Text watermarks fear two things once deployed: paraphrasing attacks, and the serving stack turning on speculative decoding. The first is an attack problem; the second is more awkward — it is a perfectly legitimate engineering optimization. A small model drafts, the large model verifies in batches, and every rejected draft swapped out carries watermark signal away with it. Meta's research team posted TextSeal2 on October 29 (arXiv:2610.40613), with a fix that offends neither side: the watermark survives speculative decoding intact, and the acceptance rate does not move.
The predecessor lost at the coin flip
TextSeal is a distortion-free watermark in the Gumbel-max scheme. To preserve output diversity it flips a coin per token, routing each one to one of two keys. The trouble sits at the detector: it never knows which key was used, so it averages the two scores — the paper quantifies the waste as a √2 loss in signal-to-noise ratio. The predecessor also hid a subtler flaw: its PRF quantized values to 13 bits, biasing sampling by -42 millinats at high-entropy positions with 101-1000 candidates (0.9% of positions). TextSeal2 switches to a 53-bit splitmix64 PRF and the bias disappears.
Core change: merge the keys, run one more race
TextSeal2 stops flipping coins. It merges two or more keys — including a publicly shareable detection key — into a single virtual key, coupled to fresh noise through AutoMark's Gaussian copula. On 5,169 real Qwen3.5-9B distributions the coupling attains 97% of the optimal per-token signal-to-noise ratio. On the speculative side, drafts are drawn by keyed exponential races, and verification adds one more exponential race run on the leftovers of the draft races. By memorylessness, this residual race reproduces block verification exactly: the output distribution equals the target model's, tokens that replace rejected drafts stay watermarked, and acceptance holds at the unwatermarked baseline of 2.74 tokens per round.
The numbers: detection and latency
The main battleground is Qwen3.5-9B (temperature 1, top-p 0.95, window k=3, 3000 answers per configuration): TextSeal2 detects 78%/97% of 100/200-token answers against 74%/97% for textGrain (FPR 10^-3, matched diversity). With speculative decoding on (Qwen3.5-0.8B drafting 8 tokens per round) the gap opens: TextSeal2 holds 67%/95%, TextSeal falls to 48%/87%, textGrain to 36%/76%. Across models it is not a one-sided sweep: 8-22 points over TextSeal on all three models, while against textGrain it leads by 11 on Llama-3.1-8B, ties on Qwen3.5-9B, and trails by 5 on Qwen3.5-27B. Long texts hold up too: on AIME problems (up to 8192 tokens) it detects 41% at 2048 tokens against 38% for textGrain's own recipe, with accuracy unchanged. Latency is the other half of the story: measured on an H200, the Sinkhorn post-optimization of the textGrain style costs 1.1-3.0 ms per step (2-6% of a 50 ms decoding step), and even its minimal version does 8-22 times TextSeal2's post-logits work; TextSeal2's key-only computation overlaps the forward pass, landing within 0.9% of plain unwatermarked sampling.
Caveats and edges
The paper's own limitations are worth copying: only three open-weight models (Llama-3.1-8B-Instruct, Qwen3.5-9B, Qwen3.5-27B) and three domains (ELI5, MBPP, AIME), temperatures 0.7-1; speculative decoding itself costs 2-4 percentage points of detection; the speculative implementation is unbatched, so no wall-clock speedups were measured; attacks exploiting knowledge of the public key were not analyzed. Code is at github.com/facebookresearch/textseal under Apache-2.0, with TextSeal2 reproduction scripts and a quick start already in the repo; the paper is arXiv:2610.40613.
For the text-watermark track, the value here is not those percentage points but the removal of an old trade-off: watermark and inference efficiency were previously either/or. The next exam is still the paraphrasing attack — that remains the real life-or-death line for watermarks.