arXiv cs.AI· Tom Sander, Pierre Fernandez, Itai Gat, Haiming Bao, Jiaxin Shi, Jason Park, Valeriu Lacatusu, Sylvestre-Alvise Rebuffi, Hongyan Chang, Hady Elsahar, Tom\'{a}\v{s} Sou\v{c}ek, Tuan Tran, Surya Parimi, Alexandre Mourachko·· 14 小时前AI 评分34
TextSeal2：面向大语言模型的无失真水印，支持 Copula 混合与无记忆竞争
TextSeal2: Distortion-Free LLM Watermarking with Copula Mixing and Memoryless Races
AI 导读
TextSeal2 是一种面向大语言模型的无失真水印，在投机解码下被拒绝草稿所替换的 token 仍用同一密钥打水印，接受率不变，且不增加可测量的推理延迟。它用 AutoMark 的高斯 copula 将两个及以上密钥合并为单一虚拟密钥，任意数量密钥（含公开共享密钥）合并都不稀释检测。
正文 · 原文
Authors:Tom Sander, Pierre Fernandez, Itai Gat, Haiming Bao, Jiaxin Shi, Jason Park, Valeriu Lacatusu, Sylvestre-Alvise Rebuffi, Hongyan Chang, Hady Elsahar, Tomáš Souček, Tuan Tran, Surya Parimi, Alexandre Mourachko
Abstract:We present TextSeal2, a distortion-free watermark for large language models that keeps its signal under speculative decoding: tokens that replace rejected drafts remain watermarked with the same keys, and the acceptance rate is unchanged. It also preserves output diversity and adds no measurable inference latency. Its predecessor, TextSeal, restores diversity in the Gumbel-max scheme by routing each token to one of two keys via a coin flip. This is suboptimal because the detector averages the scores from both keys without knowing which key was used. TextSeal2 instead merges two or more keys into a single virtual key and couples it to fresh noise through AutoMark's Gaussian copula. Any number of keys, including publicly shared keys, can be merged this way without diluting detection. Under speculative decoding, TextSeal2 verifies keyed drafts with one more exponential race, run on the leftovers of the draft races. By memorylessness, this race reproduces block verification, so the output follows the target model exactly. We evaluate TextSeal2 on three LLMs. At equal output token diversity, TextSeal2 detects 8 to 22 percentage points more 100-token answers than TextSeal at a false-positive rate of $10^{-3}$, and is comparable to textGrain while requiring no post-logits optimization. Under speculative decoding, it detects 18 and 22 percentage points more 200-token answers than TextSeal and textGrain, respectively, at the same acceptance rate.
| Comments: | Code: this https URL |
| Subjects: | Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI); Computation and Language (cs.CL) |
| Cite as: | arXiv:2610.40613 [cs.CR] |
| (or arXiv:2610.40613v1 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2610.40613 arXiv-issued DOI via DataCite |
Submission history
From: Pierre Fernandez [view email]
[v1]
Thu, 29 Oct 2026 17:54:12 UTC (703 KB)
来源：arXiv cs.AI · arxiv.org