Elamur Research⌕
☰
home / papers / 2026 / From Detection to Attribution: Forensic Linguistics and Adversarial Red Teaming as Complementary Responses to LLM Misuse

From Detection to Attribution: Forensic Linguistics and Adversarial Red Teaming as Complementary Responses to LLM Misuse

Paper · 2026 · Rui Sousa-Silva

Summary

Large language models make it cheap to produce hostile or deceptive text that imitates a specific person, and safety guardrails are often bypassed. Detection tools based on statistics, machine learning or stylometry tend to fail against adaptive adversaries. They also give opaque outputs that legal settings struggle to accept. This paper tests whether forensic linguistic (FL) analysis rooted in the theory of idiolect can complement such tools.

Using a red teaming setup, the author gave three LLMs a roughly 10,000-word sample of a real person's writing with a deliberately simple prompt. The prompt requested an abusive text against a fictitious academic society written in that person's style. All models complied, which shows that guardrails can be evaded. The genuine texts (K) and generated impersonations (Q) were then compared using stylometric, character n-gram and cluster analysis, plus qualitative idiolect analysis.

The quantitative methods gave only moderate, non-conclusive evidence of different authorship, which falls short of admissibility standards. The qualitative FL analysis separated genuine from impersonated writing more convincingly and explained why. This matters for investigations that need interpretable expert evidence.

Key points

  • Data: The known-author corpus (~10,000 words) mixes academic prose, emails and short messages. It was used as the style sample for generating toxic texts aimed at a made-up organisation, "ISAT", with three LLMs.
  • Quantitative results:
    • The K text formed its own isolated cluster.
    • Sentence length, dash usage, quotation marks and Yule's K distinguished K from Q.
    • The Q texts resembled each other more than any of them resembled K.
    • Character n-grams showed the author's dash use is a structural habit, not an accident.
  • Qualitative markers:
    • The genuine author hedges and uses concessives such as "however" and "on balance".
    • The genuine author frames requests collaboratively, uses procedural first-person reference and relies on explicit reasoning connectors.
    • The impersonations escalate conflict with categorical certainty, overt face threats, derogatory vocabulary and accusatory rhetorical questions.
  • Main argument: Interpretable, theory-backed FL evidence should carry more weight than black-box classifier scores in legal and investigative work.
  • Limitations and future work:
    • The corpus is small.
    • The analysis omitted function-word, syntactic and semantic features and trained no ML classifiers.
    • There was no inferential statistical testing.
    • Planned extensions are a larger reference corpus, cross-validated classifiers and thresholds for within-author variation.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Fields, topics and concepts

📚 Shelves 2The field of science this work belongs to (OpenAlex fields).Computer Science · 16,667 worksArtificial Intelligence · 16,194 works

🧭 Topics 1Research subjects and languages the work is about.Bias, fairness & safety · 517 works

Cite

Cite as Rui Sousa-Silva. 2026. From Detection to Attribution: Forensic Linguistics and Adversarial Red Teaming as Complementary Responses to LLM Misuse. Proceedings of the Second International Conference on Natural Language Processing and Artificial Intelligence for Cyber Security.

The paper itself, not this page. BibTeX from the library's record of the work.

@inproceedings{sousasilva2026detection,
  title = {{From Detection to Attribution: Forensic Linguistics and Adversarial Red Teaming as Complementary Responses to LLM Misuse}},
  author = {Rui Sousa-Silva},
  booktitle = {Proceedings of the Second International Conference on Natural Language Processing and Artificial Intelligence for Cyber Security},
  year = {2026},
  url = {https://aclanthology.org/2026.nlpaics-1.13/}
}

