TextSeal2 detects up to 22% more watermarked answers without affecting diversity or latency

The five-minute version

TextSeal2 markedly improves detection of LLM-generated text, achieving 59%/89% detection at a 10−3 false-positive rate for 100/200-token answers under speculative decoding, and up to 22 percentage-point gains over the prior coin-flip watermark without speculative decoding. It does so while remaining distortion-free, preserving answer diversity, adding only ~0.9% latency, and keeping the acceptance rate of speculative decoding. The evidence comes from thousands of generated answers on three open-weight models and three task domains, compared against TextSeal, textGrain, AutoMark copula and SynthID-Text. However, the paper notes a 2-4 pp detection loss when using speculative decoding and does not measure wall-clock speedups.

What they found 3

• TextSeal2 detects 10, 22 and 8 percentage points more 100-token answers than the coin-flip baseline on three models.

  “TextSeal2 detects 10, 22 and 8 percentage points more 100-token answers than the coin flip (Sander et al., 2026) on Llama3.1-8B, Qwen3.5-9B and Qwen3.5-27B respectively (paired 95% intervals [+4, +15], [+15, +25] and [+3, +12]; Figure 1a and Figure 7).”

• Under speculative decoding, TextSeal2 detects 59%/89% of 100/200-token answers, far ahead of baselines.

  “Interpolated at TextSeal’s Self-BLEU, TextSeal2 detects 59% / 89% of 100 / 200-token answers, against 31% / 71% for TextSeal, 31% / 67% for textGrain, 25% / 60% for AutoMark’s copula, and 17% / 50% for SynthID-Text; all paired intervals against TextSeal2 exclude zero (Table 1, Figure 1b).”

• TextSeal2 is distortion-free: its token-level statistics are indistinguishable from unwatermarked block verification.

  “TextSeal2 and the baselines are indistinguishable from unwatermarked block verification on both tests (textGrain’s own recipe on the all-token test, the only one that applies to it), whereas racing on the raw lane lengths fails the all-token test, by +11.7 [+5.8, +17.8] millinats per token (Figure 11).”

What undercuts it the paper’s own results

• Speculative decoding reduces detection by 2-4 percentage points relative to standard decoding.
• The speculative-decoding implementation is unbatched, so wall-clock speedups are not measured.

Stated limits 4

• Our evaluation covers three domains (open-ended ELI5 answers, MBPP code, and AIME math problems under speculative decoding) and three open-weight models, at temperatures 0.7-1.
• With block verification and 8 drafts, speculative decoding costs 2-4 percentage points of detection relative to standard decoding, and our speculative-decoding implementation is unbatched, so we do not measure wall-clock speedups.
• We do not analyse attacks that exploit knowledge of the public key beyond the private verification it enables (Milis et al., 2026).
• Finally, textGrain’s code is not public, so we use our reimplementation (Appendix G); its deployed parameters may differ.

What’s new here 4

• Introduces a residual-race mechanism that reuses draft-race leftovers, eliminating the signal loss of independent keys.
• Provides an entropy-weighted detection test that boosts detection by up to 23 pp across all methods.
• Achieves distortion-free watermarking while preserving speculative decoding acceptance rates.
• Demonstrates comparable or superior detection to textGrain without per-token optimisation.

Artifacts & methods 8

• TextSeal2system
• Copula mixingprimitive
• Residual raceprimitive
• Entropy-weighted detection testprimitive
• Qwen3.5-9B (and other LLMs)evaluation
• ELI5 question setdataset
• MBPP test problemsdataset
• AIME math problemsdataset

Topics