Learning Research_ , 12:2825–2830, 2011.
  * Potthast et al. [2016] Martin Potthast, Matthias Hagen, and Benno Stein.  Author obfuscation: Attacking the state of the art in authorship verification.  _CLEF (Working Notes)_ , pages 716–749, 2016.
  * Radford et al. [2019] Alec Radford, Jeff Wu, Rewon Child, David Luan, Dario Amodei, and Ilya Sutskever.  Language models are unsupervised multitask learners.  _OpenAI blog_ , 1(8):9, 2019.
  * Riddell et al. [2021] Allen Riddell, Haining Wang, and Patrick Juola.  A call for clarity in contemporary authorship attribution evaluation.  In _Proceedings of the International Conference on Recent Advances in Natural Language Processing (RANLP 2021)_ , pages 1174–1179, 2021.
  * Salminen et al. [2022] Joni Salminen, Chandrashekhar Kandpal, Ahmed Mohamed Kamel, Soon-gyo Jung, and Bernard J. Jansen.  Creating and detecting fake reviews of online products.  _Journal of Retailing and Consumer Services_ , 64, 2022.
  * Sanh et al. [2019] Victor Sanh, Lysandre Debut, Julien Chaumond, and Thomas Wolf.  DistilBERT, a distilled version of BERT: Smaller, faster, cheaper and lighter.  In _NeurIPS EMC 2 Workshop_, 2019.
  * Savoy [2019] Jacques Savoy.  Authorship of Pauline epistles revisited.  _Journal of the Association for Information Science and Technology_ , 70(10):1089–1097, 2019.
  * Sebastiani [2015] Fabrizio Sebastiani.  An axiomatically derived measure for the evaluation of classification algorithms.  In _Proceedings of the 2015 International Conference on the Theory of Information Retrieval_ , pages 11–20, 2015.
  * Stamatatos [2016] Efstathios Stamatatos.  Authorship verification: A review of recent advances.  _Research in Computing Science_ , 123:9–25, 2016.
  * Stamatatos et al. [2015] Efstathios Stamatatos, Walter Daelemans, Ben Verhoeven, Patrick Juola, Aurelio López-López, Martin Potthast, and Benno Stein.  Overview of the author identification task at pan 2015.  In Linda Cappellato, Nicola Ferro, Gareth J. F. Jones, and Eric SanJuan, editors, _CLEF (Working Notes)_ , volume 1391 of _CEUR Workshop Proceedings_. CEUR-WS.org, 2015.
  * Stamatatos et al. [2022] Efstathios Stamatatos, Mike Kestemont, Krzysztof Kredens, Piotr Pezik, Annina Heini, Janek Bevendorff, Benno Stein, and Martin Potthast.  Overview of the authorship verification task at PAN 2022.  In _CEUR workshop proceedings_ , volume 3180, pages 2301–2313, 2022.
  * Stein et al. [2008] Benno Stein, Nedim Lipka, and Sven Meyer zu Eissen.  Meta analysis within authorship verification.  In _19th International Workshop on Database and Expert Systems Applications_ , pages 34–39. IEEE, 2008.
  * Theophilo et al. [2021] Antonio Theophilo, Romain Giot, and Anderson Rocha.  Authorship attribution of social media messages.  _IEEE Transactions on Computational Social Systems_ , 2021.
  * Tuccinardi [2017] Enrico Tuccinardi.  An application of a profile-based method for authorship verification: Investigating the authenticity of Pliny the Younger’s letter to Trajan concerning the Christians.  _Digital Scholarship in the Humanities_ , 32(2):435–447, 2017.
  * Uchendu et al. [2020] Adaku Uchendu, Thai Le, Kai Shu, and Dongwon Lee.  Authorship attribution for neural text generation.  In _Conference on Empirical Methods in Natural Language Processing 2020 (EMNLP)_ , pages 8384–8395. ACL, 2020.
  * Vainio et al. [2019] Raija Vainio, Reima Välimäki, Anni Hella, Marjo Kaartinen, Teemu Immonen, Aleksi Vesanto, and Filip Ginter.  Reconsidering authorship in the Ciceronian corpus through computational authorship attribution.  _Ciceroniana On Line_ , 3(1), 2019.
  * Vaswani et al. [2017] Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N. Gomez, Łukasz Kaiser, and Illia Polosukhin.  Attention is all you need.  In I. Guyon, U. V. Luxburg, S. Bengio, H. Wallach, R. Fergus, S. Vishwanathan, and R. Garnett, editors, _Advances in Neural Information Processing Systems 30_ , pages 5998––6008. Curran Associates, Inc., 2017.  URL https://papers.nips.cc/paper/7181-attention-is-all-you-need.
  * Young et al. [2018] Tom Young, Devamanyu Hazarika, Soujanya Poria, and Erik Cambria.  Recent trends in Deep Learning based Natural Language Processing.  _IEEE Computational Intelligence Magazine_ , 13(3):55–75, 2018.
  * Yu et al. [2017] Lantao Yu, Weinan Zhang, Jun Wang, and Yong Yu.  SeqGAN: Sequence generative adversarial nets with policy gradient.  In _Proceedings of the AAAI Conference on Artificial Intelligence_ , volume 31, 2017.
  * Zhai et al. [2022] Wanyue Zhai, Jonathan Rusert, Zubair Shafiq, and Padmini Srinivasan.  A girl has a name, and it’s… adversarial authorship attribution for deobfuscation.  _arXiv preprint arXiv:2203.11849_ , 2022.
  * Zhang et al. [2015] Xiang Zhang, Junbo Zhao, and Yann LeCun.  Character-level convolutional networks for text classification.  In _Proceedings of the 28th International Conference on Neural Information Processing Systems_ , volume 1 of _NIPS’15_ , pages 649–657, Cambridge, MA, USA, 2015. MIT Press.
  * Zhang et al. [2017] Yizhe Zhang, Zhe Gan, Kai Fan, Zhi Chen, Ricardo Henao, Dinghan Shen, and Lawrence Carin.  Adversarial feature matching for text generation.  In _International Conference on Machine Learning_ , pages 4006–4015. PMLR, 2017.
  * Zheng et al. [2006] Rong Zheng, Jiexun Li, Hsinchun Chen, and Zan Huang.  A framework for authorship identification of online messages: Writing-style features and classification techniques.  _Journal of the American society for information science and technology_ , 57(3):378–393, 2006.