TextSeal2: Distortion-Free LLM Watermarking with Copula Mixing and Memoryless Races

What it is

TextSeal2 is a distortion-free Gumbel-max text watermark from Meta Superintelligence Labs (arXiv 2610.40613, 29 October 2026). It is the successor to TextSeal and keeps its two keys and its detector. It changes how the keys enter the sampler and how speculative decoding picks replacement tokens. Code is at https://github.com/facebookresearch/textseal.

How it works

TextSeal routes each token to one of two keys by coin flip, but the detector cannot tell which key was used and must average both scores. Only the generating key carries signal, so the expected excess score halves while the standard deviation falls only by √2. That cuts the signal-to-noise ratio by √2.

TextSeal2 instead maps each key's values to Gaussians and merges them as G⋆ = (G1 + G2)/√2, which is again standard normal. It then applies AutoMark's Gaussian copula with strength ρ, so the two-key scheme has the same diversity and detection power as AutoMark's single-key copula at the same ρ. With M keys, G⋆ = M^(-1/2) ΣG(k), so adding keys does not dilute the full detector.

For speculative decoding, the keyed drafts are exponential races. By memorylessness, the losers' leftovers are fresh exponentials. TextSeal2 runs one more race on them, the "residual race", and combines it with block verification. The output matches the target model exactly and acceptance equals that of block verification. The paper says earlier approaches, which replace rejected tokens from fresh noise or a second key, leave about a third of the text without the watermark.

Results

Table 1 uses Qwen3.5-9B on ELI5 at temperature 1, top-p 0.95. It reports the share of 200-token answers detected at a 10^-3 false-positive rate, at fixed diversity. The drafter is Qwen3.5-0.8B with 8 drafts per round.

• textGrain's own speculative recipe reaches 84, but it lowers tokens per round by 5%. TextSeal2 keeps acceptance at or above unwatermarked block verification (2.74 tokens per round over 480 prompts).
• Without speculative decoding, TextSeal2 matches AutoMark's single-key copula. The paper reports 8 to 22 points over TextSeal at 100 tokens across three LLMs.
• The residual race adds 28 to 33 points over drawing each round's last token under an independent key.
• textGrain needs Sinkhorn iterations on the critical path of decoding: 1 to 3 ms per token in the authors' implementation, 0.2 to 0.4 ms in a minimal version. TextSeal2 has no post-logits optimization step.

Preconditions

• Public detection is optional. One key can be published, but a single-key test is weaker. Its correlation with the race input is only ρ/√M, so ρ/√2 with two keys.
• Repeated context windows are handled as in AutoMark, by continuing the window's race from its leftovers. Under speculative decoding, every window raced in a round counts as used.

Caveats

• The fetched text cuts off in section 3.2. The proofs (Proposition 1 on acceptance, Theorem 1 on strength calibration, Proposition 3 on the entropy bound) and the appendices were not visible, so those claims are unchecked here.
• The detailed table covers one model and one dataset. The other two LLMs are only summarized in the abstract.
• The authors are Meta researchers evaluating against their own predecessor, TextSeal.