#  PlagBench: Exploring the Duality of Large Language Models in Plagiarism
Generation and Detection

Jooyoung Lee1 Toshini Agrawal2 Adaku Uchendu3
Thai Le4 Jinghui Chen1 Dongwon Lee1
1 The Pennsylvania State University, University Park, PA, USA, {jfl5838,
jzc5917<EMAIL_ADDRESS>
2 Vellore Institute of Technology, Bhopal, India<EMAIL_ADDRESS>
3 MIT Lincoln Laboratory, Lexington, MA, USA<EMAIL_ADDRESS>
4 Indiana University, Bloomington, IN, USA<EMAIL_ADDRESS>

###### Abstract

Recent literature has highlighted potential risks to academic integrity
associated with large language models (LLMs), as they can memorize parts of
training instances and reproduce them in the generated texts _without proper
attribution_. In addition, given their capabilities in generating high-quality
texts, plagiarists can exploit LLMs to generate realistic paraphrases or
summaries indistinguishable from original work. In response to possible
malicious use of LLMs in plagiarism, we introduce PlagBench, a comprehensive
dataset consisting of 46.5K synthetic plagiarism cases generated using three
instruction-tuned LLMs across three writing domains. The quality of PlagBench
is ensured through fine-grained automatic evaluation for each type of
plagiarism, complemented by human annotation. We then leverage our proposed
dataset to evaluate the plagiarism detection performance of five modern LLMs
and three specialized plagiarism checkers. Our findings reveal that GPT-3.5
tends to generates paraphrases and summaries of higher quality compared to
Llama2 and GPT-4. Despite LLMs’ weak performance in summary plagiarism
identification, they can surpass current commercial plagiarism detectors.
Overall, our results highlight the potential of LLMs to serve as robust
plagiarism detection tools.

PlagBench: Exploring the Duality of Large Language Models in Plagiarism
Generation and Detection

Jooyoung Lee1 Toshini Agrawal2 Adaku Uchendu3 Thai Le4 Jinghui Chen1 Dongwon
Lee1 1 The Pennsylvania State University, University Park, PA, USA, {jfl5838,
jzc5917<EMAIL_ADDRESS>2 Vellore Institute of Technology, Bhopal, India,
<EMAIL_ADDRESS>3 MIT Lincoln Laboratory, Lexington, MA, USA,
<EMAIL_ADDRESS>4 Indiana University, Bloomington, IN, USA,
<EMAIL_ADDRESS>

##  1 Introduction

Growing popularity of large language models (LLMs) has dramatically shifted
the way users craft their writings. With one button click, LLMs such as
OpenAI’s ChatGPT111https://chatgpt.com and Google’s Gemini Team et al. (2023)
can deliver high-quality texts per users’ requests. For instance, users can
ask LLMs to generate a whole story or revise a draft writing. While an
impressive ability, it is important to underscore that LLMs’ increasing
applications in various writing tasks is accompanied by substantial risks to
privacy, intellectual property (IP), academic integrity, and social ethics.
Many recent papers (e.g., Carlini et al. (2021); Tirumala et al. (2022); Zhang
et al. (2023); Carlini et al. (2023)) revealed that LLMs can memorize
information from training data without overfitting, including sensitive
information, and reproduce it during inference. Not limited to verbatim
copies, they may emit paraphrased or elongated versions of training data Lee
et al. (2023b). The observed behavior is problematic because: (1) LLMs are
generally trained on vast amounts of text documents without considering how
the content was originally released or whether it is copyrighted Brown et al.
(2022); Henderson et al. (2023), and (2) LLMs are not currently equipped with
the ability to accurately credit the original source of information as humans
do McGowan et al. (2023); Huang and Chang (2023). Hence, if we compare these
violations to human actions, they can be viewed as plagiarism—the act of
employing another person’s work or ideas without proper attribution.

Figure 1: The overview of PlagBench construction processes and proposed RQs.
Blue and red arrows denote the flow of RQ1 and RQ2, respectively.

To address plagiarism in LLMs, it is critical to improve automatic plagiarism
detectors. Current detectors are typically trained on data related to human-
authored plagiarism, while machine-generated plagiarism may exhibit
significant differences Becker et al. (2023). Khalil and Er (2023) show that
ChatGPT outputs were prone to bypass popular plagiarism check software Khalil
and Er (2023). Automatic plagiarism detection task is also essential in a
context where bad actors purposely utilize LLMs to obfuscate original content
with paraphrases or summaries and evade existing detectors. For instance,
Krishna et al. (2024); Sadasivan et al. (2023); Weber-Wulff et al. (2023) find
that a simple paraphrase of machine-written text can fool widely used AI-
generated content and plagiarism detectors. These results shed light on the
urgent necessity of developing more reliable, robust, and universal plagiarism
detectors.

To enable the development of modern LLM-aware plagiarism detectors, we posit
that the curation of high-quality, large-scale, type-varying plagiarism
datasets is necessary. Although there exist a few plagiarism detection corpora
(e.g., Potthast et al. (2013); Wahle et al. (2021a)), they are not
comprehensive and up-to-date to adequately reflect the rapidly evolving
writing patterns influenced by LLMs. In this work, therefore, we first develop
the PlagBench corpus, which consists of 46.5K text pairs covering three types
of LLM-aware plagiarism (i.e., verbatim, paraphrase, and summary cases) in
three writing domains (i.e., abstract of scholarly paper, story, news
article). In the context of PlagBench, we investigate two research questions:
(RQ1) how well can LLMs generate paraphrase and summary plagiarism of given
texts? and (RQ2) how well can LLMs detect three types of plagiarism? Figure 1
illustrates PlagBench creation processes, as well as our research questions.
Specifically, we use three state-of-the-art (SOTA) chat-based LLMs,
Llama2-70b-chat Touvron et al. (2023), GPT-3.5
Turbo222https://platform.openai.com/docs/models/gpt-3-5-turbo, and GPT-4 Turbo
Achiam et al. (2023)) for PlagBench construction. Llama2-70b-chat,
Llama3-70b-instruct,333https://ai.meta.com/blog/meta-llama-3/ Mixtral-8x7B
Jiang et al. (2024), GPT-3.5 Turbo, and GPT-4 Turbo are then used for the
detection task.444At the time of data generation, Llama3 models have not been
released, and thus it was only employed in the detection process.
Additionally, GPT-4o is excluded from both generation and detection tasks
because it was unavailable during the time of the experiments.

Key findings of our experiments are as follows: (1) Among the three LLMs,
GPT-3.5 Turbo produces the highest quality paraphrases and summaries, (2) LLMs
like Llama3 and GPT-4, with just prompting, can outperform existing plagiarism
checkers that are specifically trained for the task, and (3) LLMs generally
have difficulty distinguishing summary plagiarism.

##  2 Related Work

###  2.1 Plagiarism Detection Corpus

The Microsoft Research Paraphrase Corpus (MRPC) Dolan and Brockett (2005) and
PAWS Zhang et al. (2019b) are among the most renowned datasets for paraphrase
identification. Yet, they are not suitable for plagiarism detection tasks
because it only covers one type. Additionally, their samples are annotated at
the sentence level, which limits their applicability in real-world scenarios
where plagiarism in general occurs at the paragraph level. More recently,
Wahle et al. (2021b) constructed a paragraph long machine-paraphrased
plagiarism dataset using three neural language models such as BERT, RoBERTa,
and Longformer. Following, the authors replaced these three models with more
recently released LLMs, GPT-3, and T5, and produce machine-paraphrased texts
Wahle et al. (2022). There are many independent machine-summarized text pairs
(e.g., Cohan et al. (2018); Narayan et al. (2018)) as well, but there exists
no comprehensive dataset covering both paraphrases and summaries generated by
modern LLMs.

Potthast et al. (2013) introduced a novel plagiarism detection dataset with
five obfuscation strategies: no obfuscation, random obfuscation, translation
obfuscation, and summary obfuscation. These strategies utilized tools like
Google Translate and text summarizers to mimic plagiarist behaviors. To the
best of our knowledge, this is the first and only plagiarism detection dataset
covering a wide range of plagiarism types. However, this dataset has not been
updated since 2013.

