We present TextSeal2, a distortion-free watermark for large language models that keeps its signal under speculative decoding: tokens that replace rejected drafts remain watermarked with the same keys, and the acceptance rate is unchanged. It also preserves output diversity and adds no measurable inference latency. Its predecessor, TextSeal, restores diversity in the Gumbel-max scheme by routing each token to one of two keys via a coin flip. This is suboptimal because the detector averages the scores from both keys without knowing which key was used. TextSeal2 instead merges two or more keys into a single virtual key and couples it to fresh noise through AutoMark's Gaussian copula. Any number of keys, including publicly shared keys, can be merged this way without diluting detection. Under speculative decoding, TextSeal2 verifies keyed drafts with one more exponential race, run on the leftovers of the draft races. By memorylessness, this race reproduces block verification, so the output follows the target model exactly. We evaluate TextSeal2 on three LLMs. At equal output token diversity, TextSeal2 detects 8 to 22 percentage points more 100-token answers than TextSeal at a false-positive rate of 10−3, and is comparable to textGrain while requiring no post-logits optimization. Under speculative decoding, it detects 18 and 22 percentage points more 200-token answers than TextSeal and textGrain, respectively, at the same acceptance rate.
Figures & tables
Method
Speculative decoding
Acceptance kept
Extra post-logits work
✗
✓
SynthID-Text (tournament)
89 ± 3
50 ± 2
✓
O(L∣A∣)
TextSeal (coin flip)
81 ± 1
71 ± 2
✓
none
AutoMark copula
91 ± 3
60 ± 2
✓
none
textGrain
89 ± 4
67 ± 4
✓
Sinkhorn, O(NitBm)
textGrain, own speculative-decoding recipe
–
84 ± 6
✗ ( −5% tokens/round)
Sinkhorn, O(NitBm)
Table 1: Detection on Qwen3.5-9B (ELI5, temperature 1, top- p 0.95), at fixed diversity: % of 200-token answers detected at a false-positive rate (FPR) of 10−3 . Gray: half-width of the 95% bootstrap interval; bold: best; underlined: second best, per column. Speculative decoding: Qwen3.5-0.8B drafts 8 tokens per round, with block verification; TextSeal2 uses the residual race, the baselines use block verification’s native stopping rule with the last token of each round drawn under an independent key, and textGrain’s own recipe verifies the watermarked distributions. Acceptance is kept when tokens per round do not drop below those of unwatermarked block verification (2.74; paired over 480 prompts, Figure 11 in Appendix G ). Nit : Sinkhorn iterations on a B×m table (1–3 ms per token, Appendix D ); L : tournament layers over candidates A . TextSeal2 equals AutoMark’s copula in distribution; their gap under speculative decoding is the residual race.
Figure 1: Diversity–detection trade-off on Qwen3.5-9B at 100 tokens at FPR= 10−3 , (a) without and (b) with speculative decoding (8 drafts per round, block verification). In (a), TextSeal2 coincides with AutoMark’s single-key copula as expected since it behaves like a single-key copula. In (b), TextSeal2 uses the residual race, and the baselines use block verification’s native stopping rule with the last token of each round drawn under an independent key. Diversity is measured by Self-BLEU (lower is more diverse).
Figure 2: TextSeal2 generates one token ( subsection 3.1 ). (a) The model’s forward pass gives the probabilities pv , and the last k=3 tokens form the window w . (b) The keys’ values at w are merged into the virtual key Gv⋆ , which the copula ( 4 ) blends with the noise ηv into R~v ; the Gumbel-max choice is argminv(−lnR~v)/pv . (c) The Gumbel-max choice can be seen as a race ( 1 ): candidate v runs a lane of length Ev=−lnR~v at speed pv , and the token that finishes first is chosen.
