1 Introduction↩︎

As generative tools powered by large language models (LLMs) become increasingly widespread [1], [2], users can now conveniently rely on them for text generation and polishing. While these capabilities improve writing efficiency, they also introduce potential risks of misuse [3]. For example, users may exploit LLMs to automatically produce large volumes of papers, news articles, reviews, and other forms of text, thereby disrupting the normal order of content production and undermining the credibility of human-authored writing [4]. Against this backdrop, the effective identification of machine-generated text (MGT) has become an important problem. To address this issue, existing studies have primarily focused on two aspects of MGT identification: binary detection and source attribution [4], [5]. Compared with binary detection, MGT attribution further aims to identify the specific source generator, thereby providing finer-grained evidence for accountability tracking and misuse investigation [6].

Existing MGT attribution methods typically assume a fixed set of generators, which is often an unrealistic assumption in real-world settings. Since the attribution systems operate in a dynamic and open generator space in practice, they should not only recognize newly emerging generators, but also preserve the ability to distinguish previously seen ones. [7] introduces a more realistic setting, known as class-incremental MGT attribution, which we refer to as lifelong MGT attribution throughout this paper. Under this setting, the attribution model needs to be continuously updated as new generator classes arrive over time. However, due to factors such as computational cost, data licensing constraints, or the unavailability of historical data, it is usually impractical to recollect all past data and retrain the model from scratch [8], [9]. At the same time, directly updating the model using only data from new classes often leads to catastrophic forgetting [10], [11]. Therefore, a central challenge in lifelong MGT attribution is efficiently incorporating new generator classes under limited data while maintaining stable recognition of previously learned generators.

Under this challenge, we posit that the difficulty of lifelong MGT attribution does not necessarily need to be addressed by continuously updating the entire text encoder. Instead, a task-tuned encoder trained on the initial set of generators can already capture strong generator-related representations. If this encoder continues to be fine-tuned during the incremental stage, the representation space will continue to shift as new classes arrive, thereby making the decision boundaries of old classes unstable [12], [13]. We therefore seek to decouple the learning of new generators from deep representation updating, ensuring that incremental knowledge is absorbed without altering or disrupting the stable representation space. Motivated by this idea, we propose RidgeFT, an exemplar-free analytic update framework for lifelong MGT attribution. We consider a practical deployment scenario where the attribution system is trained and maintained from the initial stage. During initialization, RidgeFT uses the initial-class data to train a task-aware encoder and construct compact class-wise sufficient statistics; after that, the raw texts of old classes are discarded and never replayed. When new generators arrive, RidgeFT keeps the encoder frozen, maps the new data through covariance calibration and fixed random features, accumulates the corresponding statistics, and updates the classifier by a closed-form ridge solution. In this way, incremental learning is performed through statistical memory rather than historical-text replay or repeated encoder fine-tuning. We evaluate RidgeFT in a multi-topic setting [7], [14], using P3, P4, and P5 protocols that start from 3, 4, and 5 initial classes and incrementally add 3, 2, and 1 new generator classes, respectively. Under the standard P5 protocol, RidgeFT achieves 0.886 full-F1, 0.902 old-class F1, and 0.804 new-class F1, improving full-F1 by 0.037 over the strongest continual-learning baseline.

Our contributions are summarized as follows:

• We identify lifelong MGT attribution as a generator-evolving attribution problem, where the model must preserve generator-specific decision boundaries while suppressing topic-, domain-, and prompt-induced nuisance variation under an exemplar-free update constraint.

• We propose RidgeFT, an exemplar-free analytic update framework that combines fractional covariance calibration, isotropic random feature lifting, and class-balanced closed-form ridge regression, enabling incremental updates using only compact class-wise sufficient statistics.

• We conduct extensive experiments across multiple topics, multiple target generators, and two backbones. The results show that RidgeFT’s main advantage lies in substantially improving new-generator adaptation while maintaining competitive old-generator retention.

2 Related Work↩︎

Establishing effective regulatory mechanisms for MGT has become essential for maintaining content credibility and supporting platform governance [4]. Recent research has pushed MGT detection from idealized binary classification toward more complex real-world scenarios. Studies have not only developed dynamic benchmarks accounting for multilingual settings and model evolution [15], [16], but also improved detector generalization to unseen generators and domains [17]–[19], alongside enhancing robustness against adversarial attacks [20]–[22]. Additionally, phenomena with blurred boundaries, such as human-AI collaborative writing, have fallen into the scope of platform monitoring [14], [23], [24]. However, although MGT detection techniques have made progress in addressing realistic challenges, merely determining whether a text is machine-generated is no longer sufficient to satisfy the growing demands for accountability tracing and copyright attribution.

