Meta TextSeal2: An Open-Source LLM Text Watermark That Survives Speculative Decoding

Meta researchers added TextSeal2, a distortion-free two-key copula watermark, to the open-source facebookresearch/textseal toolkit, with the README citing a paper by authors including Tom Sander, Hongyan Chang and Pierre Fernandez. The repository describes TextSeal2 as staying exact and detectable under speculative decoding, so every token follows the model's own distribution while the watermark lives in the correlation between sampled tokens and two secret keys; a parameter named rho trades output diversity for detection strength. The release is research code installable via `pip install textseal`, not a hosted service or consumer detector, and the documentation states it is a statistical test tied to a secret key rather than proof of AI authorship.

Meta has added TextSeal2 to its open-source Text Seal toolkit. The facebookresearch/textseal repository https://github.com/facebookresearch/textseal?ref=explainx marks it as new and describes it as a "distortion-free two-key copula watermark that stays exact and detectable under speculative decoding." In plain terms: it is a way to hide a statistical signature in LLM text without changing what the model would have said, and it keeps working when a small draft model is used to speed up generation. This is a research release with code, not a product. There is no hosted service, no consumer detector and no Meta announcement we could find beyond the repo and its documentation. That makes it a useful tool for builders who serve their own models, and a useful data point for anyone following the debate about how AI text should be labeled. TL;DR: TextSeal2 at a glance | Question | Answer | |---|---| | What is it? | A generation-time watermark for LLM text, in Meta's open-source Text Seal toolkit | | What is new? | A two-key copula sampler that is distortion-free and works with speculative decoding | | Who built it? | Meta researchers. The README cites a paper with authors including Tom Sander, Hongyan Chang and Pierre Fernandez | | How do I install it? | pip install textseal , or clone the repo and pip install -e . | | Does it change model output quality? | The documentation says no: every token follows the model's own distribution exactly | | What is the trade-off? | A parameter named rho trades output diversity for detection strength | | Can a third party check the watermark? | Yes, with one key a public test . Both keys give the full test | | Is it a proof of AI authorship? | No. It is a statistical test tied to a secret key | What problem does TextSeal2 solve? An LLM watermark nudges the choice of each next token using a secret key. Someone who holds the key can later run a statistical test on a piece of text and see whether it was likely produced by the keyed model. Doing this well is hard, because three goals pull against each other: 1. Quality. The watermark should not make the text worse. 2. Detectability. The test should work on short text and survive some editing. 3. Serving speed. The scheme should fit the way models are actually served. The third goal is where many research watermarks quietly fail. Production inference often uses speculative decoding : a small, fast drafter proposes several tokens, and the large target model verifies them in one pass. Accepted drafts are fast; rejected ones are replaced. If a watermark assumes a single sampling step per token, the draft-and-verify loop can destroy the signal or distort the distribution. TextSeal2 is designed for that setting. The documentation says that with block verification, "the output law is exactly the target's," while the emitted tokens stay keyed. How TextSeal2 works, step by step The repo's method section gives the mechanism in compact form. Here is a plain-language reading of it. Sampling. For each position, the scheme looks at a window of the last three tokens. For every candidate next token, each of two secret keys produces a pseudo-random number. The two keys are merged into a single "virtual key," then blended with fresh random noise. A parameter rho sets the mix. The result is turned into a random "clock" for each candidate token, and the token whose clock divided by its model probability is smallest wins. This is a known sampling trick a race of exponential clocks that gives the model's exact distribution when the clocks are independent. Why that is distortion-free. The documentation says the clocks are independent and identically distributed across keys and noise, so "every token follows the model exactly." The watermark lives in the correlation between the sampled token and the keys, not in a shift of probabilities. Detection. Each pair of window and token is scored once. Without a watermark, the score follows a standard distribution; summing scores over n pairs gives a number that is tested against a Gamma distribution. The result is reported as a p-value. Using only key A gives a public test , so someone can check for the watermark without holding both keys. Speculative decoding. Draft tokens are generated as races on the drafter's distribution. The verification step uses block verification credited in the docs to Sun et al., 2025 . The kept length and last token are chosen by a race on the leftovers of the draft races, which the docs call the "residual-J race." The stated result is that the output law is exactly the target model's and acceptance matches block verification, while the tokens remain keyed. A window's keyed values are used at most once per answer. Try it: the quick start The README's quick start uses a small Hugging Face model. This is the shape of the generation and detection flow: python from transformers import AutoModelForCausalLM, AutoTokenizer from textseal.watermarking.config import WatermarkConfig from textseal.watermarking.detector import build detector from textseal.watermarking.generator import build generator model name = "meta-llama/Llama-3.2-3B-Instruct" model = AutoModelForCausalLM.from pretrained model name tokenizer = AutoTokenizer.from pretrained model name wm config = WatermarkConfig watermark type="textseal2", secret key=42, ngram=3, rho=0.9, prf="hires" generator = build generator model, tokenizer, wm config texts = generator.generate prompt , max gen len=200, temperature=1.0, top p=0.95 detector = build detector tokenizer, wm config scores = detector.get scores by t texts, scoring method="v2", seen windows=set 0 print detector.get pvalue sum scores , len scores Three practical notes from the documentation: - rho trades diversity for detection. A