Figure 3: Block verification checks the drafts against the target as a block, keeps those before a stop position I , and emits one token y at I . (a) The drafter proposes “the mat” with keyed races. (b) One target pass then gives the probability πi,v that I=i and y=v . One more race on the leftovers picks I and y : “floor” wins, so the round keeps “the” and emits “floor” at I=2 . TextSeal2 preserves the target’s distribution and block verification’s acceptance rate ( Proposition 1 ). Algorithm 1 in the appendix gives more details.
Figure 4: TextSeal2 detects the text “The cat sat on the floor and fell asleep in the sun.” ( subsection 3.4 ). (a) Each token xi and its window wi ; the highlighted row is the token of Figure 2 . (b) For “floor”, the keys’ values are merged into Gxi⋆ as in ( 4 ), without the noise, and give the score si⋆ ; key k(1) alone gives the public score si(1) . (c) The n=10 scores sum to S=23.9 , and the Gamma(n,1) tail beyond S (box) is p=4.6⋅10−4 .
Figure 5: Entropy weighting improves detection for every watermark, including under speculative decoding. % of 100-token answers detected at a false-positive rate of 10−3 with key-only scores (light bars) and with TextSeal’s entropy-weighted test (full bars), at comparable Self-BLEU. The gains are 5–18 percentage points at 100 tokens and 4–23 at 200 tokens ( Table 6 ); without speculative decoding, TextSeal2 and AutoMark’s copula coincide in distribution and differ only within their 95% intervals, as expected.
Appendix figures & tables18 assets
Supplementary material from the paper’s appendix.
Appendix
Next-token distribution
Gaussian score
TextSeal score
uniform over 8 tokens
0.998 / 0.998 / 1.000
0.915 / 0.962 / 0.992
Zipf(1.1) over 24 tokens
0.982 / 0.988 / 0.993
0.908 / 0.960 / 0.989
top token 0.5, Zipf tail
0.966 / 0.978 / 0.987
0.911 / 0.959 / 0.990
top token 0.8, Zipf tail
0.929 / 0.938 / 0.942
0.908 / 0.952 / 0.973
Appendix
Table 2: Copula race vs the best distortion-free coupling at equal entropy removed: ratio of per-token signal-to-noise ratios, for the Gaussian score s=g and TextSeal’s score s=−ln(1−u) , at couplings ρ=0.5/0.8/0.95 (the fraction of each token’s entropy removed by the key is then about 0.16 / 0.45 / 0.72).
Shape
H (nats)
ρ=0.5
0.7
0.8
0.9
0.95
uniform over 2
0.69
0.125
0.272
0.385
0.550
0.677
uniform over 8
2.08
0.147
0.308
0.426
0.590
0.712
uniform over 64
4.16
0.173
0.353
0.477
0.640
0.754
flat Zipf(0.8)
4.07
0.173
0.354
0.479
0.641
0.750
pmax=0.5
2.42
0.170
0.350
0.475
0.638
0.750
pmax=0.95
0.37
0.183
0.370
0.493
0.652
0.757
Appendix
Table 3: Fraction of each token’s entropy removed at a fixed coupling ρ , on synthetic distributions.
textGrain
Batch
Top- p (all)
TextSeal
TextSeal2
minimal
A.1, 10 / 20 / 30 it.
A.1 calibrated, β=0.25/0.5
1
0.16
0.020
0.018
0.22–0.40
1.1 / 2.1 / 3.0
2.3 / 4.1
8
0.72
0.030
0.025
0.28–0.50
1.4 / 2.6 / 3.8
2.4 / 4.5
64
2.14
0.15
0.12
0.98–1.24
3.8 / 6.7 / 9.5
2.7 / 4.8
Appendix
Table 4: Post-logits latency per decoding step (ms, median of 200 CUDA-graph replays, or 50 eager runs for calibrated textGrain, whose calibration loop has data-dependent control flow; one H200, vocabulary of 248,320 tokens, synthetic high-entropy logits). Top- p filtering is shared by all methods. The minimal textGrain version uses 5–20 Sinkhorn iterations on the 256×256 kernel without calibrating λ .