Compared with binary detection, MGT attribution further requires identifying the specific generator responsible for a text, providing critical evidence for model accountability and forensic analysis [5], [25], and has emerged as an important branch of authorship attribution [26]. While prior studies have explored practical attribution settings [27]–[29], they mostly consider static scenarios where the candidate generator set is fixed. In real-world deployment, rapid LLM updates require attribution models to evolve accordingly to recognize new generators. Simultaneously, data privacy and licensing restrictions often prevent full retraining on historical data. To address this, [7] pioneered class-incremental MGT attribution and evaluated mainstream continual learning methods. Nevertheless, existing approaches still struggle to preserve recognition performance on previously seen generators while learning the characteristics of new ones. Breaking this trade-off between adaptation to new classes and retention of old ones in lifelong MGT attribution remains an unresolved challenge, which is the central problem addressed in this work.

3 Methodology↩︎

In lifelong MGT attribution, continuously fine-tuning the text encoder on new generators alters the representation geometry of old classes, thereby degrading previous decision boundaries. To address this, we propose RidgeFT, which reformulates lifelong attribution as an analytic ridge regression problem based on sufficient statistics. RidgeFT is designed for an attribution system that is trained and maintained from the initial stage, so the required statistics of initial classes can be recorded when those classes are first available. By freezing the base text encoder, RidgeFT preserves prior knowledge and performs analytic updates exclusively on the extracted features. Given an input text \(x\), its frozen representation \(h=f_\theta(x)\) is mapped to the final prediction via a novel sequential pipeline: covariance calibration, isotropic random feature lifting, and class-balanced ridge regression (\(h\rightarrow \tilde{h}\rightarrow z(x)\rightarrow \hat{y}\)). The calibration transform and the initial sufficient statistics are computed once from the base-stage training data and then stored. During later incremental stages, RidgeFT only processes newly arriving class data and does not revisit old raw texts.

Base representations often capture generator-irrelevant variations (e.g., topic, length, domain) as high-variance directions, which impairs subsequent inner-product classifiers. To mitigate this, RidgeFT applies a fractional whitening transformation to suppress within-class noise while preserving the original discriminative geometry. This transform is estimated only from the base-stage training representations and is kept fixed after initialization, so incremental updates do not require replaying previous raw texts.

First, we calculate the within-class scatter matrix \(S_w\): \[S_w=\frac{1}{N-C_0}\sum_{c=1}^{C_0}\sum_{i:y_i=c}(h_i-\mu_c)(h_i-\mu_c)^\top,\] where \(N\) is the total number of base samples, \(C_0\) is the number of base classes, \(h_i\) is the representation of the \(i\)-th sample, and \(\mu_c\) is the feature mean of class \(c\). To address the instability of high-dimensional covariance estimation, we apply trace-scaled shrinkage: \[S_w^{\text{shrink}}=(1-\alpha)S_w+\alpha\frac{\operatorname{tr}(S_w)}{d_h}I_{d_h},\] where \(\alpha\) is the shrinkage parameter, \(\operatorname{tr}(\cdot)\) denotes the matrix trace, \(d_h\) is the feature dimension, and \(I_{d_h}\) is the identity matrix. Finally, we compute the fractionally whitened representation \(\tilde{h}\) via the eigenvalue decomposition of \(S_w^{\text{shrink}}\): \[S_w^{\text{shrink}}=U\Lambda U^\top, \Lambda=\operatorname{diag}(\sigma_1,\ldots,\sigma_{d_h}),\] Given the eigendecomposition of \(S_w^{\mathrm{shrink}}\), we calibrate each principal direction according to its estimated within-class variance: \[P_\delta=U(\Lambda+\epsilon I_{d_h})^{-\delta}U^\top, \tilde{h}=P_\delta(h-\mu).\]

Here, \(U\) and \(\Lambda\) represent the eigenvectors and eigenvalues of \(S_w^{\text{shrink}}\), respectively, with \(\sigma_j\) denoting the \(j\)-th eigenvalue. The parameter \(\delta \in [0,1]\) controls the whitening strength, \(\mu\) is the global feature mean, and \(\epsilon\) is a small constant ensuring numerical stability. By applying a fractional exponent instead of full whitening, we attenuate dominant within-class variations without excessively distorting the original feature space. This provides a stable input for the downstream analytic classifier. As exemplified in 2, this calibration is intended to reduce nuisance directions associated with topic, length, and domain, while preserving generator-related cues for attribution.