References

33 references, 6 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Joymallya Chakraborty, Wei Xia, Anirban Majumder, Dan Ma, Walid Chaabene, and Naveed Janvekar. 2024. DetoxBench: Benchmarking Large Language Models for Multitask Fraud & Abuse Detection. ArXiv, abs/2409.06072. — [arXiv:2409.06072](https://arxiv.org/abs/2409.06072) find
  2. Canyu Chen and Kai Shu. 2023. Can LLM-Generated Misinformation Be Detected? ArXiv, abs/2309.13788. find
  3. Malcolm Coulthard. 2004. Author Identification, Idiolect and Linguistic Uniqueness. Applied Linguistics, 25(4):431–447. find
  4. Badhan Chandra Das, M. Hadi Amini, and Yanzhao Wu. 2024. Security and Privacy Challenges of Large Language Models: A Survey.
  5. This study complies with the ACL Ethics Policy. The analysis uses genuine texts from a known au-Boyi Deng, Wenjie Wang, Fuli Feng, Yang Deng, Qi-thor with the author’s informed consent. To protect fan Wang, and Xiangnan He. 2023. Attack Prompt privacy and reduce re-identification risk, the orig-Gene… — [arXiv:2310.12505](https://arxiv.org/abs/2310.12505) find
  6. IOCTA 2026. IOCTA (Threat Assess-tive forensic linguistic analysis was conducted of ment on Internet Facilitated Organised Crime). Publi-discursive patterns. Because both quantitative sty-cations Office of the European Union, LU. lometry and qualitative discourse profiling can sup-Emilio Ferrara. 20… find
  7. Tim Grant. 2021. Text messaging forensics - Txt 4n6: idiolect-free authorship analysis? In Malcolm Coulthard, Alison May, and Rui Sousa-Silva, editors, The Routledge Handbook of Forensic Linguistics, 2 edition, pages 558–575. Routledge, London & New York. find
  8. Xinyue Shen, Zeyuan Chen, M. Backes, Yun Shen, and Yang Zhang. 2023. "Do Anything Now": Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Models. Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security.
  9. Daniel Kang, Xuechen Li, Ion Stoica, Carlos Guestrin, M. Zaharia, and Tatsunori Hashimoto. 2023. Exploiting Programmatic Behavior of LLMs: Dual-Use Through Standard Security Attacks. 2024 IEEE Security and Privacy Workshops (SPW), pages 132–143. find
  10. Rui Sousa-Silva. 2024. Fighting Cyber-malice: A Forensic Linguistics Approach to Detecting AI-generated Malicious Texts. In Proceedings of the First International Conference on Natural Language Processing and Artificial Intelligence for Cyber Security (NLPAICS’2024), pages 164–174, Lancaster, UK. find
  11. Hanna Kim, Minkyoo Song, S. Na, Seungwon Shin, and Kimin Lee. 2024. When LLMs Go Online: The Emerging Threat of Web-Enabled LLMs. pages 1729–1748. find
  12. Tharindu Kumarage, Garima Agrawal, Paras Sheth, Raha Moraffah, Amanat Chadha, Joshua Garland, and Huan Liu. 2024. A Survey of AI-generated Text Forensic Systems: Detection, Attribution, and Characterization. ArXiv, abs/2403.01152. — [arXiv:2403.01152](https://arxiv.org/abs/2403.01152) find
  13. Miles Q. Li and Benjamin C. M. Fung. 2025. Security Concerns for Large Language Models: A Survey. J. Inf. Secur. Appl., 95:104284.
  14. Zilong Lin, Jian Cui, Xiaojing Liao, and XiaoFeng Wang. 2024. Malla: Demystifying Real-world Large Language Model Integrated Malicious Services. ArXiv, abs/2401.03315. — [arXiv:2401.03315](https://arxiv.org/abs/2401.03315) find
  15. Zilong Lin, Zichuan Li, Xiaojing Liao, and XiaoFeng Wang. 2025. Consiglieres in the Shadow: Understanding the Use of Uncensored Large Language Models in Cybercrimes. ArXiv, abs/2508.12622. — [arXiv:2508.12622](https://arxiv.org/abs/2508.12622) find
  16. Xin Liu, Yichen Zhu, Jindong Gu, Yunshi Lan, Chao Yang, and Yu Qiao. 2024. MM-SafetyBench: A Benchmark for Safety Evaluation of Multimodal Large Language Models. find
