TextSeal2: Distortion-Free LLM Watermarking with Copula Mixing and Memoryless Races

Tom Sander; Pierre Fernandez; Itai Gat; Haiming Bao; Jiaxin Shi; Jason Park; Valeriu Lacatusu; Sylvestre-Alvise Rebuffi

cs.CROct 29, 2026

TextSeal2: Distortion-Free LLM Watermarking with Copula Mixing and Memoryless Races

Authors: Tom Sander, Pierre Fernandez, Itai Gat, Haiming Bao, Jiaxin Shi, Jason Park, Valeriu Lacatusu, Sylvestre-Alvise Rebuffi,

Organizations: Meta Superintelligence Labs

Abstract

We present TextSeal2, a distortion-free watermark for large language models that keeps its signal under speculative decoding: tokens that replace rejected drafts remain watermarked with the same keys, and the acceptance rate is unchanged. It also preserves output diversity and adds no measurable inference latency. Its predecessor, TextSeal, restores diversity in the Gumbel-max scheme by routing each token to one of two keys via a coin flip. This is suboptimal because the detector averages the scores from both keys without knowing which key was used. TextSeal2 instead merges two or more keys into a single virtual key and couples it to fresh noise through AutoMark's Gaussian copula. Any number of keys, including publicly shared keys, can be merged this way without diluting detection. Under speculative decoding, TextSeal2 verifies keyed drafts with one more exponential race, run on the leftovers of the draft races. By memorylessness, this race reproduces block verification, so the output follows the target model exactly. We evaluate TextSeal2 on three LLMs. At equal output token diversity, TextSeal2 detects 8 to 22 percentage points more 100-token answers than TextSeal at a false-positive rate of $10^{-3}$ , and is comparable to textGrain while requiring no post-logits optimization. Under speculative decoding, it detects 18 and 22 percentage points more 200-token answers than TextSeal and textGrain, respectively, at the same acceptance rate.

Figures & tables

Method	Speculative decoding		Acceptance kept	Extra post-logits work
Method	✗	✓	Acceptance kept	Extra post-logits work
SynthID-Text (tournament)	89 $\pm$ 3	50 $\pm$ 2	✓	$O(L\|\mathcal{A}\|)$
TextSeal (coin flip)	81 $\pm$ 1	71 $\pm$ 2	✓	none
AutoMark copula	91 $\pm$ 3	60 $\pm$ 2	✓	none
textGrain	89 $\pm$ 4	67 $\pm$ 4	✓	Sinkhorn, $O(N_{\mathrm{it}}Bm)$
textGrain, own speculative-decoding recipe	–	84 $\pm$ 6	✗ ( $-5\%$ tokens/round)	Sinkhorn, $O(N_{\mathrm{it}}Bm)$

Table 1: Detection on Qwen3.5-9B (ELI5, temperature 1, top-

p

0.95), at fixed diversity: % of 200-token answers detected at a false-positive rate (FPR) of

10^{-3}

. Gray: half-width of the 95% bootstrap interval; bold: best; underlined: second best, per column. Speculative decoding: Qwen3.5-0.8B drafts 8 tokens per round, with block verification; TextSeal2 uses the residual race, the baselines use block verification’s native stopping rule with the last token of each round drawn under an independent key, and textGrain’s own recipe verifies the watermarked distributions. Acceptance is kept when tokens per round do not drop below those of unwatermarked block verification (2.74; paired over 480 prompts, Figure 11 in Appendix G ).

N_{\mathrm{it}}

: Sinkhorn iterations on a

B\times m

table (1–3 ms per token, Appendix D );

L

: tournament layers over candidates

\mathcal{A}

. TextSeal2 equals AutoMark’s copula in distribution; their gap under speculative decoding is the residual race.

Figure 1: Diversity–detection trade-off on Qwen3.5-9B at 100 tokens at FPR=

10^{-3}

, (a) without and (b) with speculative decoding (8 drafts per round, block verification). In (a), TextSeal2 coincides with AutoMark’s single-key copula as expected since it behaves like a single-key copula. In (b), TextSeal2 uses the residual race, and the baselines use block verification’s native stopping rule with the last token of each round drawn under an independent key. Diversity is measured by Self-BLEU (lower is more diverse).

