💬 NLP

TextSeal: A Localized LLM Watermark for Provenance & Distillation Protection

TextSeal is a state-of-the-art, distortion-free LLM watermarking scheme that ensures robust provenance detection and distillation protection through dual-key generation and multi-region localization, all while maintaining output quality and supporting serving optimizations without inference overhead.

Original authors: Tom Sander, Hongyan Chang, Tomáš Souček, Tuan Tran, Valeriu Lacatusu, Sylvestre-Alvise Rebuffi, Alexandre Mourachko, Surya Parimi, Christophe Ropers, Rashel Moritz, Vanessa Stark, Hady Elsahar, Pierre

Published 2026-05-13

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Tom Sander, Hongyan Chang, Tomáš Souček, Tuan Tran, Valeriu Lacatusu, Sylvestre-Alvise Rebuffi, Alexandre Mourachko, Surya Parimi, Christophe Ropers, Rashel Moritz, Vanessa Stark, Hady Elsahar, Pierre Fernandez

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are a baker who makes thousands of delicious loaves of bread every day. You want to know if a loaf in a grocery store was baked by you, or if someone else copied your recipe and baked it themselves. But here's the catch: you can't just stamp "Made by Baker Tom" on the bread, because that ruins the taste and texture. You need a secret ingredient that is invisible to the human tongue but leaves a unique, detectable fingerprint for your special scanner.

This is exactly the problem TextSeal solves for Large Language Models (AI). It is a new, high-tech "invisible watermark" that proves who wrote a piece of text without changing how the text sounds or looks.

Here is how TextSeal works, broken down into simple concepts:

1. The Secret Ingredient (Dual-Key Generation)

Older watermarks were like a stamp that always put the same mark in the same spot. If you asked the AI the same question twice, it would give you the exact same answer both times. This is boring for users and can even make the AI get stuck in repetitive loops (like a song on repeat).

TextSeal's Solution: It uses two secret keys instead of one. Every time the AI picks a word, it flips a coin to decide which key to use.

The Analogy: Imagine you have two different secret spices. Sometimes you sprinkle Spice A, sometimes Spice B. To the eater, the bread tastes exactly the same (no distortion), but to your scanner, the pattern of spices creates a unique, varied fingerprint that proves it came from you. This keeps the AI's answers fresh and diverse while still being traceable.

2. The Smart Scanner (Entropy-Weighted Detection)

Detecting a watermark is hard because AI sometimes writes very predictable things (low "entropy") and sometimes very creative, unpredictable things (high "entropy").

The Problem: If the AI is 99% sure the next word is "the," adding a watermark there is like trying to hide a whisper in a hurricane. It's hard to hear. But if the AI is guessing between many words, the watermark signal is much stronger.
TextSeal's Solution: It uses a "smart scanner" that knows to pay extra attention to the parts of the text where the AI was unsure (high entropy). It ignores the boring, predictable parts and focuses on the creative parts where the watermark signal is strongest. This makes the detection much more accurate, even in long documents.

3. Finding the Needle in the Haystack (Localized Detection)

Imagine someone takes a paragraph you wrote, mixes it into a 50-page essay written by a human, and claims the whole thing is theirs. Old watermarks would look at the whole essay, get confused by all the human writing, and say, "I can't find the watermark."

TextSeal's Solution: It doesn't just look at the whole document; it scans for specific regions.

The Analogy: Instead of trying to find a single grain of sand in a beach, TextSeal looks for small, specific patches of sand that have a unique color. Even if the AI text is only 5% of a huge document, TextSeal can isolate that 5%, ignore the rest, and say, "Aha! This specific paragraph is definitely AI-generated." This works even if the AI text is chopped up and scattered throughout the document.

4. The "Radioactive" Effect (Distillation Protection)

This is perhaps the most powerful feature. If a competitor tries to steal your AI's "brain" by training their own model on your watermarked outputs, the watermark doesn't just stay in the text—it gets learned.

The Analogy: Imagine your secret spice is so potent that if a competitor tries to bake bread using your old loaves as a reference, their new bread still carries a faint trace of your spice, even if they never saw your secret recipe.
The Claim: The paper shows that if a student model is trained on TextSeal watermarked data, that student model becomes "radioactive." You can test the student model, and it will still show the watermark signal, proving it was trained on your data. This stops competitors from secretly copying your model's knowledge.

Why is this a big deal?

It's Invisible: The paper tested this with humans reading thousands of examples. They couldn't tell the difference between watermarked and non-watermarked text. It didn't make the AI sound robotic or make mistakes.
It's Fast: It adds almost zero time to the AI's thinking process, so it can be used in real-time apps.
It's Strong: It beats previous methods (like Google's SynthID) in detecting watermarks, even when the text is heavily diluted or mixed with human writing.

In short, TextSeal is a way to sign your AI's work with an invisible, unbreakable ink that survives copying, mixing, and even being "learned" by other models, all without ruining the quality of the text.

Technical Summary: TextSeal

Problem Statement

The rapid deployment of Large Language Models (LLMs) in production systems necessitates reliable mechanisms for content provenance. Watermarking aims to embed an imperceptible, algorithmically detectable signal into generated text to identify AI origins, comply with emerging regulations (e.g., the EU AI Act), and prevent unauthorized uses such as model distillation or self-training on synthetic data.

Existing state-of-the-art methods face a critical trade-off between detectability and diversity. While distortion-free methods like Gumbel-max sampling preserve the model's original output distribution (ensuring no quality degradation), they are fully deterministic: a fixed prompt and secret key always yield the same output. This eliminates generation diversity, leading to repetitive loops and poor user experience. Conversely, methods that introduce randomness to restore diversity often compromise the statistical strength of the watermark or introduce distortion (biasing the output distribution). Furthermore, existing detectors struggle with dilution, failing to identify watermarked content when it is mixed with large volumes of human-written text or fragmented across a document.

