[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"news-slug-textseal2-watermark-speculative-decoding":3,"topics-all":38,"news-related-008fe03d-3ba8-49f0-9445-0defb7977f66":57},{"id":4,"title":5,"summary":6,"content":7,"original_url":8,"source_id":9,"tags":10,"translations":24,"news_slug":31,"published_at":32,"created_at":33,"modified_at":34,"is_published":35,"publish_type":36,"image_url":14,"view_count":37},"008fe03d-3ba8-49f0-9445-0defb7977f66","TextSeal2:水印躲过投机解码,检测多22点","Meta 团队发布 TextSeal2 文本水印:不再抛硬币选密钥,而是把密钥合并成一把虚拟密钥,并用指数竞速让水印在投机解码下原样存活,接受率不变。Qwen3.5-9B 上投机解码时对 200 token 答案检出 95%,比 textGrain 高 22 个百分点,延迟与无水印采样相差不到 1%。","文本水印落地后最怕两件事:被人改写绕过,以及推理端开投机解码。前者是攻击问题,后者更尴尬——它是完全合法的工程优化:小模型先起草、大模型再批量验收,被拒草稿换下来的 token 一多,水印信号就跟着被稀释冲掉。Meta 研究团队 10 月 29 日挂出 TextSeal2(arXiv:2610.40613),给出了一个两边都不得罪的解法:水印在投机解码下原样存活,接受率一点不掉。\n\n## 上一代输在掷硬币\n\nTextSeal 属于 Gumbel-max 框架的无失真水印,为了保住输出多样性,它对每个 token 抛硬币,从两把密钥里随机挑一把来打水印。麻烦在检测端:它不知道生成端用了哪把钥匙,只能把两把钥匙的分数取平均,论文算出这一步白白损失 √2 倍信噪比。前代还埋着一个隐蔽缺陷:伪随机函数只量化到 13 bit,在候选 101-1000 个的高熵位置(占 0.9%)会产生 -42 millinats 的采样偏差;TextSeal2 换成 53 bit 的 splitmix64,这类偏差归零。\n\n## 核心改动:合并密钥,再跑一场竞速\n\nTextSeal2 不再掷硬币,而是把两把(或任意多把,包括可公开的检测密钥)合并成一把虚拟密钥,用 AutoMark 的高斯 copula 耦合新噪声。论文在 5,169 个真实 Qwen3.5-9B 分布上实测,这种耦合能达到最优单 token 信噪比的 97%。投机解码这一侧,草稿本身用带密钥的指数竞速采样,验证时在竞速残差上再补一场指数竞速;由指数分布的无记忆性,这场残差竞速恰好复现 block verification 的裁决——输出分布精确等于目标模型,替换草稿的 token 依旧带水印,每轮平均接受 token 数保持在无水印基线的 2.74。\n\n## 数字面:检出率与延迟\n\n主战场是 Qwen3.5-9B(温度 1、top-p 0.95、窗口 k=3、每组 3000 条生成):TextSeal2 检出 78%\u002F97% 的 100\u002F200 token 答案,textGrain 为 74%\u002F97%(误报率 10^-3、同等多样性)。开投机解码(Qwen3.5-0.8B 每轮起草 8 个 token)后差距拉开:TextSeal2 保持 67%\u002F95%,TextSeal 掉到 48%\u002F87%,textGrain 剩 36%\u002F76%。跨模型结论不是单边碾压:比 TextSeal 在三个模型上多检出 8-22 个百分点;对 textGrain 在 Llama-3.1-8B 领先 11 点、Qwen3.5-9B 打平、Qwen3.5-27B 落后 5 点。长文本场景同样能打:AIME 数学题(最长 8192 token)在 2048 token 处检出 41%,textGrain 自家配方 38%,准确率不变。延迟则是另一半卖点:论文在 H200 上实测,textGrain 式的 Sinkhorn 后优化每步 1.1-3.0 毫秒(占 50 毫秒解码步的 2-6%),即便最简实现也是 TextSeal2 后处理量的 8-22 倍;TextSeal2 的密钥侧计算能与前向并行,与无水印采样相差不到 0.9%。\n\n## 冷水与边界\n\n论文自曝的局限值得照抄:只测了 Llama-3.1-8B-Instruct、Qwen3.5-9B、Qwen3.5-27B 三个开放权重模型和 ELI5、MBPP、AIME 三个领域,温度 0.7-1;投机解码本身让检出率损失 2-4 个百分点;投机实现未做 batching,没测墙钟加速;利用公开密钥知识的攻击也未分析。代码在 [github.com\u002Ffacebookresearch\u002Ftextseal](https:\u002F\u002Fgithub.com\u002Ffacebookresearch\u002Ftextseal)(Apache-2.0 许可证),仓库已带 TextSeal2 复现脚本与 quick start,论文原文见 [arXiv:2610.40613](https:\u002F\u002Farxiv.org\u002Fabs\u002F2610.40613)。\n\n对文本水印这条赛道来说,这篇的价值不在那几个百分点,而在拆掉了「水印与推理效率只能二选一」的旧设定。下一道考题依然是改写攻击——那才是水印这门手艺真正的生死线。","https:\u002F\u002Farxiv.org\u002Fabs\u002F2610.40613","7437aeb9-930c-4866-a2e9-48003c1a792b",[11,15,18,21],{"id":12,"name":13,"slug":13,"description":14,"color":14},"1fcfaaf2-67de-43d3-9e35-5784852fec60","ai-safety",null,{"id":16,"name":17,"slug":17,"description":14,"color":14},"0a93ec8e-ea39-4693-81de-563ca8c173f7","inference",{"id":19,"name":20,"slug":20,"description":14,"color":14},"01598627-1ea6-4b27-a5d8-874971571a71","llm",{"id":22,"name":23,"slug":23,"description":14,"color":14},"b9bd9039-fcdb-41a8-b85b-fc1587def2b9","open-source",[25],{"id":26,"lang":27,"title":28,"summary":29,"content":30},"1d073b6b-8980-4571-875b-686a7fbf8171","en","TextSeal2: Meta watermark survives speculative decoding","TextSeal2 merges keys into a virtual key, racing on draft leftovers: 95% detection on 200-token answers under spec decoding, 22 points over textGrain.","Text watermarks fear two things once deployed: paraphrasing attacks, and the serving stack turning on speculative decoding. The first is an attack problem; the second is more awkward — it is a perfectly legitimate engineering optimization. A small model drafts, the large model verifies in batches, and every rejected draft swapped out carries watermark signal away with it. Meta's research team posted TextSeal2 on October 29 (arXiv:2610.40613), with a fix that offends neither side: the watermark survives speculative decoding intact, and the acceptance rate does not move.