###  2.2 Automatic Plagiarism Detection

There are two different formats of the automated plagiarism detection task:
intrinsic and extrinsic plagiarism detection. While intrinsic plagiarism
detection analyzes the document itself without resorting to the reference
document, extrinsic plagiarism detection involves directly comparing the
suspicious document against the reference to detect plagiarism instances
Alzahrani et al. (2011). Intrinsic approaches use patterns such as linguistic
differences within a document which indicates multiple authorship to detect
plagiarism Gipp and Gipp (2014); Xiong et al. (2024); Potthast et al. (2010);
Song et al. (2024); Stein et al. (2011). Due to high complexity of intrinsic
plagiarism task, a majority of literature and software tools follow extrinsic
plagiarism detection strategy. The extrinsic plagiarism detection task is
generally divided into two subtasks: source retrieval (i.e., finding the most
plausible pair of the source and the suspicious document) and plagiarism
identification (i.e., classifying whether two documents are plagiarizing each
other or not). Extrinsic approaches rely on similarity scores of two non-zero
vectors transformed from the document pairs and apply certain thresholds Vani
and Gupta (2017); Sağlam et al. (2024b); Potthast et al. (2010); Sağlam et al.
(2024a); Lee et al. (2023a); Moravvej et al. (2023); Avetisyan et al. (2023).
Our focus lies in the latter scope. We assume that we already have a text
pair, the source document and the suspicious document obtained through
PlagBench, and we concentrate on plagiarism identification.

##  3 Description of Automatic Plagiarism Detection

Suppose we have a source document $D_{src}$ and a suspicious document
$D_{susp}$ that potentially plagiarizes $D_{src}$. Following the plagiarism
detection task proposed by PAN,555https://pan.webis.de we study three branches
of plagiarism: verbatim, paraphrase, and summary. Verbatim plagiarism occurs
when exact copies of words or phrases from $D_{src}$ are found in $D_{susp}$
without quotation marks. Paraphrase plagiarism, on the other hand, is when
$D_{susp}$ rephrases $D_{src}$ using different words but retain the same
meaning and structure without providing a citation. Synonymous substitution,
word reordering and insertion/deletion are common paraphrasing techniques used
by plagiarists Alvi et al. (2021). While both verbatim and paraphrase
plagiarism cases tend to maintain the same length and the structure as the
original text, summary plagiarism plagiarism involves succinctly summarizing
$D_{src}$ to reuse its key points or ideas. As summaries leave out unnecessary
information, they are prone to be significantly shorter than $D_{src}$. Unlike
verbatim plagiarism, which can be effectively captured using simple string
matching algorithms, paraphrase and summary plagiarism are more challenging to
identify due to their limited lexical and syntactic similarities to the
original text. Specifically, these two categories require careful attention to
the meaning and context of the content rather than just high-level vocabulary
overlaps.

##  4 PlagBench Creation

###  4.1 PlagBench Corpus Construction

Instruction tuning is a core training mechanism crucial for assisting LLMs in
responding to human instructions. Once LLMs are pretrained with the objective
of predicting subsequent words within large corpora, LLMs then undergo
additional fine-tuning stage using diverse instruction datasets consisting of
formatted instruction pairs. Instruction-tuned LLMs have demonstrated the
ability to generalize to unseen instructions Raffel et al. (2020); Wei et al.
(2021). Motivated by this, we leverage three prominent instruction-tuned LLMs,
Llama2-70b-chat, GPT-3.5 Turbo, and GPT-4 Turbo, to create the PlagBench
corpus. Our experiment design is as follows: given one source document
$D_{src}$, three independent LLMs are prompted to rewrite it according to our
description. We then consider their outputs as $D_{susp}$. Specifics of source
document collection and suspicious document generation are described below.

####  4.1.1 Source Document Collection

Although plagiarism can occur in any type of writing, we target specific areas
such as scholarly or creative works, where originality and intellectual
property are highly valued. Li et al. (2023) present a collection of human-
authored and machine-authored corpora from diverse writing tasks. Among their
selections of corpora, we carefully choose three public English datasets: (1)
SciXGen Chen et al. (2021) consisting of 200K+ abstracts of scientific
articles (for scientific writing), (2) ROCStories Mostafazadeh et al. (2016)
consisting of 50k five-sentence commonsense stories (for story writing); and
(3) TLDR666https://huggingface.co/datasets/JulesBelveze/tldr_news consisting
of 7K+ TLDR tech newsletters (for news article writing). Their samples contain
one human-written text and multiple machine-generated variations, all sharing
either the same topic or text source as the human-written piece. For the
purpose of the study, we only use the human-written text containing at least 5
sentences as the source text.777According to our pilot experiment, paraphrases
and summaries generated based on documents shorter than 5 sentences tend to
too similar to distinguish even from human lens. We randomly select 2,400
samples from SciXGen and ROCStories corpora and 1,300 from TLDR for suspicious
document generation. The sample size of TLDR is smaller than the other two
datasets because content of TLDR tends to be short.

####  4.1.2 Suspicious Document Generation

Instruction-tuned LLMs have demonstrated strong abilities on text rephrasing
Lingard (2023); Zhang et al. (2024); Tang et al. (2023). Hence, we employ
Llama2-70b-chat, GPT-3.5 Turbo, and GPT-4 Turbo models to generate texts
corresponding to two plagiarism labels (i.e., paraphrase and summary
plagiarism) respectively. We do not use these models for verbatim plagiarism,
as generating suspicious documents can be easily accomplished by simple copy-
and-paste without any modification. Table 4 shows our hand-crafted prompt
templates, each tailored to transform a single source document according to
the provided task descriptions. As opposed to our expectations, our pilot
experiment hints that some models, especially the Llama models, have
difficulties in providing correct paraphrases or summaries on the fly. Thus,
following findings that in-context learning is very effective in enabling LLMs
to perform a new task without additional training Liu et al. (2021); Min et
al. (2022), we provide three demonstrations, one from each writing domains,
inside the prompt.

In plagiarism-free scenarios, existing datasets (e.g., Potthast et al. (2013),
Foltỳnek et al. (2020)) paired random or dissimilar documents. However, this
often results in pairs that are clearly different and thus easily
identifiable. More challenging pairs are likely to occur when two documents
share the same key topics and domain type, but their details do not overlap.
Consequently, we instruct LLMs to write continuations based on provided
keywords, domain information, and the first two sentences of the source
document. Two meaningful keywords are automatically extracted using
KeyBERT,888https://maartengr.github.io/KeyBERT/index.html a package leveraging
contextual embeddings from BERT Devlin et al. (2019) to generate keyphrases
resembling the provided document. We do not perform in-context learning for
plagiarism-free case generation because LLMs, originally trained for next
token prediction, handled the task well without needing demonstrations.

We have in total 6,100 source documents across three writing domains from
§4.1.1. Using three LLMs, we create three corresponding paraphrase, summary,
and plagiarism-free documents per sample. For GPT-4, due to its relatively
high API cost999Llama2 families are free open-source models while GPT-3.5
turbo and GPT-4 Turbo charge $3.00 and $40.00 per 1M tokens respectively., we
only utilize a subset (n=3,300) of source documents for generation. We use the
version of gpt-3.5-turbo-1106 and gpt-4-1106-preview and apply temperature
sampling (t = 0.9) for the generation configuration. As a result, the total
number of generated suspicious documents is 46,500, a summation of 6,100
generations for SciXGen, 6,100 generations for ROCStories, and 3,300
generations for TLDR, multiplied by 3 plagiarism types.

###  4.2 PlagBench Quality Assurance

LLMs can occasionally fail to be faithful to the instruction and hallucinate
Ji et al. (2023). For instance, when users instruct the LLM to paraphrase the
given text, its output may contain sentences that are not properly paraphrased
or are irrelevant to the original content. These hallucinated generations lead
to an increase in false positives within PlagBench. To ensure the quality of
our proposed dataset, we design detailed evaluation criteria and undergo
rigorous filtering steps through both automatic and human evaluation.
Automatic measures are intended to identify clearly incorrect cases, while
human annotators can further refine the process by catching more complex
errors that the automated methods might have overlooked. Table 2 describes 7
evaluation metrics used for paraphrase and summary plagiarism evaluation.
These metrics are grounded on prior works studying evaluation methods for
paraphrases Chen et al. (2020); Chen and Dolan (2011) or summaries Fabbri et
al. (2021). For non-plagiarized cases, we use the same metrics; however,
unlike in paraphrase and summary plagiarism, the suspicious documents should
not satisfy any of them. We elaborate on how we assess the established metrics
both automatically and manually in the following sections.

