TextSeal: A Localized LLM Watermark for Provenance & Distillation Protection

Abstract: We introduce TextSeal, a state-of-the-art watermark for LLMs. Building on Gumbel-max sampling, TextSeal introduces dual-key generation to restore output diversity, along with entropy-weighted scoring and multi-region localization for improved detection. It supports serving optimizations such as speculative decoding and multi-token prediction, and does not add any inference overhead. TextSeal strictly dominates baselines like SynthID-text in detection strength and is robust to dilution, maintaining confident localized detection even in heavily mixed human/AI documents. The scheme is theoretically distortion-free, and evaluation across reasoning benchmarks confirms that it preserves downstream performance; while a multilingual human evaluation (6000 A/B comparisons, 5 languages) shows no perceptible quality difference. Beyond its use for provenance detection, TextSeal is also ``radioactive'': its watermark signal transfers through model distillation, enabling detection of unauthorized use.

• The paper introduces TextSeal, a dual-key LLM watermarking technique that overcomes deterministic limitations and preserves output diversity while ensuring robust provenance.
• It employs entropy-weighted detection, dynamically adjusting per-token signals to boost detection power and calibration, achieving orders-of-magnitude improvements.
• Local multi-region localization efficiently extracts watermarked segments from mixed content, proving resilient against dilution, fragmentation, and distillation transfer.

TextSeal: Distortion-Free, Localized Watermarking for LLM Provenance and Distillation Protection

Technical Motivation and Background

TextSeal addresses critical requirements for LLM watermarking: robust provenance, regulatory compliance, and protection against unauthorized model distillation. Early watermarking schemes, especially edit-based approaches, exhibited low robustness and failed to scale for large, multilingual, or open-weight LLMs. The field matured with the introduction of sampling-based, distortion-free watermarks leveraging pseudorandom functions (PRFs): Green-Red List, Gumbel-Max, SynthID-Text, DiPMark, and WaterMax (2605.12456). Gumbel-Max watermarking achieves maximal detectability-quality trade-offs but suffers from degeneracy via deterministic outputs and lacks diversity. SynthID-Text, deployed in commercial settings, ameliorates determinism with tournament sampling but is computationally inefficient and fails to address fragmentation and dilution in mixed-provenance documents.

Algorithmic Advances of TextSeal

TextSeal innovates along three orthogonal axes:

• Dual-Key Routing: Randomized alternation between two keys restores output diversity, breaking deterministic loops of the original Gumbel-Max scheme. This dual-key mechanism natively enables speculative decoding and multi-token prediction (MTP), doubling tolerance to repeated context windows before distortion arises. The mixing parameter $\alpha$ controls the diversity-detectability trade-off, strictly dominating alternatives in diversity-quantified evaluations.
• Entropy-Weighted Detection: Standard Gumbel-Max detection is suboptimal in low-entropy regimes where watermark signal is naturally attenuated. TextSeal introduces dynamic per-token weighting via entropy estimates from proxy models (e.g., lightweight Qwen variants), computed in a single forward pass. This weighting results in hypoexponential statistics and increases the detection power orders of magnitude, especially under adversarial or real-world entropy distributions. Calibration of $p$-values is realized through a moment-matched Gamma approximation, ensuring empirical false positive rates never exceed nominal thresholds.
• Local Multi-Region Localization: Mixed-provenance documents challenge global detection due to dilution and fragmentation. TextSeal utilizes dyadic geometric cover search and applies bonferroni-corrected greedy extraction across candidate intervals, efficiently isolating watermarked regions. An adaptive ensemble merges global, single-best, and multi-window tests—guaranteeing strict calibration of family-wise error rates and enabling high-resolution annotation via density smoothing.

Figure 1: Depiction of the diversity-detectability trade-off, showing TextSeal’s consistent domination of SynthID across the Pareto frontier.

Experimental Results

Detectability-Diversity Frontier

TextSeal strictly dominates SynthID-Text and Gumbel-Max on the detectability-diversity frontier across all practical settings. By varying $\alpha$ in TextSeal and depth in SynthID, TextSeal is shown to preserve generation diversity without compromising signal strength. Entropy-aware detection further boosts median $-\log_{10}(p)$ by 1–2 orders of magnitude at minimal computational cost.