\n\n## The predecessor lost at the coin flip\n\nTextSeal is a distortion-free watermark in the Gumbel-max scheme. To preserve output diversity it flips a coin per token, routing each one to one of two keys. The trouble sits at the detector: it never knows which key was used, so it averages the two scores — the paper quantifies the waste as a √2 loss in signal-to-noise ratio. The predecessor also hid a subtler flaw: its PRF quantized values to 13 bits, biasing sampling by -42 millinats at high-entropy positions with 101-1000 candidates (0.9% of positions). TextSeal2 switches to a 53-bit splitmix64 PRF and the bias disappears.\n\n## Core change: merge the keys, run one more race\n\nTextSeal2 stops flipping coins. It merges two or more keys — including a publicly shareable detection key — into a single virtual key, coupled to fresh noise through AutoMark's Gaussian copula. On 5,169 real Qwen3.5-9B distributions the coupling attains 97% of the optimal per-token signal-to-noise ratio. On the speculative side, drafts are drawn by keyed exponential races, and verification adds one more exponential race run on the leftovers of the draft races. By memorylessness, this residual race reproduces block verification exactly: the output distribution equals the target model's, tokens that replace rejected drafts stay watermarked, and acceptance holds at the unwatermarked baseline of 2.74 tokens per round.\n\n## The numbers: detection and latency\n\nThe main battleground is Qwen3.5-9B (temperature 1, top-p 0.95, window k=3, 3000 answers per configuration): TextSeal2 detects 78%\u002F97% of 100\u002F200-token answers against 74%\u002F97% for textGrain (FPR 10^-3, matched diversity). With speculative decoding on (Qwen3.5-0.8B drafting 8 tokens per round) the gap opens: TextSeal2 holds 67%\u002F95%, TextSeal falls to 48%\u002F87%, textGrain to 36%\u002F76%. Across models it is not a one-sided sweep: 8-22 points over TextSeal on all three models, while against textGrain it leads by 11 on Llama-3.1-8B, ties on Qwen3.5-9B, and trails by 5 on Qwen3.5-27B. Long texts hold up too: on AIME problems (up to 8192 tokens) it detects 41% at 2048 tokens against 38% for textGrain's own recipe, with accuracy unchanged. Latency is the other half of the story: measured on an H200, the Sinkhorn post-optimization of the textGrain style costs 1.1-3.0 ms per step (2-6% of a 50 ms decoding step), and even its minimal version does 8-22 times TextSeal2's post-logits work; TextSeal2's key-only computation overlaps the forward pass, landing within 0.9% of plain unwatermarked sampling.\n\n## Caveats and edges\n\nThe paper's own limitations are worth copying: only three open-weight models (Llama-3.1-8B-Instruct, Qwen3.5-9B, Qwen3.5-27B) and three domains (ELI5, MBPP, AIME), temperatures 0.7-1; speculative decoding itself costs 2-4 percentage points of detection; the speculative implementation is unbatched, so no wall-clock speedups were measured; attacks exploiting knowledge of the public key were not analyzed. Code is at [github.com\u002Ffacebookresearch\u002Ftextseal](https:\u002F\u002Fgithub.com\u002Ffacebookresearch\u002Ftextseal) under Apache-2.0, with TextSeal2 reproduction scripts and a quick start already in the repo; the paper is [arXiv:2610.40613](https:\u002F\u002Farxiv.org\u002Fabs\u002F2610.40613).