TextSeal2 improves watermarking for large language model outputs
TextSeal2: Distortion-Free LLM Watermarking with Copula Mixing and Memoryless Races
Cryptography and SecurityArtificial IntelligenceComputation and Language
Summary
The paper presents TextSeal2, a method to embed hidden signals (watermarks) in the text generated by large language models without changing the quality or style of the output. This new method keeps the signals intact even when the text is checked or modified during decoding, unlike previous methods that mixed two signals and reduced accuracy. TextSeal2 combines keys in a clever way using mathematical tools called copulas to improve detection while preserving diversity and speed. The authors show it works better on several large models, detecting watermarked text with higher accuracy and no extra delays.
What this means in practice
- •For ai platform developers: Implement robust watermark detection in language model outputs without reducing diversity or slowing inference.
- •For content moderation teams: Identify AI-generated text reliably to prevent misuse while maintaining natural output styles.
Authors
Tom Sander, Pierre Fernandez, Itai Gat, Haiming Bao, Jiaxin Shi, Jason Park, Valeriu Lacatusu, Sylvestre-Alvise Rebuffi, Hongyan Chang, Hady Elsahar, Tomáš Souček, Tuan Tran, Surya Parimi, Alexandre Mourachko
Abstract
We present TextSeal2, a distortion-free watermark for large language models that keeps its signal under speculative decoding: tokens that replace rejected drafts remain watermarked with the same keys, and the acceptance rate is unchanged. It also preserves output diversity and adds no measurable inference latency. Its predecessor, TextSeal, restores diversity in the Gumbel-max scheme by routing each token to one of two keys via a coin flip. This is suboptimal because the detector averages the scores from both keys without knowing which key was used. TextSeal2 instead merges two or more keys into a single virtual key and couples it to fresh noise through AutoMark's Gaussian copula. Any number of keys, including publicly shared keys, can be merged this way without diluting detection. Under speculative decoding, TextSeal2 verifies keyed drafts with one more exponential race, run on the leftovers of the draft races. By memorylessness, this race reproduces block verification, so the output follows the target model exactly. We evaluate TextSeal2 on three LLMs. At equal output token diversity, TextSeal2 detects 8 to 22 percentage points more 100-token answers than TextSeal at a false-positive rate of $10^{-3}$, and is comparable to textGrain while requiring no post-logits optimization. Under speculative decoding, it detects 18 and 22 percentage points more 200-token answers than TextSeal and textGrain, respectively, at the same acceptance rate.