After covariance calibration, RidgeFT further lifts the calibrated representations into a fixed nonlinear random feature space to boost the expressive capacity of the analytic classifier without sacrificing closed-form incremental updates. By adopting a non-trainable random mapping [30] instead of a learnable projection layer, we ensure the feature basis remains strictly invariant upon the arrival of new generators.

Let \(\tilde{h}\in\mathbb{R}^{d_h}\) denote the calibrated encoder representation, where \(d_h\) is the feature dimension. RidgeFT samples a Gaussian random matrix \(R\in\mathbb{R}^{d_\phi\times d_h}\) once before incremental learning, with each entry drawn independently as \(R_{ij}\overset{\mathrm{i.i.d.}}{\sim}\mathcal{N}(0,1/d_h)\). The lifted feature is computed as \[z(x)=\operatorname{LN}\left(\operatorname{ReLU}(R\tilde{h})\right)\in\mathbb{R}^{d_\phi},\] where \(d_\phi\) is the random feature dimension and \(\operatorname{LN}(\cdot)\) denotes layer normalization. The matrix \(R\) is fixed throughout all incremental stages, so only the sufficient statistics of the ridge classifier need to be updated.

We use an isotropic Gaussian projection rather than a data-dependent projection learned from base classes. In lifelong MGT attribution, future generators may introduce variation directions that are not present in the initial generator set. A projection fitted to base-class geometry may therefore overemphasize existing class separations and reduce coverage of unseen generator-specific directions. By contrast, isotropic random features provide a task-agnostic nonlinear basis that expands the calibrated representation more uniformly, enabling the downstream ridge regressor to form richer decision boundaries without changing the representation space during continual learning.

Using the random feature representation \(z(x)\), RidgeFT trains the classification head via closed-form ridge regression. Because this analytic approach relies solely on second-order feature statistics, unlike iterative SGD-based methods, we only need to update the sufficient statistics for each class during the incremental stage, strictly eliminating the need to store raw text from old classes.

For each class \(c\), RidgeFT stores only three sufficient statistics in the random feature space: the second-order statistic \(A_c=\sum_{i:y_i=c}z_i z_i^\top\), the first-order statistic \(q_c=\sum_{i:y_i=c}z_i\), and the sample count \(N_c\). These statistics are computed when class \(c\) is first observed and are then retained as statistical memory, so later updates do not require replaying its raw texts. When a new generator arrives, RidgeFT only computes the same statistics for the new class and appends them to the existing table. However, directly summing class statistics can bias the ridge solution toward classes with larger sample counts, since both \(A_c\) and \(q_c\) scale with \(N_c\). To reduce this imbalance, RidgeFT introduces inverse-frequency weights based on class sample counts: \[\label{eq:class95balance95weight} \omega_c= \frac{(N_c+\tau)^{-\beta}}{\frac{1}{|\mathcal{Y}_t|}\sum_{c'\in\mathcal{Y}_t}(N_{c'}+\tau)^{-\beta}}, \qquad c\in\mathcal{Y}_t,\tag{1}\] where \(\mathcal{Y}_t\) is the set of classes observed up to incremental stage \(t\), \(\beta\) controls the strength of reweighting, and \(\tau\) prevents small classes from receiving excessively large weights. We then construct the ridge regression solution using the weighted statistics. Specifically, let \(\bar A=\sum_{c\in\mathcal{Y}_t}\omega_c A_c\), and let the \(c\)-th column of \(\bar B\) be \(\omega_c q_c\). The final classifier is given by \[W=(\bar A+\lambda I_{d_\phi})^{-1}\bar B,\] where \(\lambda>0\) is the ridge regularization coefficient.

By mitigating the dominance of majority classes via reweighting, RidgeFT converts incremental updates into the simple accumulation of sufficient statistics and a single linear system solve. This enables the efficient absorption of new generators without encoder drift. At inference, the model predicts the class maximizing \(s(x)=z(x)^\top W\). 3 summarizes this overall procedure.

