style-aware-paraphraser-mistral7b/README.md

---
base_model: mistralai/Mistral-7B-Instruct-v0.3
language: en
license: apache-2.0
pipeline_tag: text-generation
library_name: transformers
tags:
- style-transfer
- paraphrase
- dpo
- machine-text-detection
- adversarial
---

# Style-Aware Paraphraser (Mistral-7B + DPO)

Official model release for *[Attacks on Machine-Text Detectors Retain
Stylistic Fingerprints](https://arxiv.org/abs/2505.14608v3)* (ICML).

This is `mistralai/Mistral-7B-Instruct-v0.3` after two stages of training on
the Reddit Million Users Dataset:

1. **SFT** — LoRA (r=32, α=64, dropout=0.1), lr=2e-5, 1 epoch, on instruction
   triples that map Mistral-7B paraphrases of a comment back to the original
   author's style, conditioned on 16 author exemplars.
2. **Detector-guided DPO** — β=5, lr=1e-6, 3 epochs, cosine decay,
   The reward signal comes from a roberta-base
   classifier trained to discriminate the SFT model's outputs from genuine
   human text. The "most-human" candidate becomes `chosen`; a random other
   candidate becomes `rejected`.

## Intended use

Style-aware paraphrasing of **Mistral-7B paraphrases** of machine-generated
text, in the style of a target human author specified by 16 reference texts.
When transforming machine-text, the model is designed to be invoked iteratively (3 rounds, 10 candidates per
round, top-5 by SBERT) (see the demo notebook in the GitHub release).

> **Best on social-media-like text.** Trained on Reddit comments
> (32–128 tokens). The paper's evaluation shows transfer to Amazon reviews
> works well and Blogs less well; for long-form text, split into paragraphs
> and refine each independently (paper Appendix L, "Chunk & Merge").

## Inference recipe

Attacking machine-text is a two-stage process:

1. **Mistral-7B paraphrase**: Paraphrase the input machine text P=5 times
   with `mistralai/Mistral-7B-Instruct-v0.3` using the prompt in
   Appendix H.1 of the paper.
2. **Iterative refinement**: Feed those 5 paraphrases + 16 author exemplars
   into this model using the prompt in Appendix H.4, take 10 samples,
   keep the top-5 by SBERT cosine similarity to the originals, repeat for
   3 iterations.

Runnable example pulling the released author bank from the Hub and using
the `inference/iterative_refinement.py` library function from the
[source repository](https://github.com/rrivera1849/style-aware-paraphrasing):

```python
import sys; sys.path.insert(0, "release/inference")
from datasets import load_dataset
from iterative_refinement import iterative_refine

# Each row of the author bank already carries the 5 Mistral-7B paraphrases
# of `respond_reddit` plus the 16 target-author exemplars and their
# paraphrases — no second LLM needed for this path.
row = load_dataset(
    "rrivera1849/style-aware-paraphraser-author-bank-reddit",
    split="train", streaming=True,
)
row = next(iter(row))

iters = iterative_refine(
    initial_paraphrases=row["paraphrase_respond_reddit"],
    target_texts=row["reference_text"],
    target_paraphrases=row["paraphrase_reference_text"],
    original_text=row["respond_reddit"],                        # SBERT rerank reference
    model_path="rrivera1849/style-aware-paraphraser-mistral7b", # this model
    num_iters=3,
)
print(iters[-1][0])   # final iteration, top SBERT pick
```

For an end-to-end walkthrough (including the Mistral-7B paraphrase pass
needed for inputs that aren't in the bank), see `release/inference/demo.ipynb`.

## Companion artifacts

- **Author bank**: [`rrivera1849/style-aware-paraphraser-author-bank-reddit`](https://huggingface.co/datasets/rrivera1849/style-aware-paraphraser-author-bank-reddit)
  — 36 000 rows (12 000 authors × 3 generators) with 16 exemplars +
  Mistral-7B paraphrases ready to feed into this model.
- **Released outputs across 3 domains**: [`rrivera1849/style-aware-paraphraser-outputs`](https://huggingface.co/datasets/rrivera1849/style-aware-paraphraser-outputs)
  — the `{human_text, machine_text, adversarial_paraphrase}` triples used
  for the paper's Table 1 / Figure 1 evaluation.
- **Code repository**: [github.com/rrivera1849/style-aware-paraphrasing](https://github.com/rrivera1849/style-aware-paraphrasing) — full training, inference, and evaluation pipeline.

## Evaluation

At N=1 document per author (Reddit), the strongest detector across
the paper's nine-detector suite scores:

| Method        | Max AUROC(1), lower = better attack |
|---------------|---:|
| No attack     | ≈ 1.00 |
| **Ours**      | **≈ 0.55** |

Source: paper Figure 1, left panel. Same finding holds on Amazon and Blogs
(which weren't seen during training); see Figure 1 middle/right panels and
Appendix A for the per-detector breakdown.

The attack is the only method evaluated that evades **all** detectors —
including style-based ones — at single-document scale. As N grows past
~25, distributions become separable again and detection recovers.

## Responsible use

This model is an **adversarial paraphraser**: trained to make machine-
generated text harder for current detectors to identify. We release it to
support research on the *limits* of machine-text detection — detector
stress-testing, studying which stylistic features survive aggressive
paraphrasing, and building defenses (including the multi-document detection
regime the paper argues is necessary, §8).

**Out-of-scope / prohibited uses.** Producing content to deceive a reader,
evaluator, or platform about whether it was written by a human (academic
dishonesty, ghostwriting submissions, evading content-moderation or
authenticity systems whose terms prohibit it); impersonating a specific
real person; mass production of synthetic content for spam, manipulation,
or abuse.

The model is dual-use; responsibility for downstream use rests with the
user. See the paper's *Impact Statement* for the full framing.

## Training data

Training data derives from the Reddit Million Users Dataset
(Khan et al. 2021).

## Limitations

- Trained only on Reddit (32–128 token comments). Cross-domain transfer to
  Amazon reviews and blog posts works (paper Fig 1) but is weaker for blogs.
- Requires 16 exemplars from the target author.
- Detection is recovered with N≥25 documents per author.

## Citation

```bibtex
@inproceedings{rivera-soto-etal-2026-attacks,
  title     = {Attacks on Machine-Text Detectors Retain Stylistic Fingerprints},
  author    = {Rivera Soto, Rafael A. and Chen, Barry and Andrews, Nicholas},
  booktitle = {Proceedings of the International Conference on Machine Learning},
  year      = {2026},
  url       = {https://arxiv.org/abs/2505.14608},
}
```

## License

Apache 2.0 — the model weights are a fine-tuned derivative of
`mistralai/Mistral-7B-Instruct-v0.3` and inherit its license. The
companion code in the
[`style-aware-paraphrasing`](https://github.com/) repository is MIT.