Methodology: TextSeal

TextSeal is a distortion-free, non-deterministic watermarking scheme built upon the Gumbel-max framework. It introduces three core technical innovations to address the limitations of prior art:

1. Dual-Key Generation for Diversity

To overcome the determinism of standard Gumbel-max, TextSeal employs Dual-Key Routing.

Mechanism: At each generation step, the system randomly selects one of two secret keys, $k^{(1)}$ or $k^{(2)}$ , with probabilities $1-\alpha$ and $\alpha$ respectively. The token is selected via the Gumbel-max trick using the PRF (Pseudo-Random Function) value derived from the chosen key.
Impact: This restores output diversity (breaking deterministic loops) while maintaining the distortion-free property.
Optimization: The routing probability $\alpha$ can be dynamically aligned with speculative decoding acceptance rates (e.g., in Multi-Token Prediction scenarios), ensuring compatibility with serving optimizations without adding inference latency.

2. Entropy-Weighted Detection

Standard detection scores treat all tokens equally, but the watermark signal is inherently weaker in low-entropy regions (where the model is highly confident and the top token dominates regardless of the PRF).

Mechanism: TextSeal weights each token's detection score by its local entropy, estimated via a lightweight proxy model. High-entropy positions, where the watermark has more influence, contribute more to the final statistic.
Statistical Calibration: The weighted sum of scores follows a hypoexponential distribution. To compute calibrated p-values efficiently, TextSeal uses a moment-matched Gamma approximation, which handles the heterogeneity of weights and the dual-key routing variance.

3. Localized Multi-Region Detection

Global detectors fail when watermarked text is a small fraction of a long document (dilution) or scattered across non-contiguous segments (fragmentation).

Mechanism: TextSeal employs a geometric cover search to identify watermarked segments. Instead of testing all possible intervals ( $O(n^2)$ ), it searches a dyadic grid of window lengths ( $L, 2L, 4L, \dots$ ).
Extraction: A greedy algorithm extracts disjoint intervals with the lowest p-values, aggregating them while applying rigorous Bonferroni corrections to control the family-wise error rate.
Adaptive Ensemble: The system adaptively selects the most significant result among three strategies: a global full-text test, a single-best window, or a multi-region aggregation. This ensures robustness whether the text is purely watermarked or heavily mixed.

Key Contributions

State-of-the-Art Trade-off: TextSeal strictly dominates the diversity-detectability Pareto frontier, outperforming SynthID-text and standard Gumbel-max. It achieves high detectability while restoring diversity comparable to non-watermarked generation.
Robustness to Dilution: Through localized detection, TextSeal maintains confident detection even when watermarked content is diluted by a factor of 10x or fragmented into multiple small regions within long documents, where global baselines fail.
Zero Inference Overhead: The scheme adds negligible sampling overhead ( $\le 0.3\%$ ) and is fully compatible with speculative decoding and Multi-Token Prediction (MTP) without requiring model parameter changes or KV-cache modifications.
Radioactivity via Distillation: TextSeal demonstrates that its watermark signal is "radioactive." When a student model is distilled from watermarked teacher outputs, the student inherits a detectable token bias, enabling the detection of unauthorized distillation even without access to the original generation context.
Preservation of Capabilities: Extensive evaluations across 12 benchmarks (math, code, reasoning, knowledge) and multilingual human evaluations confirm that TextSeal preserves downstream model performance and introduces no perceptible quality degradation.

Experimental Results

Detectability vs. Diversity: In evaluations on the ELI5 dataset, TextSeal (with $\alpha=0.1$ ) achieves significantly lower p-values (higher detectability) than SynthID and Gumbel-max at equivalent Self-BLEU diversity scores.
Dilution Resistance: TextSeal's adaptive ensemble maintains strong detection ( $-\log_{10} p > 4$ ) even when 400 tokens of watermarked text are embedded in 12,000 tokens of unwatermarked text (3.3% watermarked fraction). Global baselines drop below significance thresholds at much lower dilution levels.
Performance Preservation: On benchmarks including AIME, MATH, GSM8K, and HumanEval, TextSeal shows no statistically significant performance drop compared to vanilla generation. Minor fluctuations observed in code benchmarks were attributed to formatting noise rather than reasoning degradation.
Human Perception: A multilingual human evaluation (6,000 A/B comparisons across 5 languages) found no perceptible quality difference. Equivalence testing (TOST) confirmed that the preference difference between watermarked and non-watermarked outputs is bounded within $\pm 5\%$ .
Distillation Transfer: In distillation experiments (DeepSeek-R1 to Qwen2.5-3B), watermarked traces successfully transferred the signal to the student model. TextSeal achieved the strongest detection signal in the original setup due to higher data retention, while Gumbel-max showed stronger per-token signal under controlled data volume.

Significance and Claims

The paper positions TextSeal as a practical, production-ready solution for LLM watermarking. Its primary significance lies in resolving the long-standing tension between diversity and detectability without sacrificing distortion-freeness.

The authors claim that TextSeal provides a "radioactive" safeguard against unauthorized model distillation, a critical concern as open-weight models are increasingly trained on synthetic data. By enabling the detection of watermarked traces in student models, TextSeal offers a mechanism to monitor model usage and protect intellectual property.

The paper remains modest regarding limitations: it acknowledges that while the watermark is distortion-free for single generations, the reduction in diversity (via the dual-key mechanism) may impact workflows relying on diverse outputs (e.g., best-of-N reranking). However, it notes that modern reasoning models often exhibit collapsed entropy naturally, potentially mitigating this marginal loss. The work establishes a new baseline for watermarking that is theoretically sound, empirically robust, and compatible with modern inference infrastructure.