Batch
Plain sampling
TextSeal
TextSeal2
TextSeal, overlapped
TextSeal2, overlapped
1
50.44
50.85
51.08
50.69
50.87
8
52.39
52.54
52.64
52.52
52.79
64
56.46
58.43
61.34
56.81
56.93
Appendix
Table 5: Full decoding step (ms, median), Qwen3.5-9B; overlapped: key-only work on a side CUDA stream.
Model
Method
Self-BLEU
Key-only
Entropy-weighted
Llama-3.1-8B
TextSeal
23.9
53 / 82
58 / 91
textGrain
24.1
55 / 86
67 / 94
AutoMark copula
23.9
63 / 90
71 / 95
TextSeal2
23.9
64 / 90
71 / 95
Qwen3.5-9B
TextSeal
20.6
42 / 82
59 / 93
textGrain
20.9
65 / 91
74 / 97
Appendix
Table 6: Key-only vs. entropy-weighted detection (TextSeal’s weighted Gamma test): % of 100 / 200-token answers detected at a false-positive rate of 10−3 , with thresholds calibrated per test over 10 keys and 10,000 unwatermarked answers. First 1000 answers per configuration without speculative decoding; last block: all 3000 answers with speculative decoding (8 drafts, block verification). Strengths: α=0.5 (TextSeal), β=0.5 (textGrain), ρ=0.9 (copulas, 53-bit PRF). For SynthID-Text, the key-only test is its official binomial test and the weighted test is the same Gamma test applied to twice its mean coin score. Self-BLEU over 32 answers to each of 100 questions. Weighting improves every method by 4–23 percentage points at 200 tokens, and the two copulas remain level without speculative decoding, as they must in distribution.
Figure 6: The diversity–detection trade-off of Figure 1 at 200 tokens instead of 100; same protocol and conventions, including the speculative panel (b).
Figure 7: Diversity (Self-BLEU; lower is more diverse) vs. detection of 100-token answers without speculative decoding, on three models (32 answers to each of 100 questions; copulas with the 53-bit PRF). Interpolated at TextSeal’s Self-BLEU, TextSeal2 gains 10, 22 and 8 percentage points over the coin flip on Llama-3.1-8B, Qwen3.5-9B and Qwen3.5-27B respectively, and AutoMark’s copula overlaps TextSeal2 throughout.
Method
Clean
10% subst.
20% subst.
30% var.
Paraphr.
TextSeal (coin flip, α=0.5 )
82
46
16
28
3
textGrain ( β=0.5 )
91
63
24
48
5
AutoMark’s copula ( ρ=0.9 )
92
66
26
48
5
TextSeal2 ( ρ=0.9 )
92
64
27
46
6
TextSeal2 ( ρ=0.95 )
94
71
31
51
7
Appendix
Table 7: Robustness: % of 1000 200-token Qwen3.5-9B answers still detected after each attack, at the clean thresholds ( 10−3 false-positive rate, 10 keys; paraphraser: Llama-3.2-3B-Instruct ).
Windows
Clean
e=0.05
e=0.12
e=0.2
Estimate at e=0.05
Estimate at e=0.12
(3,3)
68 / 92
83
58
27
–
–
(2,10)
70 / 94
74
31
10
0.045 / 0.043
0.116 / 0.087
ladder
67 / 94
75
33
9
0.045 / 0.037
0.117 / 0.059
Appendix
Table 8: Keys with different window lengths merged in the virtual key (Qwen3.5-9B, ELI5, 200 tokens; ρ=0.9 for the robustness and estimation columns; 53-bit PRF). Rows: standard two-key TextSeal2 with windows (3,3) ; two windows (2,10) ; and a six-key ladder (2,3,4,6,8,10) . Clean: % of 100 / 200-token answers detected at a false-positive rate of 10−3 , interpolated at Self-BLEU 21.5. Substitution columns: % of 200-token answers still detected, at the clean thresholds, after a fraction e of tokens is replaced uniformly at random. Estimate columns: edit rate fitted from the decay of per-key scores with window length, reported as (pooled fit over 1000 answers) / (median of per-answer fits).