Figure 2: TextSeal2 generates one token ( subsection 3.1 ). (a) The model’s forward pass gives the probabilities $p_{v}$ , and the last $k=3$ tokens form the window $\mathbf{w}$ . (b) The keys’ values at $\mathbf{w}$ are merged into the virtual key $G^{\star}_{v}$ , which the copula ( 4 ) blends with the noise $\eta_{v}$ into $\tilde{R}_{v}$ ; the Gumbel-max choice is $\argmin_{v}(-\ln\tilde{R}_{v})/p_{v}$ . (c) The Gumbel-max choice can be seen as a race ( 1 ): candidate $v$ runs a lane of length $E_{v}=-\ln\tilde{R}_{v}$ at speed $p_{v}$ , and the token that finishes first is chosen.

Figure 3: Block verification checks the drafts against the target as a block, keeps those before a stop position $I$ , and emits one token $y$ at $I$ . (a) The drafter proposes “the mat” with keyed races. (b) One target pass then gives the probability $\pi_{i,v}$ that $I=i$ and $y=v$ . One more race on the leftovers picks $I$ and $y$ : “floor” wins, so the round keeps “the” and emits “floor” at $I=2$ . TextSeal2 preserves the target’s distribution and block verification’s acceptance rate ( Proposition 1 ). Algorithm 1 in the appendix gives more details.

Figure 4: TextSeal2 detects the text “The cat sat on the floor and fell asleep in the sun.” ( subsection 3.4 ). (a) Each token

x_{i}

and its window

\mathbf{w}_{i}

; the highlighted row is the token of Figure 2 . (b) For “floor”, the keys’ values are merged into

G^{\star}_{x_{i}}

as in ( 4 ), without the noise, and give the score

s^{\star}_{i}

; key

k^{(1)}

alone gives the public score

s^{(1)}_{i}

. (c) The

n=10

scores sum to

S=23.9

, and the

\mathrm{Gamma}(n,1)

tail beyond

S

(box) is

p=4.6\cdot 10^{-4}

Figure 5: Entropy weighting improves detection for every watermark, including under speculative decoding. % of 100-token answers detected at a false-positive rate of

10^{-3}

with key-only scores (light bars) and with TextSeal’s entropy-weighted test (full bars), at comparable Self-BLEU. The gains are 5–18 percentage points at 100 tokens and 4–23 at 200 tokens ( Table 6 ); without speculative decoding, TextSeal2 and AutoMark’s copula coincide in distribution and differ only within their 95% intervals, as expected.

Appendix figures & tables18 assets

Supplementary material from the paper’s appendix.

Appendix

Next-token distribution	Gaussian score	TextSeal score
uniform over 8 tokens	0.998 / 0.998 / 1.000	0.915 / 0.962 / 0.992
Zipf(1.1) over 24 tokens	0.982 / 0.988 / 0.993	0.908 / 0.960 / 0.989
top token 0.5, Zipf tail	0.966 / 0.978 / 0.987	0.911 / 0.959 / 0.990
top token 0.8, Zipf tail	0.929 / 0.938 / 0.942	0.908 / 0.952 / 0.973

Appendix

Table 2: Copula race vs the best distortion-free coupling at equal entropy removed: ratio of per-token signal-to-noise ratios, for the Gaussian score

s=g

and TextSeal’s score

s=-\ln(1-u)

, at couplings

\rho=0.5/0.8/0.95

(the fraction of each token’s entropy removed by the key is then about 0.16 / 0.45 / 0.72).

Shape	$H$ (nats)	$\rho=0.5$	0.7	0.8	0.9	0.95
uniform over 2	0.69	0.125	0.272	0.385	0.550	0.677
uniform over 8	2.08	0.147	0.308	0.426	0.590	0.712
uniform over 64	4.16	0.173	0.353	0.477	0.640	0.754
flat Zipf(0.8)	4.07	0.173	0.354	0.479	0.641	0.750
$p_{\max}=0.5$	2.42	0.170	0.350	0.475	0.638	0.750
$p_{\max}=0.95$	0.37	0.183	0.370	0.493	0.652	0.757