####  4.2.1 Assurance via Automatic Evaluation

As opposed to human evaluation, which is accurate but time-consuming,
automatic measurement enables us to quickly and efficiently examine large
volumes of data. Here we annotate all generated examples from paraphrase and
summary plagiarism. Note that we do not perform automatic evaluation for non-
plagiarism cases because it would overlap with our benchmark task and
necessitate the use of the same plagiarism detectors we aim to evaluate. The
evaluation process should take into account two pieces of text, one source
document from §4.1.1 and one suspicious document from §4.1.2, and then assign
numerical scores for corresponding aspects from Table 2 from one by one.

There has been continuous efforts in developing automated text quality
estimation strategies. Among several existing metrics, we carefully choose a
single representative metric for every aspect. For example, we use BERTScore
Zhang et al. (2019a), one of the most common metrics for measuring semantic
equivalence. It retrieves the token-level embedding using BERT and computes
the summation of cosine similarities. It is shown to be more robust for
paraphrase classification than other conventional metrics like BLEU Papineni
et al. (2002) and METEOR Banerjee and Lavie (2005). For consistency
measurement, we use AlignScore Zha et al. (2023) in which the authors train a
information alignment model on 7 well-established tasks that include
paraphrasing and summarization. The model returns a binary classification
result (aligned v.s. not aligned). For language quality, we leverage the
automated readability index Senter and Smith (1967) for fluency measurement
and CoLAScore Zhu and Bhat (2020) for grammaticality, respectively.

Now we turn our attention to automatic summary evaluation. In the absence of
gold-standard summaries for comparison with LLM-generated summaries, we rely
on reference-free metrics. Relevance is then measured by BLANC Vasilyev et al.
(2020), a novel approach that calculate the usefulness of a summary in helping
BERT for language understanding task. This metric is ranked the highest in
relevance alignment according to the Summeval benchmark Fabbri et al. (2021).
For coherence measurement, we employ BARTScore Yuan et al. (2021), a
comprehensive evaluation metric using a pre-trained sequence-to-sequence
(seq2seq) model BART Lewis et al. (2020). We use the same models from
paraphrase evaluation regarding consistency and language quality.

Most metrics, except for CoLAScore, provide continuous values, requiring
threshold selection for filtering. The primary goal of automated evaluation is
to eliminate obviously inaccurate pairs. Thus, we shuffle the order of
suspicious document rows while keeping the source document order intact and
create invalid pairs as a means of establishing a loose cut-off point. Refer
to Appendix A.1 for experiment configurations and the threshold setup. We then
exclude samples from a final set if the text pair does not satisfy all 3 or 4
aspects, depending on the plagiarism category. Lastly, to ensure that their
generations do not overlap with verbatim plagiarism, we also compute the
Levenshtein distance Miller et al. (2009) between two texts and remove near-
duplicates. Among 31,000 (15,500 per plagiarism type) suspicious documents,
12,071 samples for paraphrase plagiarism and 13,445 samples for summary
plagiarism remain intact. The document percentage breakdown per plagiarism
type and domain type after automatic filtering is illustrated in Table 3.

Figure 2: Mean paraphrase evaluation aspect scores w.r.t. domain and model
types (automatic evaluation) Figure 3: Mean summary evaluation aspect scores
w.r.t. domain and model types (automatic evaluation)

####  4.2.2 Assurance via Human Evaluation

Human annotation plays a critical role in verifying the accuracy and
reliability of automated systems. We use Amazon Mechanical Turk (AMT) to hire
human annotators for three separate annotation tasks: non-plagiarism
evaluation, paraphrase evaluation, and summary evaluation. See Appendix A.2
for more details on the experiment design. Due to limited budgets, we perform
manual annotation on 459 batches (i.e., 1,377 samples) for no plagiarism, 393
batches (i.e., 1,251 samples) for paraphrase plagiarism, and 417 batches
(i.e., 1,251 samples) for summary plagiarism cases that are randomly sampled
from §4.2.1. For data filtering, we follow the same evaluation criteria from
our automated framework; if any of the evaluation aspects are flagged, we omit
the particular samples. Among 3,879 documents, 1,358 samples from the non-
plagiarism type, 1,014 from paraphrase, and 1,078 from summary plagiarism are
deemed valid from a human perspective. In essence, nearly 89% of samples from
automatic evaluation are considered reliable, suggesting a strong alignment
between our automatic evaluation pipeline and human assessments.

Figure 4: Binary plagiarism detection (no plagiarism vs. plagiarism)
performance of 5 LLMs w.r.t. prompt types. Dotted lines represent the
performance of non-LLM based detectors.

##  5 Experimental Results and Discussion

###  5.1 RQ1. how well can LLMs generate paraphrase and summary plagiarism?

Since PlagBench is accompanied by both automatic and manual quality evaluation
scores, we leverage them to conduct in-depth analyses on linguistic
characteristics of paraphrases and summaries generated by three LLMs,
Llama2-70b-chat, GPT-3.5 Turbo, and GPT-4 Turbo. To better understand natural
phenomenon generated paraphrases and summaries before applying any filtering
criteria, we solely rely on automated evaluation results. For paraphrases, we
assess semantic equivalence, consistency, and language quality, while for
summaries, we evaluate relevance, coherence, consistency, and language
quality. Due to a large sample size, we randomly sample 1,000 subsets per
writing domain in which each set contains on source document and three
machine-rephrased versions and compare the mean of automatic evaluation
scores.

Automatic Paraphrase Evaluation. Figure 2 shows mean evaluation scores with
respect to types of models and writing domains in paraphrase generation. We
exclude the gramaticality analyses since the majority of LLM-reworded texts
are grammatically correct. models The results indicate that Llama2-70b-chat
achieves significantly lower performance in BERTScore and Alignscore compared
to both GPT-3.5 Turbo and GPT-4 Turbo. The observed pattern persists across
three writing domains. Particularly, Llama2-70b-chat suffers from generating
factually consistent paraphrases for short stories (ROCStories). This finding
is consistent with existing literature Mishra et al. (2024); Dahl et al.
(2024) highlighting the vulnerability of Llama2 in hallucination. Within the
scope of semantic equivalence and consistency metrics, GPT-3.5 Turbo achieves
the highest score, even occasionally better than GPT-4 Turbo. Analyses on
readability score101010We use the automated readability index to measure
readability. A higher readability index hints that the text is more complex
and may necessitate a higher level of education or reading proficiency to
comprehend. gaps between the human-written source text and the machine-
generated suspicious text suggest that all three models significantly
complicate ROCStories during rephrasing. In regards to SciXGen and TLDR, GPT
models tend to produce more sophisticated texts, whereas Llama2-70b-chat often
degrades linguistic quality. Substantial readability gaps, especially in the
GPT-4 version, are somewhat anticipated, as Onder et al. (2024); Momenaei et
al. (2023) have noted that ChatGPT’s outputs can be challenging to understand,
often demanding a college-level proficiency in linguistic skills.

Automatic Summary Evaluation. Summary evaluation results are illustrated in
Figure 3. Regardless of writing domain categories, GPT-3.5 Turbo is ranked the
lowest in BARTScore, followed by Llama2-70b-chat and and then GPT-4 Turbo. The
lower the BARTScore the more coherent given a pair of the source document and
the machine-summarized document. There is no noticeable differences between
three models regarding the Alignscore, suggesting that they excel at producing
factually consistent summaries. Still, GPT3-3.5 Turbo outperforms both models
in the domains for SciXGen and TLDR. Also, BLANC scores are shown to be the
highest for GPT-4 Turbo while GPT-4 Turbo was ranked the lowest. The higher
BLANC score is the more relevant and useful the given summary is. As opposed
to paraphrase analyses which take into account the difference between two
pieces of text, here we only compute the readability index scores of LLM-
generated summaries. This is because we do not have reference summaries to
compare against. Consistent with paraphrase generation, GPT-4 Turbo tends to
produce summaries with higher readability scores in comparison to
Llama2-70b-chat and GPT-3.5 Turbo. Interestingly, summaries generated by
Llama2-70b-chat are associated with higher readability scores than GPT-3.5
Turbo. Based on thes findings, we conclude that GPT-3.5 Turbo is generally the
best paraphraser and summarizer in terms of all aspects, except for
fluency/readability. Also, while Llama2-70b-chat is ranked the worst model for
paraphrasing task, GPT-4 Turbo suffers the most for providing high-quality
summaries.