N=4
N=8
N=16
Method
Tokens / round
Detected
Tokens / round
Detected
Tokens / round
Detected
No watermark
2.44
–
2.74
–
2.85
–
TextSeal (coin flip)
2.46
34 / 73
2.77
31 / 71
2.87
30 / 68
textGrain
2.45
30 / 65
2.75
31 / 67
2.84
28 / 62
textGrain, own recipe
2.36
48 / 82
2.61
52 / 84
2.68
51 / 85
SynthID-Text
2.44
19 / 48
2.75
17 / 50
2.85
17 / 46
Appendix
Table 9: Number of drafts per round: Qwen3.5-0.8B drafting N tokens for Qwen3.5-9B, block verification, every configuration generated separately for each N (3000 answers for detection, 100 questions × 16 answers for Self-BLEU). Tokens per round: emitted tokens over target passes, at α=0.5 , β=0.5 , 10 layers and ρ=0.9 . Detected: % of 100 / 200-token answers at a false-positive rate of 10−3 , interpolated at TextSeal’s Self-BLEU for the same N (19.8 / 20.1 / 19.6). Paired over 480 prompts, only textGrain’s own recipe lowers the tokens per round ( −0.08 / −0.14 / −0.18 ); the distortion tests of Figure 11 detect the raw-lane-length control at every N , and no other scheme on the tests that apply to it, except that at N=16 the residual race and textGrain’s own recipe both sit 7 millinats below the same unwatermarked run in the all-token test (intervals [−13,−1] ), which points to noise in that shared reference.
Method
Tokens per round ( N=4 / 8 )
Detected, N=4
Detected, N=8
No watermark
3.20 / 4.08
–
–
TextSeal (coin flip, other key for the last token)
3.21 / 4.09
36 / 72
37 / 62
textGrain, other key for the last token
3.21 / 4.14
20 / 51
18 / 43
textGrain, own recipe (lowers acceptance)
3.11 / 3.88
55 / 83
50 / 79
TextSeal2, residual race
3.20 / 4.11
63 / 87
55 / 81
Appendix
Table 10: Second drafter–target pair: Llama-3.2-1B-Instruct drafting N=4 or 8 tokens per round for Llama-3.1-8B-Instruct, with block verification (ELI5, 240 prompts per row, α=0.5 , ρ=0.9 , β=0.5 , TextSeal’s 13-bit PRF for every scheme). Tokens per round: emitted tokens over target passes. Detection: % of 100 / 200-token answers at a false-positive rate of 10−3 , thresholds over 10 keys and 10,000 unwatermarked Llama-3.1-8B-Instruct answers; 95% Wilson intervals are about ±6 points.
Detected (%) at
Method
Tokens / round
Accuracy (%)
Self-BLEU
Finished (%)
256
512
1024
2048
No watermark
5.42
71.1
44.8
68
–
–
–
–
TextSeal (coin flip)
5.43
69.2
46.1
66
1
5
13
22
textGrain
5.39
69.3
45.8
66
1
2
6
15
textGrain, own recipe
5.30
69.7
46.8
68
3
8
22
38
SynthID-Text
5.39
69.2
45.6
68
2
4
9
19
Appendix
Table 11: AIME under speculative decoding: Qwen3.5-0.8B drafting 8 tokens per round for Qwen3.5-9B with block verification, 16 answers to each of 100 AIME problems (thinking disabled, prompt asking for a \boxed{} answer, temperature 1, top- p 0.95, up to 8192 tokens), at α=0.5 , β=0.5 , 10 layers and ρ=0.9 . Tokens per round: emitted tokens over target passes; only textGrain’s own recipe lowers it ( −0.11[−0.14,−0.09] , paired by problem with unwatermarked decoding). Accuracy: last \boxed{} answer; paired by problem, every scheme is within 2 points of unwatermarked decoding, all 95% intervals containing zero. Self-BLEU: over each problem’s 16 answers, first 1024 tokens. Finished: answers that end before 8192 tokens. Detected: % of answers detected at a false-positive rate of 10−3 on their first 256 / 512 / 1024 / 2048 tokens, with each method’s detector; thresholds are the empirical 10−3 quantile over the 1600 unwatermarked answers scored under 10 keys ( 1.6⋅104 null p-values; realised false-positive rates 0.05–0.15%); 95% Wilson intervals are at most ±2.4 points. Strengths are defaults, not diversity-matched; Self-BLEU varies by at most 2 points.
