In this study, we investigate which language model evasion attacks can survive state-of-the-art adversarial fine-tuning, developing strategies that rank in the top 5 on the ELOQUENT 2026 Voight-Kampff leaderboard.
While adversarial fine-tuning easily closes the winning evasion recipes from 2025, we uncover a fundamental asymmetry in detector vulnerability: pushing generated text out of the detector's training distribution reliably defeats adversarial detection, while pulling it into the distribution (e.g., mimicking human training data) fails completely.
Exploiting this, we introduce two novel out-of-distribution attack families - cross-decade register attacks and modernist stream-of-consciousness form. Both strategies easily bypass adversarial closure, achieving up to approximately 50x higher fool rates than previous methods while preserving naturalness.
Furthermore, experiments show that the obvious deployer countermeasure (augmenting training data with period prose) fails to close the vulnerability. Our findings demonstrate that the tested detector families, including adversarially fine-tuned ones, exhibit persistent vulnerabilities under structural out-of-distribution shifts, a mechanism that directly powers our leading competition performance.
Blogger's Review: This paper reveals the intricate struggle between AI text generation and detection, highlighting the limitations of adversarial fine-tuning and unexpected findings regarding detector vulnerabilities. This research provides significant insights for the future of AI writing and detection technologies, warranting close attention.