| N/A | Llama2-70b-chat | GPT-3.5 Turbo | GPT-4 Turbo |
---|---|---|---|---|---
Detectors | Verb | No | Para | Summ | No | Para | Summ | No | Para | Summ | Acc
| Llama2-70b-chat
---
66.67% | 36.29% | 68.88% | 6.66% | 30.37% | 55.55% | 8.88% | 33.33% | 71.11% | 0% | 39.5%
| Llama3-70b-instruct
---
100% | 85.92% | 95.55% | 11.11% | 81.48% | 100% | 11.11% | 78.51% |  100% | 8.88% | 75.8%
| Mixtral 8x7B-instruct
---
88.14% | 34.81% | 55.55% | 11.11% | 29.62% | 66.66% | 8.88% | 21.48% | 77.77% | 11.11% | 41.85%
| GPT-3.5 Turbo
---
77.77% | 47.41% | 86.66% | 17.77% | 42.22% | 97.77% | 2.22% | 41.48% | 91.11% | 2.22% | 51.35%
| GPT-4 Turbo
---
99.25% | 93.33% | 82.22% | 17.77% | 92.59% | 100% | 15.55% | 85.18% | 100% | 15.55% | 80.12%
GPTZero | 37.03% | 100% | 6.66% | 0% | 100% | 2.22% | 4.44% | 100% | 0% | 0% | 56.91%
Prepostseo | 5l.85% | 91.85% | 20% | 0% | 96.29% | 17.77% | 2.22% | 93.33% | 4.44% | 6.66% | 58.39%
WWW’23 detector | 82.22% | 80% | 88.88% | 82.22% | 77.77% | 86.66% | 84.44% | 83.7% | 77.77% |  91.11% | 82.34%

Table 1: Plagiarism type classification (original (i.e., ‘No’) vs. verbatim
(i.e., ‘Verb’) vs. paraphrase (i.e., ‘Para’) vs. summary (i.e., ‘Summ’)
plagiarism) performance of 8 detectors w.r.t. the models used for generation.
For non-LLM approaches, we compute the category-wise breakdown from binary
classification as they are not suitable for this task. ‘Acc’ in the leftmost
column indicates the overall accuracy regardless of category types. The
highest values among LLM-based approaches are highlighted in  red, while the
highest values for non-LLM-based approaches are highlighted in  blue.

###  5.2 RQ2. how well can LLMs detect plagiarism?

Experimental Setup. To investigate LLMs’ capabilities in plagiarism detection,
we present two tasks: 1) binary classification (plagiarism-free vs.
plagiarism) and 2) plagiarism type identification (plagiarism-free vs.
verbatim vs. paraphrase vs. summary plagiarism). Unlike RQ1, we leverage human
annotation results to curate the evaluation data. Specifically, we randomly
sample 810 pairs of $D_{susp}$ and $D_{susp}$ from human annotation subset of
PlagBench. The breakdown of the 810 text pairs consists of 45 text pairs from
no plagiarism labels and 45 from three plagiarism labels, generated by 3
models within 3 different domains. We experiment with four prompt variations:
zero-shot vanilla prompting, zero-shot Chain-of-Thought (CoT) prompting Wei et
al. (2022), few-shot vanilla prompting, and few-shot CoT prompting. CoT
prompting is one of the most popular prompt techniques to enhance models’
downstream task performance by eliciting reasoning. As shown in Table 5, we
incorporate our defined plagiarism categories and their respective definitions
into the prompt, aiming to enhance the alignment of LLMs with our task. For
few-shot experiments, we provide six demonstrations consisting of a mix of
three plagiarism pairs and three plagiarism-free pairs, ensuring no overlap
with the evaluation data. We leverage GPT-4 to obtain high-quality reasoning
for few-shot CoT prompting.

Five LLMs are tested in total: Llama2-70b-chat, Llama3-70b-instruct,
Mixtral-8x7B-instruct, GPT-3.5 Turbo, and GPT-4 Turbo. We employ greedy
decoding (i.e., choosing the most plausible token at each generation step) for
answer prediction because it is widely used for various detection tasks and
supports the reproducibility of the results to some extent.

We additionally incorporate three non-LLM-based plagiarism detectors as
baseline models. Two of these, GPTZero111111https://gptzero.me/ and
Prepostseo,121212https://www.prepostseo.com/plagiarism-checker are commercial
plagiarism checkers, while the third is a detector proposed by Lee et al.
(2023b). We denote Lee et al. (2023b)’s detector as the WWW’23 detector for
the rest of the paper. All these tools rely on semantic similarity measures
and text alignment algorithms to distinguish plagiarism.

Binary Plagiarism Detection Results. Figure 4 shows the plagiarism detection
performance of $D_{src}$ and $D_{susp}$ in a binary setting (original vs.
plagiarism). We report accuracy scores since the label distribution is
balanced; 405 examples out of 810 are plagiarism-free cases, and the remaining
405 examples belong to one of three plagiarism types. The results of zero-shot
vanilla prompting, the most basic setup, hint that Llama2-70b-chat and
Mixtral-8x7B-instruct perform poorly with accuracy scores worse than a random
guess (Acc = 0.5). According to our qualitative inspection, the errors from
Llama2-70b-chat and Mixtral-8x7B-instruct arise because their final outputs do
not include a binary prediction. 26.7% of Llama2-70b-instruct’s output and
11.6% of Mixtral-8x7B-instruct’s output do not provide the prediction at all.
Additionally, their predictions tend to be highly skewed to the negative
class. In contrast, the performance of Llama3-70b-instruct is twice higher
than that of Llama2-70b-chat. Similarly, there is a significant performance
improvement from GPT-3.5 Turbo to GPT-4 Turbo. These findings are reasonable
in a sense that Llama3 and GPT-4 are upgraded versions of Llama2 and GPT-3.5,
respectively. A similar phenomenon has been reported in the task of medical
final examination Rosoł et al. (2023). CoT prompting and few-shot learning
tends to significantly boost detection performance across all models,
consistent with previous literature Wei et al. (2022); Brown et al. (2020).
Especially, Mixtral-8x7B-instruct and GPT-3.5 Turbo demonstrates a noticeable
performance gain from few-shot CoT prompting. We inspect that demonstrations
of different plagiarism categories and the corresponding rationale that
supports the correct answer assist them to identify more complicated
plagiarism categories like paraphrases and summaries. The performance gain of
Llama3-70b-instruct and GPT-4 Turbo obtained from few-shot CoT prompting is
not as significant as that of other models, but still these achieve near-
perfect performance. Commercial plagiarism detectors, GPTZero and Prepostseo,
is shown to achieve roughly 10% higher performance than random guessing. They
outperform three LLMs in a zero-shot setting, but their performance is
substantially lower than recently published LLMs such as Llama3-70b-instruct
and GPT-4 Turbo. This may be due to these tools relying on simple string-
matching algorithms designed specifically for detecting verbatim plagiarism,
rather than accommodating a broader range of plagiarism categories.
Conversely, the WWW’23 detector exhibits stronger performance as it is
specifically tailored for this task. Nonetheless, four LLMs have been shown to
surpass its performance through few-shot CoT prompting. Overall, these results
highlight the potential of LLMs in effectively detecting plagiarism.

Plagiarism Type Classification Results. Table 1 shows detection results of 8
detectors on plagiarism type classification depending on plagiarism types and
models used for generation. Of the four prompting techniques, we resort to
zero-shot CoT prompting for this experiment. This decision is motivated by the
fact that its inference time is significantly faster than few-shot CoT
prompting with improved detection performance. Equivalent to binary plagiarism
detection performance measurement, we report accuracy scores. In line with the
results from binary Plagiarism Detection, Llama3-70b-instruct and GPT-4 Turbo
are the highest performing LLMs. In particular, their identification of
verbatim and paraphrase plagiarism achieve 99-100% accuracy. GPT-3.5 Turbo is
demonstrated to be quite capable of distinguishing paraphrase plagiarism, but
it performs poorly in identifying plagiarism-free content and summarized
content. Most notably, LLMs perform poorly in detecting summary plagiarism
across all genres. Most of their errors stem from short texts being confused
for paraphrase plagiarism instead of summary plagiarism. Now, looking at
traditional plagiarism checkers, we find that GPTZero and Prepostseo excel at
identifying non-plagiarized content compared to the WWW’23 detector. Yet, the
WWW’23 detector surpasses them in paraphrase and summary detection. This
discrepancy may be due to differing definitions of plagiarism; since these
tools are designed for detecting verbatim plagiarism, they may incorrectly
classify text pairs with minimal lexical overlap as non-plagiarized.