Figure 8: Diversity (Self-BLEU over each problem’s 16 answers, first 1024 tokens; lower is more diverse) vs. detection at a false-positive rate of 10−3 on AIME under speculative decoding, on the first 1024 (a) and 2048 (b) tokens; same setup as Table 11 , sweeping each method’s strength. Interpolated at TextSeal’s Self-BLEU (46.1), TextSeal2 detects 30% of answers at 2048 tokens, against 23% for the coin flip, 21% for SynthID-Text, 17% for textGrain and 9% for AutoMark’s copula; paired by problem, its lead is significant over all but the coin flip ( +7.4[−0.2,+19.5] ). Error bars: 95% Wilson intervals.
Method
Detected (128 / 256 / 512 tokens)
TextSeal (coin flip)
30 / 39 / 42
textGrain
38 / 46 / 48
SynthID-Text
42 / 50 / 50
AutoMark copula
54 / 59 / 59
TextSeal2, one use per window
47 / 55 / 60
Appendix
Table 12: Code: Qwen3.5-9B writing Python solutions to the 500 MBPP test problems, up to 512 new tokens (most answers end earlier, so detection saturates after 256 tokens). % of answers detected at 128 / 256 / 512 tokens, thresholds at a 1% false-positive rate over 10 keys and 2922 unwatermarked answers (all 974 MBPP problems, 3 seeds); same settings as on ELI5 ( α=0.5 , ρ=0.9 , β=0.5 , 10 SynthID layers; the copulas use the 53-bit PRF), whose Qwen3.5-9B Self-BLEU is 20.6–20.9 for all five; one answer per problem, so code diversity is not measured. 11% of positions are a window’s second occurrence in the text.
ELI5
MBPP
Repeated windows
Detected @256
Median z @256 / 1024 / 2048
Detected @512
Median z @1024 / 2048
One use per window
93.0
6.0 / 15.9 / 22.8
53.2
4.8 / 5.6
Leftover continuation
96.8
6.5 / 16.9 / 23.9
60.8
5.2 / 5.7
Δ leftover continuation
+3.8[+2.1,+5.6]
+0.5 / +0.9 / +1.1
+7.6[+2.4,+12.8]
+0.3 / +0.4
Appendix
Table 13: Repeated windows in long generations: Qwen3.5-9B with thinking traces, up to 2048 tokens (ELI5: 1024 prompts, MBPP: 500 problems; ρ=0.9 , 53-bit PRF). A window repeats at 16% of positions on ELI5 and 34% on MBPP. Detection at a false-positive rate of 10−3 (thresholds over 10 keys and 2048 / 1000 unwatermarked traces) and median z-score of the key-only test; both rules use the same detector. Δ : paired difference against one use per window, with 95% bootstrap interval over prompts. Distortion check, on 480 traces generated with one key per answer: the mean of −lnpx−H(p) at a window’s 2nd / 3rd+ occurrences is +3[−6,+13] / −3[−8,+2] millinats with leftover continuation, and −3[−12,+7] / +2[−3,+6] millinats without any watermark, so leftover continuation introduces no measurable distortion.
