safety security
The Watermark Survives a Rejected Draft
TextSeal2 preserved the target distribution and speculative-decoding acceptance rate while improving detection in the reported tests.
Summary
TextSeal2 preserved the target distribution and speculative-decoding acceptance rate while improving detection in the reported tests.
Speculative decoding can replace a drafter's rejected tokens, creating a difficult case for language-model watermarks. TextSeal2 combines multiple keys into a virtual key and uses a memoryless verification race so replacement tokens remain keyed while the output follows the target model's distribution. Across three models, the paper reports 8 to 22 percentage points more detected 100-token answers than its predecessor at a false-positive rate of one in a thousand. Under speculative decoding, it detected 18 and 22 percentage points more 200-token answers than TextSeal and textGrain, respectively, without changing acceptance rate. Those results measure controlled detection, not resistance to every transformation or attacker.
Why it matters
TextSeal2 preserved the target distribution and speculative-decoding acceptance rate while improving detection in the reported tests.
Limits and context
- TextSeal2 combines multiple keys into a virtual key and uses a memoryless verification race so replacement tokens remain keyed while the output follows the target model's distribution.
- Those results measure controlled detection, not resistance to every transformation or attacker.
Key claims
TextSeal2 preserved the target distribution and speculative-decoding acceptance rate while improving detection in the reported tests.
Qualification: TextSeal2 combines multiple keys into a virtual key and uses a memoryless verification race so replacement tokens remain keyed while the output follows the target model's distribution.
Evidence: source-2026-11-01-009
Sources
- arXiv preprint 2610.40613, original v1arXiv · primary research
Corrections
No corrections have been recorded for this story.