Appendix

Table 3: Fraction of each token’s entropy removed at a fixed coupling

\rho

, on synthetic distributions.

				textGrain
Batch	Top- $p$ (all)	TextSeal	TextSeal2	minimal	A.1, 10 / 20 / 30 it.	A.1 calibrated, $\beta=0.25/0.5$
1	0.16	0.020	0.018	0.22–0.40	1.1 / 2.1 / 3.0	2.3 / 4.1
8	0.72	0.030	0.025	0.28–0.50	1.4 / 2.6 / 3.8	2.4 / 4.5
64	2.14	0.15	0.12	0.98–1.24	3.8 / 6.7 / 9.5	2.7 / 4.8

Appendix

Table 4: Post-logits latency per decoding step (ms, median of 200 CUDA-graph replays, or 50 eager runs for calibrated textGrain, whose calibration loop has data-dependent control flow; one H200, vocabulary of 248,320 tokens, synthetic high-entropy logits). Top-

p

filtering is shared by all methods. The minimal textGrain version uses 5–20 Sinkhorn iterations on the

256\times 256

kernel without calibrating

\lambda

Batch	Plain sampling	TextSeal	TextSeal2	TextSeal, overlapped	TextSeal2, overlapped
1	50.44	50.85	51.08	50.69	50.87
8	52.39	52.54	52.64	52.52	52.79
64	56.46	58.43	61.34	56.81	56.93

Appendix

Table 5: Full decoding step (ms, median), Qwen3.5-9B; overlapped: key-only work on a side CUDA stream.

Model	Method	Self-BLEU	Key-only	Entropy-weighted
Llama-3.1-8B	TextSeal	23.9	53 / 82	58 / 91
	textGrain	24.1	55 / 86	67 / 94
	AutoMark copula	23.9	63 / 90	71 / 95
	TextSeal2	23.9	64 / 90	71 / 95
Qwen3.5-9B	TextSeal	20.6	42 / 82	59 / 93
	textGrain	20.9	65 / 91	74 / 97

Appendix

Table 6: Key-only vs. entropy-weighted detection (TextSeal’s weighted Gamma test): % of 100 / 200-token answers detected at a false-positive rate of

10^{-3}

, with thresholds calibrated per test over 10 keys and 10,000 unwatermarked answers. First 1000 answers per configuration without speculative decoding; last block: all 3000 answers with speculative decoding (8 drafts, block verification). Strengths:

\alpha=0.5

(TextSeal),

\beta=0.5

(textGrain),

\rho=0.9

(copulas, 53-bit PRF). For SynthID-Text, the key-only test is its official binomial test and the weighted test is the same Gamma test applied to twice its mean coin score. Self-BLEU over 32 answers to each of 100 questions. Weighting improves every method by 4–23 percentage points at 200 tokens, and the two copulas remain level without speculative decoding, as they must in distribution.

Figure 6: The diversity–detection trade-off of Figure 1 at 200 tokens instead of 100; same protocol and conventions, including the speculative panel (b).

Figure 7: Diversity (Self-BLEU; lower is more diverse) vs. detection of 100-token answers without speculative decoding, on three models (32 answers to each of 100 questions; copulas with the 53-bit PRF). Interpolated at TextSeal’s Self-BLEU, TextSeal2 gains 10, 22 and 8 percentage points over the coin flip on Llama-3.1-8B, Qwen3.5-9B and Qwen3.5-27B respectively, and AutoMark’s copula overlaps TextSeal2 throughout.

Method	Clean	10% subst.	20% subst.	30% var.	Paraphr.
TextSeal (coin flip, $\alpha=0.5$ )	82	46	16	28	3
textGrain ( $\beta=0.5$ )	91	63	24	48	5
AutoMark’s copula ( $\rho=0.9$ )	92	66	26	48	5
TextSeal2 ( $\rho=0.9$ )	92	64	27	46	6
TextSeal2 ( $\rho=0.95$ )	94	71	31	51	7

Appendix

Table 7: Robustness: % of 1000 200-token Qwen3.5-9B answers still detected after each attack, at the clean thresholds (

10^{-3}

false-positive rate, 10 keys; paraphraser: Llama-3.2-3B-Instruct ).

