TextSeal2 is a distortion-free watermark for LLM text from Meta researchers. It keeps its signal under speculative decoding, so tokens that replace rejected drafts stay watermarked, and it leaves the acceptance rate unchanged.

Why does speculative decoding break most watermarks?

Each round ends with a token the target model draws from a residual distribution, not the draft's. Replacing it from fresh noise or a second key keeps acceptance but loses or splits the watermark there, and verifying between watermarked distributions keeps the mark but accepts fewer drafts.

How does TextSeal2 mark the replacement token?

It runs one more exponential race on the leftovers of the keyed draft races. By memorylessness, that race reproduces block verification, so the output follows the target model and the replacement token stays keyed.

Does the watermark change what the model writes?

The paper states the scheme is distortion-free: averaged over secret keys, the text follows the target model's distribution. It reports no measurable inference latency on three LLMs.

LLM· 2026-11-01

TextSeal2 watermarks LLM text through speculative decoding — Keyed replacement tokens — What does it mean?

Jargon

Speculative decoding: A small draft model proposes several tokens and the large target model checks them in one pass. The draft-verify idea
Block verification: A verification rule that looks at the whole drafted block and stops at one position, keeping the drafts before it and emitting one new token there. It keeps the target model's exact output distribution.
Distortion-free watermark: A watermark whose next-token distribution, averaged over all possible secret keys, equals the model's own. Text quality is unchanged on average.
Exponential race: A way to sample a token: each token gets a random lane length from the key, runs at a speed equal to its probability, and the first to finish is the sample. Token v wins with exactly its probability.
Memorylessness: A property of the exponential distribution: the distance a lane still has to run after others have run for a while is again a fresh random value from the same distribution.
False-positive rate (FPR): How often the detector wrongly flags human text. The paper reports detection at an FPR of 1 in 1,000.
Acceptance rate: How many drafted tokens the target keeps per round. A watermark that lowers it slows serving.

The news. On 29 October 2026, Meta researchers posted TextSeal2, a successor to their TextSeal watermark. The paper reports that it keeps the watermark on tokens that replace rejected drafts in speculative decoding, evaluated on three LLMs with no measurable inference latency. Read the paper →

Picture the print shop. Every page the shop prints must carry the hidden stamp, because the inspector later counts stamps across a whole stack of pages to decide whether the shop printed it. An apprentice drafts four pages quickly. The master editor reads them and keeps the first two, rejects the third, and rewrites it. If the rewrite comes off the press without the stamp, that page is blank evidence.

That is the problem in speculative decoding. Each round emits an average of 2.74 tokens in the paper's setup, and the last one is a token the target model emits itself, and that token follows a residual distribution, not the draft's. In the paper's experiments, replaced tokens are about a third of the text. Earlier schemes handled them in one of three ways, and each gave something up.

Scheme	Replacement token	Detected (200 tokens)	Acceptance kept
TextSeal (coin flip)	Last token of each round drawn under an independent key	71 ± 2%	Yes
textGrain with block verification	Same independent-key rule	67 ± 4%	Yes
textGrain, its own recipe	Verifies between the watermarked distributions	84 ± 6%	No, about 5% fewer tokens per round
TextSeal2	One residual race on the draft races' leftovers	89 ± 1%	Yes

The setup is Qwen3.5-9B as the target and Qwen3.5-0.8B drafting 8 tokens per round, with detection at a false-positive rate of 1 in 1,000. TextSeal2 detects 18 points more than TextSeal and 22 points more than textGrain at the same acceptance; textGrain's own recipe gets close only by accepting fewer drafts. These are the paper's figures for one setup, so treat them as a comparison inside that setup.

Now the trick. In the print shop, the apprentice's stamp is only partly used up when the master rejects a page. Each draft token came from an exponential race: every candidate token has a secret lane length from the key, and the draft model's probabilities set the speeds. When the winner finishes, the other lanes still have distance left, and by memorylessness that leftover is again fresh randomness.

TextSeal2 runs one more race on exactly those leftovers, this time at the speeds the target model and block verification assign to each (stop position, token) pair. The winner of that second race decides where the round stops and which token replaces the draft. The paper proves two things about it: the number of tokens per round is the same as block verification's, so acceptance is unchanged, and the output follows the target model exactly.

A worked example (my own simplified arithmetic, not a result from the paper). Unwatermarked block verification emits an average of 2.74 tokens per round, including one final replacement token. So 1 in 2.74, about 36%, of all tokens sit at that position, which matches the paper's "about a third". In a 200-token answer that is roughly 73 tokens. If those carry no usable mark, 127 keyed tokens remain. A detector that sums per-token scores gains strength roughly with the square root of the number of keyed tokens, so the signal falls to about √(127/200) ≈ 0.80 of its full size, around 20% weaker, in this simplified view. Keeping all 200 tokens keyed removes that loss.

The detector does not change. It sums scores over the text and does not need to know where rounds end, because kept drafts carry the signal of their draft races and the replacement carries the signal of the relay race. The paper also notes limits: the guarantees assume the keyed values at each position are independent uniform values, which its window rule is designed to meet, and the results come from three LLMs.

Goes deeper in: LLM Serving → Speculative Decoding → The Verification Algorithm

Related explainers

TextSeal2 and exponential-race sampling — how a keyed race both samples a token and carries the watermark
RCSD: training speculative drafts from accepted and rejected sequences — another way the accept/reject signal shapes speculative decoding

Frequently Asked Questions

Check what you knowMap your AI & GPU knowledge across every track — free, role-based