##  6 Conclusion

We present a novel large-scale plagiarism detection benchmark, PlagBench: a
collection of 46.5K artificial plagiarism cases generated by three cutting-
edge LLMs. The development and analysis of the PlagBench dataset underscores
the nuanced challenges and opportunities presented by LLMs in combating
plagiarism while also acknowledging their potential vulnerabilities to being
used for unethical practices. We envision PlagBench as a universal standard
for evaluating plagiarism detection methods.

## Limitations

The current research has two limitations. First, we use a single manually
crafted prompt template for generating machine-plagiarized documents and
detecting plagiarism. There are, however, various prompting techniques and
strategies for automatically optimizing prompts. We expect future work to
explore a broader range of prompts for both generation and detection purposes.
Second, our experiments are based on instruction-tuned decoder-only LLMs. It
is uncertain whether the observed findings would apply to other types of LLMs
with different architectures. Future research should revisit our RQs using
more diverse model types.

## Ethics Statement

This research involves the use of LLMs to simulate plagiaristic behavior. All
source documents utilized in this study are derived from publicly accessible
open-source datasets. To promote transparency and reproducibility, we will
make all data and code used in our experiments available to the research
community. We acknowledge the potential ethical concerns associated with
generating synthetic plagiarism documents. Therefore, we emphasize that these
documents should be used exclusively for research purposes aimed at
understanding and mitigating plagiarism. We advise against any misuse of the
synthetic data, such as using it to deceive or harm others. Our work is
intended to contribute to the development of more effective plagiarism
detection tools and to enhance academic integrity. By sharing our resources,
we aim to support the broader research community in these endeavors.

Regarding human annotation, our research protocol was approved by the
Institutional Review Board (IRB) at our institution. We only recruited
annotators that are 18 years old or over. All annotators were paid over
minimum wage rate.

