ArXiv

TextSeal: A Localized LLM Watermark for Provenance & Distillation Protection

2026-05-12 · 17:44 UTC ·Tom Sander, Hongyan Chang, Tomáš Souček... ·1 min read

Authors: Tom Sander, Hongyan Chang, Tomáš Souček...
Categories: cs.CR, cs.CL, cs.LG
arXiv: https://arxiv.org/abs/2605.12456v1
PDF: https://arxiv.org/pdf/2605.12456v1

Brief

TextSeal presents a practical, localized watermark for LLM outputs that combines Gumbel-max sampling, dual-key generation, entropy-weighted scoring, and multi-region localization to preserve diversity while enabling strong provenance detection. The method adds no inference cost, supports serving optimizations like speculative decoding, strictly dominates prior baselines (e.g., SynthID-text), is robust to dilution, transfers through distillation, and a 6,000 A/B multilingual study (5 languages) reported no perceptible quality change. Full paper text was not available in the provided content.

Why it matters

TextSeal is a localized LLM watermark (arXiv 2026-05-12) that uses Gumbel-max sampling with a dual-key generation scheme, entropy-weighted scoring, and multi-region localization to restore output diversity and improve detection; it supports speculative decoding and multi-token prediction with no added inference overhead.

Key details

TextSeal strictly outperforms baselines such as SynthID-text in detection strength, is robust to dilution (maintaining confident localized detection in heavily mixed human/AI documents), is provably distortion-free, and its watermark transfers through model distillation; a multilingual human evaluation (6,000 A/B comparisons across 5 languages) found no perceptible quality difference.

Source evidence

Abstract

We introduce TextSeal, a state-of-the-art watermark for large language models. Building on Gumbel-max sampling, TextSeal introduces dual-key generation to restore output diversity, along with entropy-weighted scoring and multi-region localization for improved detection. It supports serving optimizations such as speculative decoding and multi-token prediction, and does not add any inference overhead. TextSeal strictly dominates baselines like SynthID-text in detection strength and is robust to dilution, maintaining confident localized detection even in heavily mixed human/AI documents. The scheme is theoretically distortion-free, and evaluation across reasoning benchmarks confirms that it preserves downstream performance; while a multilingual human evaluation (6000 A/B comparisons, 5 languages) shows no perceptible quality difference. Beyond its use for provenance detection, TextSeal is also ``radioactive'': its watermark signal transfers through model distillation, enabling detection of unauthorized use.