\n\nFor the text-watermark track, the value here is not those percentage points but the removal of an old trade-off: watermark and inference efficiency were previously either\u002For. The next exam is still the paraphrasing attack — that remains the real life-or-death line for watermarks.","textseal2-watermark-speculative-decoding","2026-11-01T15:11:35Z","2026-11-01T15:11:39.452303Z","2026-11-01T15:11:39.452316Z",true,"agent",198,[39,48],{"slug":40,"tag_slug":40,"title_zh":41,"title_en":42,"intro_zh":43,"intro_en":44,"id":45,"is_active":35,"created_at":46,"modified_at":47},"ai-for-science","AI for Science 2026：从 UniPert 到 GPT-Rosalind 的硬核进化","AI for Science 2026: from UniPert to GPT-Rosalind","生命科学、化学材料、物理世界模型——AI 正在从\"语言工具\"变成\"实验伙伴\"。本专题收录 AI 在三大科学方向的关键节点：UniPert 统一基因与化学扰动空间、GPT-Rosalind 端到端生命科学推理、达摩院 AI 智能体 28 小时找到 4 种超导新材料、Anthropic Claude Science 把工作台做成标准品。","From language tool to lab partner — AI is reshaping life sciences, chemistry\u002Fmaterials, and physical world models. This topic covers the key milestones: UniPert unifying genetic-chemical perturbation spaces, GPT-Rosalind's end-to-end life-sciences reasoning, DAMO's AI agent discovering 4 superconducting materials in 28 hours, and Anthropic's Claude Science workbench going mainstream.","988a4300-5fab-41c4-b5d8-63711a2dc757","2026-09-10T01:34:15.296649Z","2026-09-10T01:34:15.296663Z",{"slug":49,"tag_slug":49,"title_zh":50,"title_en":51,"intro_zh":52,"intro_en":53,"id":54,"is_active":35,"created_at":55,"modified_at":56},"h3-series","MiniMax H3 系列：从开源权重到 35 倍吞吐","MiniMax H3 Series: from open weights to 35x throughput","MiniMax H3 自 2026 年 8 月开源以来节奏密集：官方把生成、参考与编辑收回一个模型；ComfyUI 当天压进 RTX 3060；摩尔线程 3 小时完成国产 GPU 适配；fal 后训练版把吞吐拉到 35 倍；FastH3 蒸馏再砍推理成本。本专题持续追踪 H3 的发布—开源—蒸馏—部署全链路。","Since MiniMax open-sourced H3 in August 2026 the pace has been relentless: one unified omni-modal model, same-day ComfyUI support down to an RTX 3060, a 3-hour Day-0 port to Moore Threads GPUs, fal's post-trained H3 Max at 35x throughput, and FastH3 distillation cutting inference cost further. This topic tracks the full H3 chain — release, open weights, distillation, deployment.","83ef0daa-3c31-4cb3-86ed-e5ee58654d5f","2026-09-08T07:33:19.942193Z","2026-09-08T07:33:19.942209Z",{"items":58},[59,64,69,74,79,84],{"id":60,"title":61,"news_slug":62,"published_at":63},"44009c4a-bcba-46a5-81a8-b94cb17ca840","上下文压缩省了算力,却悄悄削掉了拒答","context-compression-weakens-refusal-alignment","2026-11-05T07:05:00+00:00",{"id":65,"title":66,"news_slug":67,"published_at":68},"71fb0c13-8ea5-4c49-91b1-7fdafc0b55a8","单卡110token\u002F秒:FlashProve可证推理开源","anthropic-flashprove-provable-inference","2026-11-03T23:11:00+00:00",{"id":70,"title":71,"news_slug":72,"published_at":73},"9cfac3fd-f359-467e-94ba-f8ed3172d713","生成器自己当重排器:RAG 少驻留一个模型","glance-generator-reranker-shared-prefill","2026-10-31T13:11:54+00:00",{"id":75,"title":76,"news_slug":77,"published_at":78},"559df680-f13e-48f0-9263-73116aaff411","上交大DLite免历史投机解码:Agent提速2.74倍","dlite-history-free-speculative-decoding","2026-10-19T17:07:52+00:00",{"id":80,"title":81,"news_slug":82,"published_at":83},"ab1e6bdf-9433-41f0-be4d-cc0f78523ac2","SonicBoom v0.0.3:一个 .so 干掉手工调优","sonicboom-v003-mlir-compiler","2026-10-19T09:03:05+00:00",{"id":85,"title":86,"news_slug":87,"published_at":88},"35b53dfa-7faa-470d-a8e4-798e08edfc41","NetBSD 拒 AI 代码冲上 12 万美元捐款,反 AI 阵营找到新坐标","netbsd-120k-usd-anti-ai-code-ban","2026-10-15T08:00:00+00:00"]