4 Experimental Setting↩︎

To simulate the continual emergence of generators in real-world scenarios, we adopt a class-incremental MGT attribution benchmark targeting \(1\) Human source and \(5\) LLMs. We evaluate our method under \(3\) incremental protocols: P3, P4, and P5, which begin with 3, 4, and 5 initial classes, respectively. While P5 follows the standard single-step incremental setting of prior work [7], P3 and P4 are introduced to further increase task difficulty. By starting with smaller base sets and introducing one new class per subsequent step, P3 and P4 involve more incremental stages, thereby imposing substantially stricter requirements on the model’s resistance to catastrophic forgetting.

We conduct experiments on two representative benchmark datasets, which correspond to two major real-world scenarios where LLM misuse poses particularly significant risks: rigorous academic writing and diverse social media interaction. (1) MGT-Academic [7]: This dataset focuses on the academic writing domain and covers three disciplines, namely STEM, Humanities, and Social Science. It includes human-authored text as well as text generated by five mainstream models, namely GPT-3.5³, GPT-4o-mini [31], Moonshot [32], Mixtral-8x7B [33], and Llama-3.1 [34]. We use the full dataset in our experiments, which contains approximately \(73K\) samples in total. (2) AIGTBench (Social Media Subset) [14]: The texts in this subset are drawn from major social media platforms. It likewise contains human-written text and text generated by GPT-3.5, GPT-4o-mini, Llama-1 [35], Llama-2 [36], and Llama-3.1. To ensure rigorous evaluation and class balance, we uniformly sample \(15K\) instances from each class for our experiments.

We follow the experimental protocol of [7] and compare our method against several representative baselines. We include the classical methods LwF [37], iCaRL [38], and BiC [39], as well as the more recent EASE [40], PASS [41] and SimpleCIL [42]. To ensure fair comparison, all replay-based methods use the same memory buffer setting, with 100 stored samples for each old class. As for the backbone, we adopt DeBERTa-v3-base [43] and RoBERTa-base [44] as the text encoders for feature extraction.

All experiments are conducted under the same data splits, incremental protocols, and memory budget. As the primary evaluation metric, we use macro-F1. To provide a more detailed analysis of model behavior, we report not only the overall macro-F1 over all seen classes, but also separate scores on old classes and new classes. This multi-dimensional evaluation enables us to quantify how different methods balance two competing objectives: mitigating catastrophic forgetting on old classes and adapting to newly introduced ones. Unless otherwise specified, we report the mean performance over three random seeds.

5 Experiments↩︎

5.1 Comparison with Baselines↩︎

We compare RidgeFT with a wide range of baselines under \(3\) evaluation protocols. Baselines marked with \(\ast\), such as LwF\(\ast\), iCaRL\(\ast\), BiC\(\ast\), and EASE\(\ast\), denote methods equipped with a replay mechanism that stores historical samples.

As shown in [fig:trajectory_academic,fig:trajectory_social_media], RidgeFT consistently outperforms all baselines across the P3 and P4 incremental stages in both domains. In the academic setting, encompassing the STEM, Humanities, and Social Science datasets, under P3 (sequentially adding Moonshot, Llama-3.1, and GPT-4o-mini), RidgeFT maintains strong old-class F1 (0.913, 0.870, 0.861) and new-class F1 (0.814, 0.729, 0.799) across the three stages. Under P4, it achieves full-F1 scores of 0.862 and 0.838, significantly outpacing the strongest baseline, which drops from 0.797 to 0.730. This highlights that replay-based baselines still struggle to balance old and new classes, while replay-free baselines such as PASS and SimpleCIL are even more limited when generator classes arrive sequentially. This robust advantage extends to the social media setting, where RidgeFT sustains high full-F1 scores across the P3 stages (0.945, 0.868, 0.855) and P4 stages (0.878, 0.867). Notably, at the final social media P4 stage, RidgeFT’s new-class F1 reaches 0.899, substantially beating the strongest baseline (0.735). These results confirm that RidgeFT remains stable absorbing continuous generator arrivals without compromising past knowledge.

This advantage is further confirmed under the P5 protocol (refer to 1). Averaged over the two backbones, RidgeFT achieves 0.886 full-F1, 0.902 old-class F1, and 0.804 new-class F1. Compared with the strongest full-F1 baseline, it improves full-F1 by 0.037. Compared with the best baseline on new-class F1, it improves new-class F1 by 0.107, while also outperforming the best old-class baseline on old-class F1. This reveals a core limitation of baselines: they are better at preserving the decision boundaries of previously learned features, yet remain less effective at efficiently absorbing information from new classes. In contrast, RidgeFT not only performs better in retaining old classes, but also delivers a substantial improvement on the more critical task of recognizing new classes, surpassing the strongest baseline by 0.107.

