SHADE: Trace-Based Humanization for Robust and Composable AI-Text Detector Evasion

Abstract

Low frozen-detector scores do not establish that machine-specific evidence has been removed: an attack may remain easy to relearn. We study trace-based humanization, which targets measurable machine–human discrepancies using genre-matched human reference bands and preserves previously neutralized coordinates. SHADE combines controlled generation with local feature-specific edits. Its primary endpoint, NS10, is developed against interpretable FZ features and Ghostbuster, then frozen. On a disjoint 74-source RAID complement, it reduces AUROC on five detector families from $.910/.906/.985/.835/.775$ to $.489/.706/.732/.537/.550$, with all paired reduction intervals excluding zero. Nested 20/30/40-example attack exposure produces near-zero recovery for GLTR and Binoculars, negative recovery for WaveDetect, partial recovery for Ghostbuster, and strong RoBERTa recovery at two budgets. This contrast separates frozen evasion from relearning resistance and identifies a residual coverage boundary. On the original 54-source composition cohort, RoBERTa-guided RAFT after NS10 improves on both constituents across all five detectors, with pointwise paired gain intervals excluding zero; the same module after StealthRL is complementary on only two. The results support measurable trace neutralization as a basis for controllable attacks, detector-specific adaptation tests, and complementary residual composition.