## References

  * Achiam et al. (2023) Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. 2023.  Gpt-4 technical report.  _arXiv preprint arXiv:2303.08774_.
  * Alvi et al. (2021) Faisal Alvi, Mark Stevenson, and Paul Clough. 2021.  Paraphrase type identification for plagiarism detection using contexts and word embeddings.  _International Journal of Educational Technology in Higher Education_ , 18(1):42.
  * Alzahrani et al. (2011) Salha M Alzahrani, Naomie Salim, and Ajith Abraham. 2011.  Understanding plagiarism linguistic patterns, textual features, and detection methods.  _IEEE Transactions on Systems, Man, and Cybernetics, Part C (Applications and Reviews)_ , 42(2):133–149.
  * Avetisyan et al. (2023) K Avetisyan, G Gritsay, and A Grabovoy. 2023.  Cross-lingual plagiarism detection: Two are better than one.  _Programming and Computer Software_ , 49(4):346–354.
  * Banerjee and Lavie (2005) Satanjeev Banerjee and Alon Lavie. 2005.  Meteor: An automatic metric for mt evaluation with improved correlation with human judgments.  In _Proceedings of the acl workshop on intrinsic and extrinsic evaluation measures for machine translation and/or summarization_ , pages 65–72.
  * Becker et al. (2023) Jonas Becker, Jan Philip Wahle, Terry Ruas, and Bela Gipp. 2023.  Paraphrase detection: Human vs. machine content.  _arXiv preprint arXiv:2303.13989_.
  * Brown et al. (2022) Hannah Brown, Katherine Lee, Fatemehsadat Mireshghallah, Reza Shokri, and Florian Tramèr. 2022.  What does it mean for a language model to preserve privacy?  In _Proceedings of the 2022 ACM Conference on Fairness, Accountability, and Transparency_ , pages 2280–2292.
  * Brown et al. (2020) Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. 2020.  Language models are few-shot learners.  _Advances in neural information processing systems_ , 33:1877–1901.
  * Carlini et al. (2023) Nicholas Carlini, Daphne Ippolito, Matthew Jagielski, Katherine Lee, Florian Tramer, and Chiyuan Zhang. 2023.  Quantifying memorization across neural language models.  In _The Eleventh International Conference on Learning Representations_.
  * Carlini et al. (2021) Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson, et al. 2021.  Extracting training data from large language models.  In _30th USENIX Security Symposium (USENIX Security 21)_ , pages 2633–2650.
  * Chen and Dolan (2011) David Chen and William B Dolan. 2011.  Collecting highly parallel data for paraphrase evaluation.  In _Proceedings of the 49th annual meeting of the association for computational linguistics: human language technologies_ , pages 190–200.
  * Chen et al. (2021) Hong Chen, Hiroya Takamura, and Hideki Nakayama. 2021.  Scixgen: a scientific paper dataset for context-aware text generation.  _arXiv preprint arXiv:2110.10774_.
  * Chen et al. (2020) Wenqing Chen, Jidong Tian, Liqiang Xiao, Hao He, and Yaohui Jin. 2020.  A semantically consistent and syntactically variational encoder-decoder framework for paraphrase generation.  In _Proceedings of the 28th international conference on computational linguistics_ , pages 1186–1198.
  * Cohan et al. (2018) Arman Cohan, Franck Dernoncourt, Doo Soon Kim, Trung Bui, Seokhwan Kim, Walter Chang, and Nazli Goharian. 2018.  A discourse-aware attention model for abstractive summarization of long documents.  In _Proceedings of the 2018 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 2 (Short Papers)_ , pages 615–621, New Orleans, Louisiana. Association for Computational Linguistics.
  * Dahl et al. (2024) Matthew Dahl, Varun Magesh, Mirac Suzgun, and Daniel E Ho. 2024.  Large legal fictions: Profiling legal hallucinations in large language models.  _arXiv preprint arXiv:2401.01301_.
  * Devlin et al. (2019) Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. 2019.  BERT: Pre-training of deep bidirectional transformers for language understanding.  In _Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long and Short Papers)_ , pages 4171–4186, Minneapolis, Minnesota. Association for Computational Linguistics.
  * Dolan and Brockett (2005) Bill Dolan and Chris Brockett. 2005.  Automatically constructing a corpus of sentential paraphrases.  In _Third international workshop on paraphrasing (IWP2005)_.
  * Fabbri et al. (2021) Alexander R Fabbri, Wojciech Kryściński, Bryan McCann, Caiming Xiong, Richard Socher, and Dragomir Radev. 2021.  Summeval: Re-evaluating summarization evaluation.  _Transactions of the Association for Computational Linguistics_ , 9:391–409.
  * Foltỳnek et al. (2020) Tomáš Foltỳnek, Terry Ruas, Philipp Scharpf, Norman Meuschke, Moritz Schubotz, William Grosky, and Bela Gipp. 2020.  Detecting machine-obfuscated plagiarism.  In _International conference on information_ , pages 816–827. Springer.
  * Gipp and Gipp (2014) Bela Gipp and Bela Gipp. 2014.  _Citation-based plagiarism detection_.  Springer.
  * Henderson et al. (2023) Peter Henderson, Xuechen Li, Dan Jurafsky, Tatsunori Hashimoto, Mark A Lemley, and Percy Liang. 2023.  Foundation models and fair use.  _arXiv preprint arXiv:2303.15715_.
  * Huang and Chang (2023) Jie Huang and Kevin Chen-Chuan Chang. 2023.  Citation: A key to building responsible and accountable large language models.  _arXiv preprint arXiv:2307.02185_.
  * Ji et al. (2023) Ziwei Ji, Nayeon Lee, Rita Frieske, Tiezheng Yu, Dan Su, Yan Xu, Etsuko Ishii, Ye Jin Bang, Andrea Madotto, and Pascale Fung. 2023.  Survey of hallucination in natural language generation.  _ACM Computing Surveys_ , 55(12):1–38.
  * Jiang et al. (2024) Albert Q Jiang, Alexandre Sablayrolles, Antoine Roux, Arthur Mensch, Blanche Savary, Chris Bamford, Devendra Singh Chaplot, Diego de las Casas, Emma Bou Hanna, Florian Bressand, et al. 2024.  Mixtral of experts.  _arXiv preprint arXiv:2401.04088_.
  * Khalil and Er (2023) Mohammad Khalil and Erkan Er. 2023.  Will chatgpt g et you caught? rethinking of plagiarism detection.  In _International Conference on Human-Computer Interaction_ , pages 475–487. Springer.
  * Krishna et al. (2024) Kalpesh Krishna, Yixiao Song, Marzena Karpinska, John Wieting, and Mohit Iyyer. 2024.  Paraphrasing evades detectors of ai-generated text, but retrieval is an effective defense.  _Advances in Neural Information Processing Systems_ , 36.
  * Lee et al. (2023a) Gunwoo Lee, Jindae Kim, Myung-seok Choi, Rae-Young Jang, and Ryong Lee. 2023a.  Review of code similarity and plagiarism detection research studies.  _Applied Sciences_ , 13(20):11358.
  * Lee et al. (2023b) Jooyoung Lee, Thai Le, Jinghui Chen, and Dongwon Lee. 2023b.  Do language models plagiarize?  In _Proceedings of the ACM Web Conference 2023_ , pages 3637–3647.
  * Lewis et al. (2020) Mike Lewis, Yinhan Liu, Naman Goyal, Marjan Ghazvininejad, Abdelrahman Mohamed, Omer Levy, Veselin Stoyanov, and Luke Zettlemoyer. 2020.  BART: Denoising sequence-to-sequence pre-training for natural language generation, translation, and comprehension.  In _Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics_ , pages 7871–7880, Online. Association for Computational Linguistics.
  * Li et al. (2023) Yafu Li, Qintong Li, Leyang Cui, Wei Bi, Longyue Wang, Linyi Yang, Shuming Shi, and Yue Zhang. 2023.  Deepfake text detection in the wild.  _arXiv preprint arXiv:2305.13242_.
  * Lingard (2023) Lorelei Lingard. 2023.  Writing with chatgpt: An illustration of its capacity, limitations & implications for academic writers.  _Perspectives on medical education_ , 12(1):261.
  * Liu et al. (2021) Jiachang Liu, Dinghan Shen, Yizhe Zhang, Bill Dolan, Lawrence Carin, and Weizhu Chen. 2021.  What makes good in-context examples for gpt-$3$?  _arXiv preprint arXiv:2101.06804_.
  * McGowan et al. (2023) Alessia McGowan, Yunlai Gui, Matthew Dobbs, Sophia Shuster, Matthew Cotter, Alexandria Selloni, Marianne Goodman, Agrima Srivastava, Guillermo A Cecchi, and Cheryl M Corcoran. 2023.  Chatgpt and bard exhibit spontaneous citation fabrication during psychiatry literature search.  _Psychiatry Research_ , 326:115334.
  * Miller et al. (2009) Frederic P Miller, Agnes F Vandome, and John McBrewster. 2009.  Levenshtein distance: Information theory, computer science, string (computer science), string metric, damerau? levenshtein distance, spell checker, hamming distance.
  * Min et al. (2022) Sewon Min, Xinxi Lyu, Ari Holtzman, Mikel Artetxe, Mike Lewis, Hannaneh Hajishirzi, and Luke Zettlemoyer. 2022.  Rethinking the role of demonstrations: What makes in-context learning work? In _Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing_ , pages 11048–11064, Abu Dhabi, United Arab Emirates. Association for Computational Linguistics.
  * Mishra et al. (2024) Abhika Mishra, Akari Asai, Vidhisha Balachandran, Yizhong Wang, Graham Neubig, Yulia Tsvetkov, and Hannaneh Hajishirzi. 2024.  Fine-grained hallucination detection and editing for language models.  _arXiv preprint arXiv:2401.06855_.
  * Momenaei et al. (2023) Bita Momenaei, Taku Wakabayashi, Abtin Shahlaee, Asad F Durrani, Saagar A Pandit, Kristine Wang, Hana A Mansour, Robert M Abishek, David Xu, Jayanth Sridhar, et al. 2023.  Appropriateness and readability of chatgpt-4-generated responses for surgical treatment of retinal diseases.  _Ophthalmology Retina_ , 7(10):862–868.
  * Moravvej et al. (2023) Seyed Vahid Moravvej, Seyed Jalaleddin Mousavirad, Diego Oliva, and Fardin Mohammadi. 2023.  A novel plagiarism detection approach combining bert-based word embedding, attention-based lstms and an improved differential evolution algorithm.  _arXiv preprint arXiv:2305.02374_.
  * Mostafazadeh et al. (2016) Nasrin Mostafazadeh, Nathanael Chambers, Xiaodong He, Devi Parikh, Dhruv Batra, Lucy Vanderwende, Pushmeet Kohli, and James Allen. 2016.  A corpus and cloze evaluation for deeper understanding of commonsense stories.  In _Proceedings of the 2016 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies_ , pages 839–849.
  * Narayan et al. (2018) Shashi Narayan, Shay B. Cohen, and Mirella Lapata. 2018.  Don’t give me the details, just the summary! Topic-aware convolutional neural networks for extreme summarization.  In _Proceedings of the 2018 Conference on Empirical Methods in Natural Language Processing_ , Brussels, Belgium.
  * Onder et al. (2024) CE Onder, G Koc, P Gokbulut, I Taskaldiran, and SM Kuskonmaz. 2024.  Evaluation of the reliability and readability of chatgpt-4 responses regarding hypothyroidism during pregnancy.  _Scientific Reports_ , 14(1):243.
  * Papineni et al. (2002) Kishore Papineni, Salim Roukos, Todd Ward, and Wei-Jing Zhu. 2002.  Bleu: a method for automatic evaluation of machine translation.  In _Proceedings of the 40th annual meeting of the Association for Computational Linguistics_ , pages 311–318.
  * Potthast et al. (2013) Martin Potthast, Matthias Hagen, Tim Gollub, Martin Tippmann, Johannes Kiesel, Paolo Rosso, Efstathios Stamatatos, and Benno Stein. 2013.  Overview of the 5th international competition on plagiarism detection.  In _CLEF Conference on Multilingual and Multimodal Information Access Evaluation_ , pages 301–331. CELCT.
  * Potthast et al. (2010) Martin Potthast, Benno Stein, Alberto Barrón-Cedeño, and Paolo Rosso. 2010.  An evaluation framework for plagiarism detection.  In _Coling 2010: Posters_ , pages 997–1005.
  * Raffel et al. (2020) Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, and Peter J Liu. 2020.  Exploring the limits of transfer learning with a unified text-to-text transformer.  _Journal of machine learning research_ , 21(140):1–67.
  * Rosoł et al. (2023) Maciej Rosoł, Jakub S Gąsior, Jonasz Łaba, Kacper Korzeniewski, and Marcel Młyńczak. 2023.  Evaluation of the performance of gpt-3.5 and gpt-4 on the polish medical final examination.  _Scientific Reports_ , 13(1):20512.
  * Sadasivan et al. (2023) Vinu Sankar Sadasivan, Aounon Kumar, Sriram Balasubramanian, Wenxiao Wang, and Soheil Feizi. 2023.  Can ai-generated text be reliably detected?  _arXiv preprint arXiv:2303.11156_.
  * Sağlam et al. (2024a) Timur Sağlam, Moritz Brödel, Larissa Schmid, and Sebastian Hahner. 2024a.  Detecting automatic software plagiarism via token sequence normalization.  In _Proceedings of the IEEE/ACM 46th International Conference on Software Engineering_ , pages 1–13.
  * Sağlam et al. (2024b) Timur Sağlam, Sebastian Hahner, Larissa Schmid, and Erik Burger. 2024b.  Automated detection of ai-obfuscated plagiarism in modeling assignments.  In _Proceedings of the 46th International Conference on Software Engineering: Software Engineering Education and Training_ , pages 297–308.
  * Senter and Smith (1967) RJ Senter and Edgar A Smith. 1967.  Automated readability index.  Technical report, Technical report, DTIC document.
  * Song et al. (2024) Yifan Song, Yuanxin Wang, Marshall An, Christopher Bogart, and Majd Sakr. 2024.  Programming plagiarism detection with learner data.  In _Proceedings of the 55th ACM Technical Symposium on Computer Science Education V. 2_ , pages 1826–1827.
  * Stein et al. (2011) Benno Stein, Nedim Lipka, and Peter Prettenhofer. 2011.  Intrinsic plagiarism analysis.  _Language Resources and Evaluation_ , 45:63–82.
  * Tang et al. (2023) Liyan Tang, Zhaoyi Sun, Betina Idnay, Jordan G Nestor, Ali Soroush, Pierre A Elias, Ziyang Xu, Ying Ding, Greg Durrett, Justin F Rousseau, et al. 2023.  Evaluating large language models on medical evidence summarization.  _npj Digital Medicine_ , 6(1):158.
  * Team et al. (2023) Gemini Team, Rohan Anil, Sebastian Borgeaud, Yonghui Wu, Jean-Baptiste Alayrac, Jiahui Yu, Radu Soricut, Johan Schalkwyk, Andrew M Dai, Anja Hauth, et al. 2023.  Gemini: a family of highly capable multimodal models.  _arXiv preprint arXiv:2312.11805_.
  * Tirumala et al. (2022) Kushal Tirumala, Aram Markosyan, Luke Zettlemoyer, and Armen Aghajanyan. 2022.  Memorization without overfitting: Analyzing the training dynamics of large language models.  _Advances in Neural Information Processing Systems_ , 35:38274–38290.
  * Touvron et al. (2023) Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, et al. 2023.  Llama 2: Open foundation and fine-tuned chat models.  _arXiv preprint arXiv:2307.09288_.
  * Vani and Gupta (2017) K Vani and Deepa Gupta. 2017.  Detection of idea plagiarism using syntax–semantic concept extractions with genetic algorithm.  _Expert Systems with Applications_ , 73:11–26.
  * Vasilyev et al. (2020) Oleg Vasilyev, Vedant Dharnidharka, and John Bohannon. 2020.  Fill in the BLANC: Human-free quality estimation of document summaries.  In _Proceedings of the First Workshop on Evaluation and Comparison of NLP Systems_ , pages 11–20, Online. Association for Computational Linguistics.
  * Wahle et al. (2022) Jan Philip Wahle, Terry Ruas, Frederic Kirstein, and Bela Gipp. 2022.  How large language models are transforming machine-paraphrase plagiarism.  In _Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing_ , pages 952–963, Abu Dhabi, United Arab Emirates. Association for Computational Linguistics.
  * Wahle et al. (2021a) Jan Philip Wahle, Terry Ruas, Norman Meuschke, and Bela Gipp. 2021a.  Are neural language models good plagiarists? a benchmark for neural paraphrase detection.  In _2021 ACM/IEEE Joint Conference on Digital Libraries (JCDL)_ , pages 226–229. IEEE.
  * Wahle et al. (2021b) Jan Philip Wahle, Terry Ruas, Norman Meuschke, and Bela Gipp. 2021b.  Are neural language models good plagiarists? a benchmark for neural paraphrase detection.  In _2021 ACM/IEEE Joint Conference on Digital Libraries (JCDL)_ , pages 226–229.
  * Weber-Wulff et al. (2023) Debora Weber-Wulff, Alla Anohina-Naumeca, Sonja Bjelobaba, Tomáš Foltỳnek, Jean Guerrero-Dib, Olumide Popoola, Petr Šigut, and Lorna Waddington. 2023.  Testing of detection tools for ai-generated text.  _International Journal for Educational Integrity_ , 19(1):26.
  * Wei et al. (2021) Jason Wei, Maarten Bosma, Vincent Y Zhao, Kelvin Guu, Adams Wei Yu, Brian Lester, Nan Du, Andrew M Dai, and Quoc V Le. 2021.  Finetuned language models are zero-shot learners.  _arXiv preprint arXiv:2109.01652_.
  * Wei et al. (2022) Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, Fei Xia, Ed Chi, Quoc V Le, Denny Zhou, et al. 2022.  Chain-of-thought prompting elicits reasoning in large language models.  _Advances in neural information processing systems_ , 35:24824–24837.
  * Xiong et al. (2024) Jiale Xiong, Jing Yang, Lei Yan, Muhammad Awais, Abdullah Ayub Khan, Roohallah Alizadehsani, and U Rajendra Acharya. 2024.  Efficient reinforcement learning-based method for plagiarism detection boosted by a population-based algorithm for pretraining weights.  _Expert Systems with Applications_ , 238:122088.
  * Yuan et al. (2021) Weizhe Yuan, Graham Neubig, and Pengfei Liu. 2021.  Bartscore: Evaluating generated text as text generation.  In _Advances in Neural Information Processing Systems_ , volume 34, pages 27263–27277. Curran Associates, Inc.
  * Zha et al. (2023) Yuheng Zha, Yichi Yang, Ruichen Li, and Zhiting Hu. 2023.  AlignScore: Evaluating factual consistency with a unified alignment function.  In _Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)_ , pages 11328–11348, Toronto, Canada. Association for Computational Linguistics.
  * Zhang et al. (2023) Chiyuan Zhang, Daphne Ippolito, Katherine Lee, Matthew Jagielski, Florian Tramèr, and Nicholas Carlini. 2023.  Counterfactual memorization in neural language models.  _Advances in Neural Information Processing Systems_ , 36:39321–39362.
  * Zhang et al. (2019a) Tianyi Zhang, Varsha Kishore, Felix Wu, Kilian Q Weinberger, and Yoav Artzi. 2019a.  Bertscore: Evaluating text generation with bert.  _arXiv preprint arXiv:1904.09675_.
  * Zhang et al. (2024) Tianyi Zhang, Faisal Ladhak, Esin Durmus, Percy Liang, Kathleen McKeown, and Tatsunori B Hashimoto. 2024.  Benchmarking large language models for news summarization.  _Transactions of the Association for Computational Linguistics_ , 12:39–57.
  * Zhang et al. (2019b) Yuan Zhang, Jason Baldridge, and Luheng He. 2019b.  PAWS: Paraphrase Adversaries from Word Scrambling.  In _Proc. of NAACL_.
  * Zhu and Bhat (2020) Wanzheng Zhu and Suma Bhat. 2020.  GRUEN for evaluating linguistic quality of generated text.  In _Findings of the Association for Computational Linguistics: EMNLP 2020_ , pages 94–108, Online. Association for Computational Linguistics.