Finally, using GPT-4o-mini as the target generator (STEM / DeBERTa-base / P5), we analyze the impact of target-class data proportions. As shown in 5, when reducing target-class data from 100% to 5%, RidgeFT’s full-F1 remains highly stable (ranging from 0.919 to 0.908). Conversely, the strongest replay baseline (LwF\(\ast\)) averages only 0.893, and the replay-free SimpleCIL drops to 0.831. This confirms that RidgeFT does not rely on abundant new-class data, demonstrating superior data efficiency and robustness even under severe low-resource incremental conditions.

5.2 Ablation Studies↩︎

We ablate the \(3\) core components of RidgeFT using GPT-4o-mini as the target generator (STEM / DeBERTa-base / P5). As shown in 2, each component contributes distinctly, and they are highly complementary. When Whitening is used alone, the model can stabilize encoder features to some extent, but its adaptability remains limited under low-resource conditions. For example, with only \(20\%\) of the new-class data, the new-class F1 reaches only \(0.741\). In contrast, Random Feature Lift consistently outperforms Whitening across all data ratios, indicating that random nonlinear features enhance the separability of different generators. Class-Balanced Ridge (CBR) is the strongest individual component. Even with only \(20\%\) of the data, it achieves a new-class F1 of \(0.865\), suggesting that it plays a central role in mitigating the bias between old and new classes. Notably, both CBR and the full RidgeFT exhibit stability across data ratios ranging from \(20\%\) to \(100\%\). According to 1 , when \(\beta=1\) and \(\tau=0\), the class weight satisfies \(\omega_c \propto 1/N_c\), which exactly offsets the linear growth of class statistics (\(A_c, q_c\)) with respect to the sample size \(N_c\). Consequently, the ridge update effectively operates on class-averaged statistics, rendering the model largely insensitive to the sampling ratio once stable estimation is reached. Finally, combining all three components yields the best overall performance. Their complementarity is particularly evident in the \(20\%\) low-resource setting, where the full RidgeFT boosts the new-class F1 from \(0.865\) (CBR alone) to 0.878. Additional frozen-representation analysis is provided in 7.

6 presents the hyperparameter sensitivity of RidgeFT. Overall, it exhibits strong robustness to most hyperparameters. For example, varying the smoothing constant \(\tau\) and the ridge regularization coefficient \(\lambda\) causes almost no performance fluctuation, with Full-F1 remaining consistently around \(0.919\). From the perspective of feature stabilization, a moderate amount of trace shrinkage, with \(\alpha \in [0.05, 0.10]\), is already sufficient to ensure reliable covariance estimation. The covariance calibration exponent \(\delta\) performs best in the range \([0.375, 0.625]\), with Full-F1 reaching \(0.919\) at \(\delta=0.5\). However, overly strong calibration, such as \(\delta=1.0\), instead suppresses useful discriminative information in the features and leads to a performance drop. In terms of performance gains, the random feature dimension \(d_\phi\) and the class reweighting strength \(\beta\) play the most important roles. As \(d_\phi\) increases from \(512\) to \(8192\), the higher-dimensional feature space substantially improves the separability of new generators, steadily raising Full-F1 and new-class F1 to \(0.9201\) and \(0.890\), respectively. In addition, under the low-resource setting with \(20\%\) data, strong reweighting with \(\beta=1.0\) boosts new-class F1 by nearly 12 percentage points compared with the unweighted case \(\beta=0\), increasing it from \(0.760\) to \(0.878\). This highlights its decisive role in alleviating the severe imbalance between old and new classes.

Although RidgeFT is exemplar-free, it is not memory-free. Its closed-form update still requires storing the statistics needed for ridge regression: the calibration parameters, the fixed projection matrix \(R\), and the class-wise sufficient statistics \(A_c\), \(q_c\), and \(N_c\). The high-dimensional \(A_c \in \mathbb{R}^{d_\phi \times d_\phi}\) dominates this storage cost. Under the default setting (\(d_\phi=4096\), \(6\) classes), the fp64 implementation requires \(782.35\) MiB in total, with the six class-specific \(A_c\) matrices alone accounting for \(768\) MiB.