Figure 2: Pareto frontier of diversity strategies, highlighting TextSeal’s superior trade-off that pushes both diversity and detectability limits compared to baselines.

Performance Preservation

Evaluation across 12 complex benchmarks (math, code, knowledge, common sense) confirms strict distortion-freeness: performance metrics remain unchanged between watermarked and vanilla generations, with differences well within stochastic generation variance. Minor drops in code benchmarks are attributable to formatting errors rather than reasoning failures.

Imperceptibility

A multilingual human preference study (6,000 paired samples, 5 languages) demonstrates equivalence between watermarked and non-watermarked outputs: net win rates are statistically insignificant and equivalence is confirmed via Two One-Sided Tests procedure. Annotator agreement remains high despite the study’s language diversity.

Dilution and Fragmentation Robustness

TextSeal’s local detection approach rescues detectability under extreme dilution and fragmentation scenarios, preserving strong statistical significance even when watermarked content constitutes <5% of document length or is split across multiple fragments. Global detection is shown to rapidly degrade beyond the 0.01 significance threshold as dilution increases, while adaptive ensemble maintains high $-\log_{10}p$ far into the tail of document length.

Figure 3: Localized detection for mixed documents, illustrating TextSeal’s resilience under dilution and fragmentation where global detectors fail.

Computational Efficiency

TextSeal introduces negligible sampling overhead ($\leq 0.3\%$) during generation; detection with entropy-aware proxies requires minimal VRAM and time, outperforming SynthID’s tournament sampling by $3\times$ in speed and scaling efficiently to large deployments. Compatibility with speculative decoding and multi-token prediction is demonstrated empirically, with draft acceptance rates and perplexity identical across all watermark conditions.

Figure 4: Entropy-aware detection performance and computational costs, showing the favorable trade-off achieved by the 0.8B proxy model.

Figure 5: MTP speculative decoding with TextSeal watermarking, validating zero overhead and maintained detectability across model variants.

Radioactive Transfer through Distillation

TextSeal’s watermark signal is "radioactive": its statistical trace transfers through model distillation, enabling detection of unauthorized use or leakage. Students fine-tuned on watermarked reasoning traces inherit detectable token biases, revealed by teacher-forcing radioactivity tests. Among Gumbel-Max, TextSeal, and SynthID, TextSeal achieves the highest transferred detection signal and benchmark accuracy under practical settings. Ablations over entropy weighting functions establish concave normalized weighting as optimal, improving learnability detection by over 25 orders of magnitude.

Figure 6: Watermark radioactivity through distillation, quantifying detection power versus number of unique tokens for each watermark method.

Figure 7: Entropy-aware scoring for watermark learnability detection, demonstrating the dramatic effect of $\sqrt{\hat{H}}$ weighting on transferred detection power.

Theoretical and Practical Implications

TextSeal delivers rigorous guarantees: strict distortion-freeness, calibration of empirical FPR, localized detection robust to dilution/fragmentation, imperceptibility across languages, and radioactive transfer. These advances render TextSeal suitable for legal, regulatory, and commercial provenance contexts in modern LLM deployments. Practically, it enables watermarking without performance degradation, supports speculative optimizations, and can be applied at scale with minimal infrastructure changes.

Theoretically, TextSeal extends statistical testing frameworks for watermark detection, combining dual-key routing, entropy-weighted hypothesis testing, and geometric localization. The proof structure across diversity schemes, detection bounds, and combinatorial penalties provides a foundation for future work on multi-bit watermarks, semantic marking, and learnability measurement in open models.

Future Directions

Further development may include: expanding TextSeal to semantic or multi-bit watermarking, integrating local provenance tagging in live document pipelines, quantifying diversity trade-offs in RL-trained reasoning models, and optimizing proxy architecture for ultralight detection. The radioactive property posits TextSeal as a key tool for training data copyright enforcement, tracking output contamination through retrieval-augmented systems, and benchmarking in contaminated environments.

Conclusion

TextSeal introduces principled dual-key routing, entropy-aware detection, and localized region-based extraction, achieving superior detectability and diversity preservation. It strictly dominates previous baselines, guarantees imperceptibility and performance, and enables radioactive tracing through distillation. These qualities render TextSeal a comprehensive solution for LLM output provenance and downstream data protection, advancing the methodological state of LLM watermarking (2605.12456).