Figure 9: Calibration: false-positive rate against the nominal p-value threshold for the detectors of Table 1 without speculative decoding, on 10 keys and 10,000 unwatermarked Qwen3.5-9B answers; grey: 95% binomial interval around the diagonal. At 10−3 and above, every detector is within a factor 1.3 of nominal.
Figure 10: Figure 1 with diversity measured by the share of distinct 4-grams (higher is more diverse), including the speculative panel (b).
Figure 11: Is speculative decoding with a watermark still distortion-free? Paired differences from unwatermarked block verification (8 drafts per round) on the same 480 prompts, with one key per answer (95% paired bootstrap intervals). (a) Tokens per round. (b) Mean of −lnrI,y−H(rI) at the last token y of each round, which has expectation zero when it follows block verification’s residual law rI (not shown for textGrain’s own recipe, whose last token follows the residual of the watermarked distributions). (c) Mean of −lnpx−H(p) over all tokens, which has expectation zero for any distortion-free scheme. Only the control (racing on raw lane lengths, Remark 1 ) deviates in (c), and only textGrain’s own recipe lowers tokens per round.
We introduce TextSeal, a state-of-the-art watermark for large language models. Building on Gumbel-max sampling, TextSeal introduces dual-key generation to restore output diversity, along with entropy-weighted scoring and multi-region localization for improved detection. It supports serving optimizations such as speculative decoding and multi-token prediction, and does not add any inference overhead. TextSeal strictly dominates baselines like SynthID-text in detection strength and is robust to dilution, maintaining confident localized detection even in heavily mixed human/AI documents. The scheme is theoretically distortion-free, and evaluation across reasoning benchmarks confirms that it preserves downstream performance; while a multilingual human evaluation (6000 A/B comparisons, 5 languages) shows no perceptible quality difference. Beyond its use for provenance detection, TextSeal is also ``radioactive'': its watermark signal transfers through model distillation, enabling detection of unauthorized use.
As watermarking of LLM-generated text enters deployment, users increasingly need to check text whose source is unknown. Existing detectors read the watermark through a specific tokenizer or embedding pipeline, and even if all providers adopted the same watermarking method, differences in these representations would leave their watermarks incompatible, and the text alone does not reveal which representation produced it. We propose ByteMark, a unified watermarking scheme that defines its signal on the UTF-8 bytes of published text. Models with different tokenizers embed this signal under one public specification and key, and a single detector verifies the text from the text and key alone. When the tokenizer or embedding model of a baseline detector is replaced, its detection degrades sharply, whereas ByteMark, which uses neither, retains its detection rate; ByteMark also remains detectable when participating models continue or rewrite the text.
We introduce Stateless Bernoulli Watermarking (SBW), a new statistical watermark for Large Language Models that determines green list membership through independent per-token Bernoulli trials. Unlike KGW's vocabulary permutation or SynthID's multi-layer tournament, SBW requires only a single comparison per token against a counter-based random number generator, reducing membership complexity to O(1) and enabling single-kernel execution with zero intermediate allocations. We prove that this formulation preserves the same detection guarantees as fixed-size green lists: the z-score test remains N(0,1) under the null. The stateless architecture enables capabilities unavailable to existing methods: full-vocabulary self-salt watermarking (over 6000× faster than KGW's self-salt and 2× faster than SynthID despite biasing the entire vocabulary with candidate-dependent seeding) and architectural compatibility with distributed inference. In end-to-end generation benchmarks, SBW adds less than 1% overhead at all batch sizes. We additionally identify hash function design as a previously unexplored axis for watermark quality, showing that a GPU-native Jenkins hash improves null calibration by 1.8× while producing more diverse text. Experiments across two seeding schemes and eight (γ,δ) configurations confirm statistical equivalence with ROC-AUC differences below 0.01.
Simone Ceppi, Ignacio Sanchez
European Commission Joint Research Centre Ispra, Italy