higher value strengthens detection and reduces variety between samples. The README's examples use 0.9. The paper sweeps values between 0.7 and 0.99. - The secret key is the whole security model. secret key=42 is a demo value. Anyone who learns your real key can test for, and potentially work against, your watermark. - Speculative decoding has its own class. The docs show a SpeculativeGenerator that pairs a Qwen3.5-0.8B drafter, drafting 8 tokens per call, with a Qwen3.5-9B target. It needs a GPU with the matching models downloaded. What the repo says about its experiments The repo does not publish a results table in the README, so we are not going to quote numbers we cannot see. It does describe the setup of the paper's experiments: - Models: Qwen3.5-9B as the target and Qwen3.5-0.8B as the drafter, with a second drafter and target pair of Llama-3.2-1B-Instruct and Llama-3.1-8B-Instruct. - Sampling: temperature 1, top-p 0.95, a window of 3 tokens, and 200 new tokens on the ELI5 question-answering set. - Thresholds: a false-positive rate of 1e-3, calibrated on 10 keys times 10,000 unwatermarked answers. - Other tasks: AIME math problems with longer answers, and the MBPP code benchmark. - Baselines in the config: the original TextSeal, AutoMark, textGrain, and Google DeepMind's SynthID text implementation through the official g-values. Because the scripts to reproduce these runs are included, anyone can rerun them and check the claims rather than trusting a summary. That is the main reason this release is worth a look. The paper is titled "TextSeal2: Distortion-Free LLM Watermarking with Copula Mixing and Memoryless Races" and is listed as arXiv:2610.40613 https://arxiv.org/abs/2610.40613?ref=explainx . The repo's citation block names Tom Sander, Pierre Fernandez, Itai Gat and others among the authors. How TextSeal2 fits the wider Text Seal toolkit The repository is broader than one method. Its README lists these pieces: | Component | What it does | |---|---| | TextSeal2 | New. Distortion-free two-key copula watermark, exact under speculative decoding | | TextSeal | Dual-key generation-time watermark with speculative decoding and localized detection. See the TextSeal paper on arXiv https://arxiv.org/abs/2605.12456?ref=explainx | | Post-hoc watermarking | Rewrites existing text with an LLM while inserting a watermark from a generation-time scheme green-list, Gumbel-max, DipMark, SynthID, MorphMark, WaterMax and others | | Public detection | One key for public detection, both keys for full detection that flags tampering | | Contamination detection | Detects whether watermarked benchmark data entered a model's training set, through "radioactivity" | | Training infrastructure | Distributed pretraining and fine-tuning with contamination injection, for research | Post-hoc watermarking is the piece most readers can use without running their own model. You pass finished text to the PostHocWatermarker , and an LLM rewrites it while embedding the signal. The README gives tips on strengthening it: raise temperature for Gumbel-max watermarks, or raise delta for green-list watermarks. What a watermark can and cannot do Watermarks are often discussed as if they solved the question of "was this written by AI?" They do not, and the TextSeal2 documentation is careful not to say they do. - It only detects text from a cooperating generator. If a model is not run with the watermark, there is nothing to find. - Detection is probabilistic. You get a p-value. A low value is strong evidence; a high value says little, especially on short text. - Heavy rewriting weakens the signal. The repo includes analysis scripts for attacks, but we have not run them, and we do not claim a robustness figure. - The key is a single point of failure. Whoever holds it can check for the watermark. A leaked key can help an attacker target it. - It does not identify a person. It ties text to a key and a model setup, not to an author. For related reading on where text watermarks are heading in products, see our coverage of xAI's invisible text watermark for the Grok API https://explainx.ai/blog/xai-grok-api-invisible-text-watermark-november-7-eu-ai-act-opt-out-x-watermark-header-2026 , which shows a provider turning the idea into a shipping feature with an opt-out. Our piece on the provenance tax https://explainx.ai/blog/lasso-provenance-tax-watermarking-agent-tool-calling-2026 covers how watermarking can interfere with agent tool calls and refusals, a cost any serving team should weigh. DeepMind's SynthID Bio https://explainx.ai/blog/deepmind-synthid-bio-protein-watermarking-2026 applies the same family of ideas to AI-designed proteins, and the case for the word "spymarks" https://explainx.ai/blog/spymarks-vs-watermarks-ai-tracking-explained-2026 raises the privacy side of hidden marks. If you are interested in how fake process evidence is created, see AI agents that hand-draw art and fake the timelapse https://explainx.ai/blog/ai-agents-hand-drawing-fake-timelapse-proof-2026 . Who should care - Teams that serve open-weight models. If you run speculative decoding for latency and want a watermark, TextSeal2 is the first Meta release we have seen that targets that exact combination in code. - Researchers. Reproducible scripts and baselines including SynthID text make this a convenient comparison harness. - Benchmark maintainers. The radioactivity tooling offers a way to ask whether a test set leaked into training data, which matters for evaluation integrity. - Policy and compliance readers. Labeling rules for AI text are moving. A distortion-free, openly available scheme is one input to what regulators and providers consider feasible. It is not a compliance solution on its own. What we could not verify We read the repository README and the TextSeal2 documentation. We did not run the code, and we found no separate Meta blog post or press statement for TextSeal2 at the time of writing. The release surfaced through a repo update; third-party aggregators relayed it. Every technical claim above is the repository's own description of its method. Performance claims in the paper, including detection strength and speed under speculative decoding, are best checked by running the included scripts. Related reading Primary sources: facebookresearch/textseal on GitHub https://github.com/facebookresearch/textseal?ref=explainx and its TextSeal2 documentation https://github.com/facebookresearch/textseal/blob/main/docs/README textseal2.md?ref=explainx . Repository details are accurate as of November 2, 2026 and may change as Meta updates the code and paper.