##  Appendix A Appendix

###  A.1 Automatic Evaluation of LLM-Generated Plagiarism

We leverage publicly available two datasets, PAWS Zhang et al. (2019b) and
SummEval Fabbri et al. (2021), to find the optimal thresholds for data
filtering regarding paraphrase evaluation and summary evaluation,
respectively. Both datasets contain human annotation labels signaling whether
a pair of texts is correct paraphrases or not. PAWS provide one binary label
for each text pair, whereas SummEval contains a list of 8 annotation results
in which the scores range from 1 to 5 evaluated across 4 dimensions:
coherence, consistency, fluency, and relevance.

The threshold selection process is straightforward; we apply our established
automated evaluation measurements to the subset of these two corpora and
compute their mean scores of bad examples. Specifically, we compute mean
scores of entries with ‘0’ label from the PAWS dataset and entries with
average annotation scores lower than 2.5 from the SummEval dataset. These mean
scores are then used as a reference to assign filtering thresholds. Give two
pieces of evaluation texts $(d,d^{*})$, let’s denote paraphrase evaluation
results as $R_{\text{para\\_eval}}$. $R_{\text{para\\_eval}}$ can be expressed
as below:

$\displaystyle R_{\text{para\\_eval}}=\begin{cases}1&\text{if
}\text{Alignscore}(d,d^{*})>0.5\\\ &\quad\land\text{BERTScore}(d,d^{*})>0.5\\\
&\quad\land\text{Readability\\_Gap}(d,d^{*})>-0.5\\\
&\quad\land\text{COLAscore\\_Improv}(d,d^{*})\geq 0\\\
0&\text{else}.\end{cases}$

Summary evaluation results are denoted as $R_{\text{summ\\_eval}}$.

$\displaystyle R_{\text{summ\\_eval}}=\begin{cases}1&\text{if
}\text{Alignscore}(d,d^{*})>0.5\\\ &\quad\land\text{BLANC}(d,d^{*})>0.0\\\
&\quad\land\text{BARTScore}(d,d^{*})>-4.0\\\
&\quad\land\text{Readability}(d,d^{*})>10\\\
&\quad\land\text{COLAscore\\_Improv}(d,d^{*})\geq 0\\\
0&\text{else}.\end{cases}$

Given these two definitions, we omit all samples associated with ‘0’ in
regards to $R_{\text{para\\_eval}}$ and $R_{\text{summ\\_eval}}$.