To reduce this bottleneck, we examine compression along two orthogonal dimensions. The first is numerical precision (fp32 or bf16), which preserves the full class-wise statistic table. This retains the flexibility to reweight classes post-training or incorporate new samples into previously seen classes. The second is class aggregation, which stores only the weighted merged matrix \(\bar A=\sum_c \omega_c A_c\). This significantly reduces the memory footprint but folds the current class weights into the matrix, sacrificing the ability to update old classes individually. Importantly, this limitation is fully compatible with our P3/P4/P5 protocols, where incremental stages only introduce new generator classes.

As shown in 3, RidgeFT is highly robust to low-precision storage. Reducing per-class \(A_c\) to fp32 or bf16 substantially cuts storage while keeping the Full-F1 consistently above 0.919. Class aggregation yields even larger gains by removing redundant class-specific matrices. Among all variants, merged bf16 provides the optimal trade-off: it requires only 46.35 MiB (a \(16.9\times\) compression ratio) while achieving a Full-F1 of 0.920. Overall, RidgeFT should be viewed as replay-free rather than storage-free. Merged bf16 is the most compact choice for our new-class-only protocols, whereas per-class bf16 is preferable if future updates may add samples to old classes.

6 Conclusion↩︎

This paper addresses the challenge of lifelong MGT attribution: continuously learning new generators without suffering catastrophic forgetting or relying on historical text replay. To overcome the dilemma between representation drift (from fine-tuning) and memory overhead (from exemplars), we propose RidgeFT. By freezing a task-tuned encoder and formulating incremental adaptation as closed-form ridge regression, our replay-free framework balances old and new classes without encoder parameter updates. Extensive experiments confirm that RidgeFT achieves a superior trade-off against baselines, demonstrating that combining stable representations with analytic updates offers a scalable path for future MGT attribution systems.

Limitations↩︎

Although RidgeFT achieves strong performance in lifelong MGT attribution, it still has several limitations.

• Storage Requirements and Compression: RidgeFT is replay-free rather than completely storage-free. In other words, although it does not require storing raw text samples from old classes, its closed-form ridge updates still rely on storing the covariance calibration parameters, the fixed random projection matrix, and the class-level sufficient statistics. While our compression study shows that the storage cost can be substantially reduced through low-precision storage and statistical merging, how to further compress these statistical quantities remains an important direction for future research.

• Multilingual Extension: Our experiments are mainly conducted on English datasets. Since RidgeFT operates in the encoder representation space rather than relying on language-specific surface-level textual features, we believe that it has the potential to extend to multilingual MGT attribution. A natural direction for future work is to combine RidgeFT with multilingual encoders and systematically evaluate its effectiveness across more languages and cross-lingual generator settings.

• Long-term Deployment and Representation Stability: Because RidgeFT does not continue updating the deep encoder during the incremental stage, but instead relies on a fixed representation space, a fixed random feature mapping, and closed-form ridge updates, it should not be interpreted as a method that can absorb an unlimited number of new generators over an arbitrarily long time horizon without performance degradation. As future generators become increasingly different from those seen during the initial training stage, the frozen representation may contain insufficient generator-specific information, which can weaken the effectiveness of later incremental updates. Therefore, in longer-term deployment scenarios, an important open question is how to introduce periodic encoder adaptation or calibration refresh while preserving representation stability.

Ethical Considerations↩︎

This work focuses on lifelong machine-generated text attribution under benchmark settings. It does not collect private user data, involve human subjects, or introduce new generative or attack capabilities. The main potential risk lies in the deployment of attribution systems: imperfect predictions may cause incorrect judgments about the source of a text. Therefore, we suggest that MGT attribution models should be used as auxiliary evidence rather than as the sole basis for high-stakes decisions. Real-world deployment should further consider domain shift, transparency, and human oversight.

7 Sufficiency Analysis of Frozen Representations↩︎

Since RidgeFT freezes the task-tuned encoder during the incremental stage, a natural question arises: do frozen representations still preserve discriminative information for future generators? To answer this question, we compare three feature spaces derived from the same frozen encoder: the raw representation \(h=f_\theta(x)\), the covariance-calibrated representation \(\tilde{h}=P_\delta(h-\mu)\), and the random feature representation \(z=\mathrm{LN}(\mathrm{ReLU}(R\tilde{h}))\). We diagnose these feature spaces using nearest-centroid probes and ridge probes, where none of the methods updates the encoder parameters.