  17. Alison May, Rui Sousa-Silva, and Malcolm Coulthard. 2021. Introduction. In Malcolm Coulthard, Alison May, and Rui Sousa-Silva, editors, The Routledge Handbook of Forensic Linguistics, 2 edition, pages 1–8. Routledge, London and New York. find
  18. Gerald R McMenamin. 1993. Forensic Stylistics. Elsevier, Amsterdam. find
  19. Gerald R. McMenamin. 2001. Style markers in authorship studies. Forensic Linguistics, 8(2):93–97. find
  20. Maximilian Mozes, Xuanli He, Bennett Kleinberg, and L. D. Griffin. 2023. Use of LLMs for Illicit Purposes: Threats, Prevention Measures, and Vulnerabilities. ArXiv, abs/2308.12833. — [arXiv:2308.12833](https://arxiv.org/abs/2308.12833) find
  21. Sayak Saha Roy, Poojitha Thota, Krishna Vamsi Naragam, and Shirin Nilizadeh. 2024. From Chatbots to Phishbots?: Phishing Scam Generation in Commercial Large Language Models. In 2024 IEEE Symposium on Security and Privacy (SP), pages 36– 54. find
  22. Ruixiang Tang, Yu-Neng Chuang, and Xia Hu. 2023. The Science of Detecting LLM-Generated Text. Communications of the ACM, 67:50 – 59. find
  23. Haoyu Wang, Bingzhe Wu, Yatao Bian, Yongzhe Chang, Xueqian Wang, and Peilin Zhao. 2024. Probing the Safety Response Boundary of Large Language Models via Unsafe Decoding Path Generation. find
  24. Huandong Wang, Wenjie Fu, Yingzhou Tang, Zhilong Chen, Yuxi Huang, Jinghua Piao, Chen Gao, Fengli Xu, Tao Jiang, and Yong Li. 2025. A Survey on Responsible LLMs: Inherent Risk, Malicious Use, and Mitigation Strategy. find
  25. Laura Weidinger, Jonathan Uesato, Maribeth Rauh, Conor Griffin, Po-Sen Huang, John Mellor, Amelia Glaese, Myra Cheng, Borja Balle, Atoosa Kasirzadeh, Courtney Biles, Sasha Brown, Zac Kenton, Will Hawkins, Tom Stepleton, Abeba Birhane, Lisa Anne Hendricks, Laura Rimell, William Isaac, Julia Haas, Sea… find
  26. Jiaxin Wen, Pei Ke, Hao Sun, Zhexin Zhang, Chengfei Li, Jinfeng Bai, and Minlie Huang. 2023. Unveiling the Implicit Toxicity in Large Language Models. ArXiv, abs/2311.17391.
  27. Akila Wickramasekara, F. Breitinger, and Mark Scanlon. 2024. SoK: Exploring the Potential of Large Language Models for Improving Digital Forensic Investigation Efficiency. Forensic Sci. Int. Digit. Investig., 52:301859. find
  28. Junchao Wu, Shu Yang, Runzhe Zhan, Yulin Yuan, Lidia Sam Chao, and Derek Fai Wong. 2025. A Survey on LLM-Generated Text Detection: Necessity, Methods, and Future Directions. Computational Linguistics, 51(1):275–338.
  29. Zonghao Ying, Aishan Liu, Siyuan Liang, Lei Huang, Jinyang Guo, Wenbo Zhou, Xianglong Liu, and Dacheng Tao. 2024. SafeBench: A Safety Evaluation Framework for Multimodal Large Language Models. find
  30. Chi Zhang, Changjia Zhu, Junjie Xiong, Xiaoran Xu, Lingyao Li, Yao Liu, and Zhuo Lu. 2025. Guardians and Offenders: A Survey on Harmful Content Generation and Safety Mitigation of LLM. ArXiv, abs/2508.05775. — [arXiv:2508.05775](https://arxiv.org/abs/2508.05775) find
  31. Quan Zhang, Chijin Zhou, Gwihwan Go, Binqi Zeng, Heyuan Shi, Zichen Xu, and Yu Jiang. 2024. Imperceptible Content Poisoning in LLM-Powered Applications. In Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering, ASE ’24, page 242–254, New York, NY, USA. Associati… find
  32. Ying Zhao, Yuanzhao Guo, Xuemeng Weng, Yuan Tian, Wei Wang, and Yi Chang. 2025. Detoxifying Large Language Models via the Diversity of Toxic Samples. In Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing, pages 5858–5871, Suzhou, China. Association for Computation… find
  33. Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J. Zico Kolter, and Matt Fredrikson. 2023. Universal and Transferable Adversarial Attacks on Aligned Language Models.

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/silva-2026-detection-attribution-forensic-linguistics-adversarial/