###  A.2 Details on Human Evaluation of LLM-Generated Plagiarism

Each task consists of 3 batches of one source text and three suspicious texts
generated by Llama2-70b-chat, GPT-3.5 Turbo, and GPT-4 Turbo. Given a pair of
the source text and machine-paraphrased or machine-summarized texts, we first
verbally describe our established evaluation aspects on the task description
and ask them to answer if the described aspect is satisfied or not. For
plagiarism-free cases, the definitions of paraphrase and summary plagiarism
were provided, and annotators are tasked to identify two texts belong to
either paraphrase or summary plagiarism. See Figure 6, 7, and 5 for the user
study interface design. To ensure the quality of responses submitted by
annotators, we enforce four built-in worker qualifications, involving(1) HIT
Approval Rate of ${\leq}98\%$, (2) a minimum of 1,000 Approved HITs, (3)
Masters qualification status, and (4) U.S-based workers. Moreover, we
purposely add one dummy question per batch and reject the response providing
incorrect answers to the question. Given that the estimated completion time
per batch is 10 minutes, workers are compensated $\$1.5$ per batch based on
United States average hourly wages. We hire 3 annotators per sample in order
to assign majority voting results as gold labels.

###  A.3 Model Size And Budget

We enlist model size used for our experiment here: for Llama2 and Llama3, we
use the largest scale among their models, which is 70B. GPT-3.5 is expected to
contain 175B parameters, equivalent to GPT-3. Meanwhile, GPT-4 has 1.76T
parameters, and Mixtral has 46.7B total parameters. For all experiments, we
leverage API calls from Huggingface and OpenAI official website.

Figure 5: AMT experiment interface example for plagiarism-free case evaluation Figure 6: AMT experiment interface example for paraphrase plagiarism evaluation Figure 7: AMT experiment interface example for paraphrase plagiarism evaluation Type | Metric | Description
---|---|---
Paraphrase |  | Semantic
---
equivalence
Evaluates whether the paraphrased text conveys the same meaning as the source
text.
Consistency |  | Evaluates whether the paraphrased text accurately represents the information contained
---
in the source text without the inclusion of errors or distortions.
| Language
---
quality
| Evaluates whether the paraphrased text maintains or improves upon the
quality of the
---
source text in regards to fluency and grammaticality.
Summary | Relevance |  | Evaluates whether the summary covers all the essential information and key points from
---
the source text while omitting irrelevant or tangential details.
Coherence |  | Evaluate whether the summary is well-structured and not just a random assortment of
---
information from the source text.
Consistency |  | Evaluates whether the summary accurately represents the content and meaning of the
---
source text without the inclusion of errors or distortions.
| Language
---
quality
| Evaluates whether the summary maintains or improves upon the quality of the
source
---
text in regards to fluency and grammaticality.
Table 2: Descriptions of evaluation metrics for paraphrase and summary Plagiarism. Domain | Model | # of document pairs |  | # of remaining pairs
---
(paraphrase)
| # of remaining pairs
---
(summary)
SciXGen | Llama2-70b-chat | 2,400 | 1,179 (49.12%) | 2,147 (89.46%)
GPT-3.5 Turbo | 2,400 | 1,764 (73.5%) | 2,379 (99.12%)
GPT-4 Turbo | 1,300 | 1,085 (83.46%) | 1,266 (97.38%)
ROCStories | Llama2-70b-chat | 2,400 | 1,699 (70.79%) | 1,975 (82.29%)
GPT-3.5 Turbo | 2,400 | 2,385 (99.38%) | 1,614 (67.25%)
GPT-4 Turbo | 1,300 | 1,295 (99.62%) | 1,166 (89.69%)
TLDR | Llama2-70b-chat | 1300 | 753 (57.92%) | 1,060 (81.54%)
GPT-3.5 Turbo | 1300 | 1,230 (99.38%) | 1,181 (90.85%)
GPT-4 Turbo | 700 | 681 (97.29%) | 657 (93.86%)
Table 3: Dataset statistics after automatic filtering for paraphrase and summary plagiarism. The percentage in the bracket represents the percentage of remaining document pairs remaining out of original pairs. Plagiarism category | Template
---|---
Paraphrase |  | Paraphrase the following text while keeping its meaning.
---
Text: {source_doc_demonstration1}
Paraphrased: {paraphrase_demonstration1}
Text: {source_doc_demonstration2}
Paraphrased: {paraphrase_demonstration2}
Text: {source_doc_demonstration3}
Paraphrased: {paraphrase_demonstration3}
Text: {target_source_doc}
Paraphrased:
Summary |  | Summarize the following text in 1-3 sentences.
---
Text: {source_doc_demonstration1}
Summarized: {summary_demonstration1}
Text: {source_doc_demonstration2}
Summarized : {summary_demonstration2}
Text: {source_doc_demonstration3}
Summarized: {summary_demonstration3}
Text: {target_source_doc}
Summarized:
Plagiarism-Free |  |  Based on the provided text passage and keywords, write its continuation in a style of {genre}.
---
When generating, make sure that the continuation is coherent while including
all keywords.
Text: {target_sentences}
Keywords: {keywords}
Continuation:
Table 4: Prompt templates for plagiarism generation task. Text in violet
represents instructions and text in gray represents few-shot demonstrations.
Lastly, text in magenta is used for the actual task.

Prompt type | Template
---|---
| Zero-shot vanilla
---
prompting
(binary detection)
There are three types of plagiarism: • Verbatim plagiarism: the evaluation
text consists of exact copies of words or phrases without transformation from
the source text without citation. • Paraphrase plagiarism: the evaluation text
is rephrased or rewritten using different words but retain the same meaning
and structure as the source text without citation. • Summary plagiarism: the
evaluation text encapsulates the most essential points of the source text into
a shorter form without citation. If the evaluation text does not belong to any
of three plagiarism categories, it means plagiarism-free. Given a pair of text
and provided plagiarism definitions, does the evaluation text plagiarize the
source text (yes/no)? Please format your final response as ‘Answer:
{{response}}’. Source text: {source_doc} Evaluation text: {susp_doc}
| Zero-shot CoT
---
prompting
(binary detection)
| There are three types of plagiarism:
---
• Verbatim plagiarism: the evaluation text consists of exact copies of words
or phrases
without transformation from the source text without citation.
• Paraphrase plagiarism: the evaluation text is rephrased or rewritten using
different words but
retain the same meaning and structure as the source text without citation.
• Summary plagiarism: the evaluation text encapsulates the most essential
points of the source text
into a shorter form without citation.
If the evaluation text does not belong to any of three plagiarism categories,
it means plagiarism-free.
Given a pair of text and provided plagiarism definitions, does the evaluation
text plagiarize the source text
(yes/no)? First think step-by-step and format your final response as ‘Final
answer: {{response}}’.
Source text: {source_doc}
Evaluation text: {susp_doc}
Answer: Let’s think step-by-step.
| Zero-shot vanilla
---
prompting
(type identification)
| There are three types of plagiarism:
---
• Verbatim plagiarism: the evaluation text consists of exact copies of words
or phrases
without transformation from the source text without citation.
• Paraphrase plagiarism: the evaluation text is rephrased or rewritten using
different words but
retain the same meaning and structure as the source text without citation.
• Summary plagiarism: the evaluation text encapsulates the most essential
points of the source text
into a shorter form without citation.
• No plagiarism: the evaluation text does not belong to any of three
plagiarism categories.
Given a pair of text and provided plagiarism definitions, what type of
plagiarism
(no/verbatim/paraphrase/summary) does the evaluation belong to when compared
to the source text?
Please format your final response as ‘Answer: {{response}}’.
Source text: {source_doc}
Evaluation text: {susp_doc}
| Zero-shot CoT
---
prompting
(type identification)
| There are three types of plagiarism:
---
• Verbatim plagiarism: the evaluation text consists of exact copies of words
or phrases
without transformation from the source text without citation.
• Paraphrase plagiarism: the evaluation text is rephrased or rewritten using
different words but
retain the same meaning and structure as the source text without citation.
• Summary plagiarism: the evaluation text encapsulates the most essential
points of the source text
into a shorter form without citation.
• No plagiarism: the evaluation text does not belong to any of three
plagiarism categories.
Given a pair of text and provided plagiarism definitions, what type of
plagiarism
(no/verbatim/paraphrase/summary) does the evaluation belong to when compared
to the source text?
First think step-by-step and
format your final response as ‘Answer: {{response}}’.
Source text: {source_doc}
Evaluation text: {susp_doc}
Answer: Let’s think step-by-step.

Table 5: Prompt templates for plagiarism detection task.