This analysis is conducted under the P5 protocol, where the model is first trained on five initial classes and GPT-4o-mini is introduced as the final new generator. As shown in 4, applying a ridge probe directly on the raw frozen representation \(h\) already yields a new-class F1 of \(0.844\), which suggests that the frozen encoder is not limited to the initial classes and still preserves useful discriminative cues for subsequent generators. Building on this, RidgeFT further improves the new-class F1 to \(0.860\), while also maintaining stable old-class F1. On the other hand, the nearest-centroid probe improves from \(0.495\) on \(h\) to \(0.730\) on \(z\), indicating that the feature transformations in RidgeFT make the class structure more suitable for statistic-based analytic classification.

It should be noted that this analysis does not imply that a frozen encoder is always sufficient for arbitrary future generators. The random feature mapping can only enhance the usability of the information already present in the frozen representation, but it cannot recover generator-specific information that is entirely absent from the encoder. Therefore, RidgeFT is better suited to scenarios where the frozen representation still provides at least partial coverage of future generators. For generators that are extremely out of distribution, periodic adaptation of the encoder may still be necessary.

8 Artifact Licenses, Intended Use, and Data Safety↩︎

We use two publicly released benchmark datasets, MGT-Academic [7] and AIGTBench [14], and do not collect any new user data. MGT-Academic is released under the MIT license, and AIGTBench is released under the Apache 2.0 license. Both datasets are released for research on machine-generated or AI-generated text detection/attribution, and our use is consistent with their intended research purposes. We cite the original datasets and papers, and we do not redistribute the raw datasets as part of this work.

For privacy and content safety, we use the processed benchmark versions released by the original authors. These datasets have already undergone preprocessing and moderation by their respective creators. Our experiments only use text content and class labels for aggregate model training and evaluation, and we do not analyze, expose, or redistribute any individual-level information.

9 Software Implementations and Package Settings↩︎

All experiments were conducted in a Linux environment with kernel version 5.4.0-174-generic and Python 3.12.2. We used PyTorch 2.10.0+cu128 with CUDA 12.8 on an NVIDIA L20 GPU with driver version 550.54.15. Transformer encoders and tokenizers were implemented with HuggingFace Transformers 4.57.6, using DeBERTa-v3-base and RoBERTa-base as the main backbones. Encoder fine-tuning followed a unified configuration with a maximum sequence length of 256, batch size 16, 3 training epochs, AdamW optimization, weight decay, and gradient clipping.

Traditional machine learning classifiers and evaluation metrics were implemented with scikit-learn 1.7.2. Numerical computation relied on NumPy 2.0.1 and SciPy 1.15.2, while result aggregation and visualization used Pandas 2.2.3 and Matplotlib 3.9.1. For RidgeFT, we fixed the main hyperparameters across all primary experiments: fractional whitening exponent \(\delta=0.5\), shrinkage coefficient \(\alpha=0.05\), random feature dimension \(d_\phi=4096\), ridge regularization coefficient \(\lambda=1.0\), and class-balanced ridge coefficient \(\beta=1.0\). Each experiment was run three times, and we report the average results.

10 Computational Experiments↩︎

We report the computational cost of different update strategies on a single NVIDIA L20 GPU. Under the P5 protocol with DeBERTa-v3-base, RidgeFT updates the classifier by recomputing sufficient statistics and solving a closed-form ridge regression problem, which only takes a few seconds for the newly added generator. In contrast, the joint-from-scratch baseline retrains an 184M-parameter DeBERTa-v3-base model on all old and new training texts, involving about 94k samples, and takes approximately 50 minutes on a single GPU. The initial five-class encoder training is shared across methods and takes 1,738 seconds.

These results show that RidgeFT achieves much lower incremental update cost than full retraining, while avoiding access to old raw texts during the update stage. This efficiency advantage is central to our lifelong MGT attribution setting, where attribution systems must incorporate newly emerging generators without repeatedly retraining the entire model.

11 Use of AI Assistants↩︎

We used AI assistants only for language polishing, grammar checking, and improving the readability of the manuscript. All research ideas, experimental designs, implementation decisions, experimental results, analyses, and final claims were developed, checked, and approved by the authors. The AI assistants were not used to independently generate, validate, or interpret experimental results, and they are not listed as authors.

References↩︎