TextSeal2: Distortion-Free LLM Watermarking with Copula Mixing and Memoryless Races

What it claims

TextSeal2 is a distortion-free LLM watermark from Meta Superintelligence Labs (arXiv, October 2026). It targets four deployment requirements: an unchanged output distribution, diverse answers under a fixed key, no added decoding latency, and an unchanged speculative-decoding acceptance rate. On Qwen3.5-9B with speculative decoding, it detects 89% of 200-token answers at a 10^-3 false-positive rate. TextSeal detects 71% and textGrain 67% in the same setting. The authors say textGrain is the strongest prior scheme at a given diversity, but that it adds post-logits latency and its speculative variant lowers acceptance.

How it works

The authors diagnose TextSeal's weakness as a signal-to-noise problem. Its coin flip picks one of two keys per token. The detector does not know which key was used, so it averages both scores, which halves the signal and cuts signal-to-noise by √2.

TextSeal2 maps each key's pseudo-random values to Gaussians and sums them as G⋆ = (G1 + G2)/√2. It then blends G⋆ with fresh noise η through AutoMark's copula, R̃ = Φ(ρG⋆ + √(1−ρ²)η), and runs the usual Gumbel-max race on R̃. Detection scores every token against G⋆, so the scheme matches AutoMark's single-key copula in diversity and power at the same ρ. The construction extends to M keys with no loss to the full detector.

flowchart LR
  K1[Key 1 values] --> G[Virtual key G⋆]
  K2[Key 2 values] --> G
  G --> C[Copula with strength ρ]
  N[Fresh noise η] --> C
  C --> R[Gumbel-max race]
  R --> T[Emitted token]

Under speculative decoding, keyed drafts are exponential races. By memorylessness, the losing candidates' leftover times are fresh exponentials. TextSeal2 runs one more race on those leftovers, combined with block verification (Sun et al., 2025), to choose the first rejected draft and the bonus token. The authors prove the output follows the target model exactly and acceptance equals block verification's (Proposition 1).

The strength ρ plays the role of textGrain's entropy budget β. The entropy removed per token rises strictly with ρ (Theorem 1). The copula comes close to the bound of detection evidence per unit of entropy removed (Proposition 3).

Evidence

The setup is Qwen3.5-9B on ELI5, temperature 1, top-p 0.95, 200-token answers, FPR 10^-3, at fixed diversity measured by Self-BLEU. Results are without / with speculative decoding:

• SynthID-Text: 89 / 50
• TextSeal: 81 / 71
• AutoMark copula: 91 / 60
• textGrain: 89 / 67
• textGrain's own speculative recipe: 84 with speculative decoding, at 5% fewer tokens per round
• TextSeal2: 91 / 89

The speculative-decoding setting uses Qwen3.5-0.8B drafting 8 tokens per round with block verification. Acceptance counts as kept if tokens per round stay at or above unwatermarked block verification (2.74, paired over 480 prompts). Without speculative decoding, TextSeal2 and AutoMark tie, as expected. The 89-versus-60 gap between them comes entirely from the residual race. The residual race adds 28 to 33 points over drawing each round's last token under an independent key. Replaced tokens make up about a third of the text in these experiments.

textGrain's Sinkhorn step sits on the decoding critical path. It costs 1 to 3 ms per token in the authors' implementation and 0.2 to 0.4 ms in a minimal version. TextSeal2 adds no post-logits work.

How to use it

Code is at https://github.com/facebookresearch/textseal. The page does not state a licence or install commands. One key can be published as k_pub for public detection while the private key does full verification.

Limits

A published key gives a weaker test. Its correlation with the race input is only ρ/√2, or ρ/√M with M keys. Repeated context windows break single-sequence distortion-freeness unless they are masked or continued with a residual race. Under speculative decoding, every window raced in a round counts as used. The fetched text ends partway through Section 3.2. Detailed results appear only for Qwen3.5-9B, though the abstract reports three LLMs.