Windows	Clean	$e=0.05$	$e=0.12$	$e=0.2$	Estimate at $e=0.05$	Estimate at $e=0.12$
$(3,3)$	68 / 92	83	58	27	–	–
$(2,10)$	70 / 94	74	31	10	0.045 / 0.043	0.116 / 0.087
ladder	67 / 94	75	33	9	0.045 / 0.037	0.117 / 0.059

Appendix

Table 8: Keys with different window lengths merged in the virtual key (Qwen3.5-9B, ELI5, 200 tokens;

\rho=0.9

for the robustness and estimation columns; 53-bit PRF). Rows: standard two-key TextSeal2 with windows

(3,3)

; two windows

(2,10)

; and a six-key ladder

(2,3,4,6,8,10)

. Clean: % of 100 / 200-token answers detected at a false-positive rate of

10^{-3}

, interpolated at Self-BLEU 21.5. Substitution columns: % of 200-token answers still detected, at the clean thresholds, after a fraction

e

of tokens is replaced uniformly at random. Estimate columns: edit rate fitted from the decay of per-key scores with window length, reported as (pooled fit over 1000 answers) / (median of per-answer fits).

	$N=4$		$N=8$		$N=16$
Method	Tokens / round	Detected	Tokens / round	Detected	Tokens / round	Detected
No watermark	2.44	–	2.74	–	2.85	–
TextSeal (coin flip)	2.46	34 / 73	2.77	31 / 71	2.87	30 / 68
textGrain	2.45	30 / 65	2.75	31 / 67	2.84	28 / 62
textGrain, own recipe	2.36	48 / 82	2.61	52 / 84	2.68	51 / 85
SynthID-Text	2.44	19 / 48	2.75	17 / 50	2.85	17 / 46

Appendix

Table 9: Number of drafts per round: Qwen3.5-0.8B drafting

N

tokens for Qwen3.5-9B, block verification, every configuration generated separately for each

N

(3000 answers for detection, 100 questions

\times

16 answers for Self-BLEU). Tokens per round: emitted tokens over target passes, at

\alpha=0.5

\beta=0.5

, 10 layers and

\rho=0.9

. Detected: % of 100 / 200-token answers at a false-positive rate of

10^{-3}

, interpolated at TextSeal’s Self-BLEU for the same

N

(19.8 / 20.1 / 19.6). Paired over 480 prompts, only textGrain’s own recipe lowers the tokens per round (

-0.08

-0.14

-0.18

); the distortion tests of Figure 11 detect the raw-lane-length control at every

N

, and no other scheme on the tests that apply to it, except that at

N=16

the residual race and textGrain’s own recipe both sit 7 millinats below the same unwatermarked run in the all-token test (intervals

[-13,-1]

), which points to noise in that shared reference.

Method	Tokens per round ( $N=4$ / $8$ )	Detected, $N=4$	Detected, $N=8$
No watermark	3.20 / 4.08	–	–
TextSeal (coin flip, other key for the last token)	3.21 / 4.09	36 / 72	37 / 62
textGrain, other key for the last token	3.21 / 4.14	20 / 51	18 / 43
textGrain, own recipe (lowers acceptance)	3.11 / 3.88	55 / 83	50 / 79
TextSeal2, residual race	3.20 / 4.11	63 / 87	55 / 81

Appendix

Table 10: Second drafter–target pair: Llama-3.2-1B-Instruct drafting

N=4

8

tokens per round for Llama-3.1-8B-Instruct, with block verification (ELI5, 240 prompts per row,

\alpha=0.5

\rho=0.9

\beta=0.5

, TextSeal’s 13-bit PRF for every scheme). Tokens per round: emitted tokens over target passes. Detection: % of 100 / 200-token answers at a false-positive rate of

10^{-3}

, thresholds over 10 keys and 10,000 unwatermarked Llama-3.1-8B-Instruct answers; 95% Wilson intervals are about

\pm 6

points.

