Meta TextSeal2: An Open-Source LLM Text Watermark That Survives Speculative Decoding

Meta has added TextSeal2 to its open-source Text Seal toolkit. The facebookresearch/textseal repository marks it as new and describes it as a "distortion-free two-key copula watermark that stays exact and detectable under speculative decoding." In plain terms: it is a way to hide a statistical signature in LLM text without changing what the model would have said, and it keeps working when a small draft model is used to speed up generation.

This is a research release with code, not a product. There is no hosted service, no consumer detector and no Meta announcement we could find beyond the repo and its documentation. That makes it a useful tool for builders who serve their own models, and a useful data point for anyone following the debate about how AI text should be labeled.

TL;DR: TextSeal2 at a glance

What problem does TextSeal2 solve?

An LLM watermark nudges the choice of each next token using a secret key. Someone who holds the key can later run a statistical test on a piece of text and see whether it was likely produced by the keyed model. Doing this well is hard, because three goals pull against each other:

1. Quality. The watermark should not make the text worse.
2. Detectability. The test should work on short text and survive some editing.
3. Serving speed. The scheme should fit the way models are actually served.

The third goal is where many research watermarks quietly fail. Production inference often uses speculative decoding: a small, fast drafter proposes several tokens, and the large target model verifies them in one pass. Accepted drafts are fast; rejected ones are replaced. If a watermark assumes a single sampling step per token, the draft-and-verify loop can destroy the signal or distort the distribution.

TextSeal2 is designed for that setting. The documentation says that with block verification, "the output law is exactly the target's," while the emitted tokens stay keyed.

How TextSeal2 works, step by step

The repo's method section gives the mechanism in compact form. Here is a plain-language reading of it.

Sampling. For each position, the scheme looks at a window of the last three tokens. For every candidate next token, each of two secret keys produces a pseudo-random number. The two keys are merged into a single "virtual key," then blended with fresh random noise. A parameter rho sets the mix. The result is turned into a random "clock" for each candidate token, and the token whose clock divided by its model probability is smallest wins. This is a known sampling trick (a race of exponential clocks) that gives the model's exact distribution when the clocks are independent.

Why that is distortion-free. The documentation says the clocks are independent and identically distributed across keys and noise, so "every token follows the model exactly." The watermark lives in the correlation between the sampled token and the keys, not in a shift of probabilities.

Detection. Each pair of window and token is scored once. Without a watermark, the score follows a standard distribution; summing scores over n pairs gives a number that is tested against a Gamma distribution. The result is reported as a p-value. Using only key A gives a public test, so someone can check for the watermark without holding both keys.

Speculative decoding. Draft tokens are generated as races on the drafter's distribution. The verification step uses block verification (credited in the docs to Sun et al., 2025). The kept length and last token are chosen by a race on the leftovers of the draft races, which the docs call the "residual-J race." The stated result is that the output law is exactly the target model's and acceptance matches block verification, while the tokens remain keyed. A window's keyed values are used at most once per answer.

Try it: the quick start

The README's quick start uses a small Hugging Face model. This is the shape of the generation and detection flow:

from transformers import AutoModelForCausalLM, AutoTokenizer
from textseal.watermarking.config import WatermarkConfig
from textseal.watermarking.detector import build_detector
from textseal.watermarking.generator import build_generator

model_name = "meta-llama/Llama-3.2-3B-Instruct"
model = AutoModelForCausalLM.from_pretrained(model_name)
tokenizer = AutoTokenizer.from_pretrained(model_name)

wm_config = WatermarkConfig(watermark_type="textseal2", secret_key=42,
                            ngram=3, rho=0.9, prf="hires")
generator = build_generator(model, tokenizer, wm_config)
texts = generator.generate([prompt], max_gen_len=200, temperature=1.0, top_p=0.95)

detector = build_detector(tokenizer, wm_config)
scores = detector.get_scores_by_t(texts, scoring_method="v2", seen_windows=set())[0]
print(detector.get_pvalue(sum(scores), len(scores)))

Three practical notes from the documentation:

• rho trades diversity for detection. A higher value strengthens detection and reduces variety between samples. The README's examples use 0.9. The paper sweeps values between 0.7 and 0.99.
• The secret key is the whole security model. secret_key=42 is a demo value. Anyone who learns your real key can test for, and potentially work against, your watermark.
• Speculative decoding has its own class. The docs show a SpeculativeGenerator that pairs a Qwen3.5-0.8B drafter, drafting 8 tokens per call, with a Qwen3.5-9B target. It needs a GPU with the matching models downloaded.

