RADAR adversarially trained AI text detector

Three records in the studies index name RADAR, and two print figures. RAID 2024 queried the Hugging Face model and reports false positive rates on human-written documents of 7.48% at threshold 0.25, 3.48% at 0.5, 2.17% at 0.75 and 1.23% at 0.95 (arXiv 2405.07940, Table 4, read 10 November 2026). At a threshold calibrated to 5% false positives it scored 88.8 on open chat models with greedy decoding, 48.3 on open non-chat models under sampling and 31.8 once a repetition penalty was added (Table 5), 70.9 overall on non-adversarial text (Table 14), and 12.9 on Python code, 51.1 on Czech news and 53.2 on German news (Table 7). Table 8 shows the per-domain spread behind that 5% total: 0.1% of recipes and 20.4% of reviews flagged at the same threshold, the paper's own example of "domain-specific weaknesses", and Appendix G.2 calls RADAR "uncharacteristically bad on IMDb Movie Reviews".

Under attack the same record prints 67.3 for paraphrase against 70.9 with none, 67.5 under synonym swap, 69.5 under misspelling, 59.3 under homoglyphs and 82.2 under zero-width spaces (arXiv 2405.07940, Tables 6 and 16, read 10 November 2026). The spread is narrower than Binoculars' 36.1-point synonym drop in the same table. DAMAGE 2025, written by Pangram Labs, ran RADAR as its adversarially trained baseline on AI-written student essays and reports a true positive rate at a fixed 5% false positive rate of 3.33% before and 5.05% after 19 commercial humanizers (Table 3, 1,000 bootstrap iterations, essay count not printed), 62.4% on RAID's paraphrase split and 62.7% on its synonym split (Table 4), and at the default threshold 70.67% on AI essays, 79.33% after humanizing and a 51.87% false positive rate on human essays (arXiv 2501.03437, Tables 3, 4 and 7, read 10 November 2026). The record explains the 3.33%: at a 5% false positive operating point a detector whose default rate is 51.87% "detects almost nothing". NIST AI 700-1 names RADAR-Vicuna-7B as one of its two baseline discriminators and prints no result under that name (NIST AI 700-1, Section 4.2.5, read 9 November 2026), so it counts as a record and feeds no field.

The fields follow the index rules. The false positive value is 3.48% at threshold 0.5 from RAID 2024 Table 4, the GLTR, Fast-DetectGPT and Binoculars treatment; DAMAGE 2025's 51.87% carries no printed essay count and stays in the base text. Robustness is 67.3, the paraphrase column at 5% false positives that the ranking sorts on, with the 82.2 zero-width figure and the 79.33% default-threshold figure quoted beside it. No record prints a miss count, so the false negative ranking carries no value.

RADAR qualifies for three study rankings, read 10 November 2026 in the data file: independently tested detectors with 2 records (the NIST AI 700-1 naming of RADAR-Vicuna-7B as a baseline prints no result and is carried as a note, as it is on the GPT-2 Output Detector card), false positive rates at 3.48% of RAID's human documents at threshold 0.5, and adversarial robustness at 67.3 under paraphrase. On stated values it qualifies for the open-source view with the Apache License 2.0 code and the last push of 18 September 2025, and not for the API view, where the model card's "API service" line is quoted in the second table. It is absent from the free tier, language, price and claim gap rankings, which need a word allowance, a language count, a price and an accuracy percentage the method does not publish.

The paraphrase result reads beside the paraphrased text question: RADAR lost 3.6 points under RAID's paraphrase where Binoculars gained 0.7 and Fast-DetectGPT lost 1.8 (arXiv 2405.07940, Table 16, read 10 November 2026), and in DAMAGE 2025 it caught 5.05% of humanized essays at 5% false positives where GPTZero caught 60.04%. Every detector card on the register shows the same fourteen fields, so the empty price and language cells here can be read beside the commercial tools that fill them.