					Detected (%) at
Method	Tokens / round	Accuracy (%)	Self-BLEU	Finished (%)	256	512	1024	2048
No watermark	5.42	71.1	44.8	68	–	–	–	–
TextSeal (coin flip)	5.43	69.2	46.1	66	1	5	13	22
textGrain	5.39	69.3	45.8	66	1	2	6	15
textGrain, own recipe	5.30	69.7	46.8	68	3	8	22	38
SynthID-Text	5.39	69.2	45.6	68	2	4	9	19

Appendix

Table 11: AIME under speculative decoding: Qwen3.5-0.8B drafting 8 tokens per round for Qwen3.5-9B with block verification, 16 answers to each of 100 AIME problems (thinking disabled, prompt asking for a \boxed{} answer, temperature 1, top-

p

0.95, up to 8192 tokens), at

\alpha=0.5

\beta=0.5

, 10 layers and

\rho=0.9

. Tokens per round: emitted tokens over target passes; only textGrain’s own recipe lowers it (

-0.11

[-0.14,-0.09]

, paired by problem with unwatermarked decoding). Accuracy: last \boxed{} answer; paired by problem, every scheme is within 2 points of unwatermarked decoding, all 95% intervals containing zero. Self-BLEU: over each problem’s 16 answers, first 1024 tokens. Finished: answers that end before 8192 tokens. Detected: % of answers detected at a false-positive rate of

10^{-3}

on their first 256 / 512 / 1024 / 2048 tokens, with each method’s detector; thresholds are the empirical

10^{-3}

quantile over the 1600 unwatermarked answers scored under 10 keys (

1.6\cdot 10^{4}

null p-values; realised false-positive rates 0.05–0.15%); 95% Wilson intervals are at most

\pm 2.4

points. Strengths are defaults, not diversity-matched; Self-BLEU varies by at most 2 points.

Figure 8: Diversity (Self-BLEU over each problem’s 16 answers, first 1024 tokens; lower is more diverse) vs. detection at a false-positive rate of

10^{-3}

on AIME under speculative decoding, on the first 1024 (a) and 2048 (b) tokens; same setup as Table 11 , sweeping each method’s strength. Interpolated at TextSeal’s Self-BLEU (46.1), TextSeal2 detects 30% of answers at 2048 tokens, against 23% for the coin flip, 21% for SynthID-Text, 17% for textGrain and 9% for AutoMark’s copula; paired by problem, its lead is significant over all but the coin flip (

+7.4

[-0.2,+19.5]

). Error bars: 95% Wilson intervals.

Method	Detected (128 / 256 / 512 tokens)
TextSeal (coin flip)	30 / 39 / 42
textGrain	38 / 46 / 48
SynthID-Text	42 / 50 / 50
AutoMark copula	54 / 59 / 59
TextSeal2, one use per window	47 / 55 / 60

Appendix

Table 12: Code: Qwen3.5-9B writing Python solutions to the 500 MBPP test problems, up to 512 new tokens (most answers end earlier, so detection saturates after 256 tokens). % of answers detected at 128 / 256 / 512 tokens, thresholds at a 1% false-positive rate over 10 keys and 2922 unwatermarked answers (all 974 MBPP problems, 3 seeds); same settings as on ELI5 (

\alpha=0.5

\rho=0.9

\beta=0.5

, 10 SynthID layers; the copulas use the 53-bit PRF), whose Qwen3.5-9B Self-BLEU is 20.6–20.9 for all five; one answer per problem, so code diversity is not measured. 11% of positions are a window’s second occurrence in the text.

	ELI5		MBPP
Repeated windows	Detected @256	Median z @256 / 1024 / 2048	Detected @512	Median z @1024 / 2048
One use per window	93.0	6.0 / 15.9 / 22.8	53.2	4.8 / 5.6
Leftover continuation	96.8	6.5 / 16.9 / 23.9	60.8	5.2 / 5.7
$\Delta$ leftover continuation	$+3.8$ $[+2.1,+5.6]$	$+0.5$ / $+0.9$ / $+1.1$	$+7.6$ $[+2.4,+12.8]$	$+0.3$ / $+0.4$

Appendix

Table 13: Repeated windows in long generations: Qwen3.5-9B with thinking traces, up to 2048 tokens (ELI5: 1024 prompts, MBPP: 500 problems;

\rho=0.9

, 53-bit PRF). A window repeats at 16% of positions on ELI5 and 34% on MBPP. Detection at a false-positive rate of

10^{-3}

(thresholds over 10 keys and 2048 / 1000 unwatermarked traces) and median z-score of the key-only test; both rules use the same detector.