What the repo says about its experiments

The repo does not publish a results table in the README, so we are not going to quote numbers we cannot see. It does describe the setup of the paper's experiments:

• Models: Qwen3.5-9B as the target and Qwen3.5-0.8B as the drafter, with a second drafter and target pair of Llama-3.2-1B-Instruct and Llama-3.1-8B-Instruct.
• Sampling: temperature 1, top-p 0.95, a window of 3 tokens, and 200 new tokens on the ELI5 question-answering set.
• Thresholds: a false-positive rate of 1e-3, calibrated on 10 keys times 10,000 unwatermarked answers.
• Other tasks: AIME math problems with longer answers, and the MBPP code benchmark.
• Baselines in the config: the original TextSeal, AutoMark, textGrain, and Google DeepMind's SynthID text implementation through the official g-values.

Because the scripts to reproduce these runs are included, anyone can rerun them and check the claims rather than trusting a summary. That is the main reason this release is worth a look.

The paper is titled "TextSeal2: Distortion-Free LLM Watermarking with Copula Mixing and Memoryless Races" and is listed as arXiv:2610.40613. The repo's citation block names Tom Sander, Pierre Fernandez, Itai Gat and others among the authors.

How TextSeal2 fits the wider Text Seal toolkit

The repository is broader than one method. Its README lists these pieces:

Post-hoc watermarking is the piece most readers can use without running their own model. You pass finished text to the PostHocWatermarker, and an LLM rewrites it while embedding the signal. The README gives tips on strengthening it: raise temperature for Gumbel-max watermarks, or raise delta for green-list watermarks.

What a watermark can and cannot do

Watermarks are often discussed as if they solved the question of "was this written by AI?" They do not, and the TextSeal2 documentation is careful not to say they do.

• It only detects text from a cooperating generator. If a model is not run with the watermark, there is nothing to find.
• Detection is probabilistic. You get a p-value. A low value is strong evidence; a high value says little, especially on short text.
• Heavy rewriting weakens the signal. The repo includes analysis scripts for attacks, but we have not run them, and we do not claim a robustness figure.
• The key is a single point of failure. Whoever holds it can check for the watermark. A leaked key can help an attacker target it.
• It does not identify a person. It ties text to a key and a model setup, not to an author.

For related reading on where text watermarks are heading in products, see our coverage of xAI's invisible text watermark for the Grok API, which shows a provider turning the idea into a shipping feature with an opt-out. Our piece on the provenance tax covers how watermarking can interfere with agent tool calls and refusals, a cost any serving team should weigh. DeepMind's SynthID Bio applies the same family of ideas to AI-designed proteins, and the case for the word "spymarks" raises the privacy side of hidden marks. If you are interested in how fake process evidence is created, see AI agents that hand-draw art and fake the timelapse.

Who should care

• Teams that serve open-weight models. If you run speculative decoding for latency and want a watermark, TextSeal2 is the first Meta release we have seen that targets that exact combination in code.
• Researchers. Reproducible scripts and baselines (including SynthID text) make this a convenient comparison harness.
• Benchmark maintainers. The radioactivity tooling offers a way to ask whether a test set leaked into training data, which matters for evaluation integrity.
• Policy and compliance readers. Labeling rules for AI text are moving. A distortion-free, openly available scheme is one input to what regulators and providers consider feasible. It is not a compliance solution on its own.

What we could not verify

We read the repository README and the TextSeal2 documentation. We did not run the code, and we found no separate Meta blog post or press statement for TextSeal2 at the time of writing. The release surfaced through a repo update; third-party aggregators relayed it. Every technical claim above is the repository's own description of its method. Performance claims in the paper, including detection strength and speed under speculative decoding, are best checked by running the included scripts.

Related reading

• Grok API invisible text watermark: what changes and how to opt out
• The provenance tax: watermarking, tool calls and refusals
• SynthID Bio: DeepMind can watermark AI-designed proteins
• "Spymarks": a new word for hidden AI tracking
• AI agents can hand-draw art and fake the timelapse

Primary sources: facebookresearch/textseal on GitHub and its TextSeal2 documentation.

Repository details are accurate as of November 2, 2026 and may change as Meta updates the code and paper.