\Delta

: paired difference against one use per window, with 95% bootstrap interval over prompts. Distortion check, on 480 traces generated with one key per answer: the mean of

-\ln p_{x}-H(\vec{p})

at a window’s 2nd / 3rd+ occurrences is

+3

[-6,+13]

-3

[-8,+2]

millinats with leftover continuation, and

-3

[-12,+7]

+2

[-3,+6]

millinats without any watermark, so leftover continuation introduces no measurable distortion.

Figure 9: Calibration: false-positive rate against the nominal p-value threshold for the detectors of Table 1 without speculative decoding, on 10 keys and 10,000 unwatermarked Qwen3.5-9B answers; grey: 95% binomial interval around the diagonal. At

10^{-3}

and above, every detector is within a factor 1.3 of nominal.

Figure 10: Figure 1 with diversity measured by the share of distinct 4-grams (higher is more diverse), including the speculative panel (b).

Figure 11: Is speculative decoding with a watermark still distortion-free? Paired differences from unwatermarked block verification (8 drafts per round) on the same 480 prompts, with one key per answer (95% paired bootstrap intervals). (a) Tokens per round. (b) Mean of

-\ln r_{I,y}-H(\vec{r}_{I})

at the last token

y

of each round, which has expectation zero when it follows block verification’s residual law

\vec{r}_{I}

(not shown for textGrain’s own recipe, whose last token follows the residual of the watermarked distributions). (c) Mean of

-\ln p_{x}-H(\vec{p})

over all tokens, which has expectation zero for any distortion-free scheme. Only the control (racing on raw lane lengths, Remark 1 ) deviates in (c), and only textGrain’s own recipe lowers tokens per round.

LLM Watermarking

Large language model watermarking embeds or detects signals in text and models to trace provenance, ownership, and unauthorized use.

See all 112 papers

TextSeal: A Localized LLM Watermark for Provenance & Distillation Protection
May 12, 2026Tom Sander, Hongyan Chang, Tomáš Souček +10Language Model Fingerprinting LLM Watermarking
FAIR, Meta Superintelligence Labs
ByteMark: A Unified Byte-Level Watermark for Detection Across Language Models
Oct 10, 2026Xiaopu Wang, Runze LiText Watermarking LLM Watermarking
Flip, Don't Shuffle: Watermarking LLMs at the Speed of Inference
Sep 3, 2026Simone Ceppi, Ignacio SanchezLLM Watermarking
European Commission Joint Research Centre Ispra, Italy

May 12, 2026J/K move · Enter open · S save

TextSeal: A Localized LLM Watermark for Provenance & Distillation Protection

Tom Sander, Hongyan Chang, Tomáš Souček, Tuan Tran+9

FAIR, Meta Superintelligence Labs

Language Model Fingerprinting LLM Watermarking Robust Watermarking Robustness of Machine-Generated Text Detection Data Provenance in Language Models

Open paper AskPDF arXiv

We introduce TextSeal, a state-of-the-art watermark for large language models. Building on Gumbel-max sampling, TextSeal introduces dual-key generation to restore output diversity, along with entropy-weighted scoring and multi-region localization for improved detection. It supports serving optimizations such as speculative decoding and multi-token prediction, and does not add any inference overhead. TextSeal strictly dominates baselines like SynthID-text in detection strength and is robust to dilution, maintaining confident localized detection even in heavily mixed human/AI documents. The scheme is theoretically distortion-free, and evaluation across reasoning benchmarks confirms that it preserves downstream performance; while a multilingual human evaluation (6000 A/B comparisons, 5 languages) shows no perceptible quality difference. Beyond its use for provenance detection, TextSeal is also ``radioactive'': its watermark signal transfers through model distillation, enabling detection of unauthorized use.

Abstract

LLM Watermarking

Explore similar work

TextSeal: A Localized LLM Watermark for Provenance & Distillation Protection

ByteMark: A Unified Byte-Level Watermark for Detection Across Language Models

Flip, Don't Shuffle: Watermarking LLMs at the Speed of Inference