Research map / Large language models / Language, safety and interpretability

TextSeal: A Localized LLM Watermark for Provenance & Distillation Protection

NeurIPS 2026 · Large language models › Language, safety and interpretability · approach: Text watermarking · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes TextSeal, a distortion-free Gumbel-max LLM watermark with dual-key routing for diversity, entropy-weighted Gamma-calibrated detection, and multi-region localization, evaluated on Qwen3.5-27B against Gumbel-Max and SynthID-Text.

Problem

Gumbel-max watermarks are deterministic (same prompt and key yield the same output), causing loss of diversity and repetitive loops, and detection is weak on mixed-entropy text and diluted or fragmented documents.

Approach

Randomly route each generation step between two secret keys (dual-key Gumbel-max) to restore diversity, weight per-token detection scores by local entropy with a moment-matched Gamma p-value, and search geometric windows to localize watermarked regions.

Key results

• Under the default setup, TextSeal strictly dominates SynthID-Text on the diversity-detectability frontier, and the adaptive ensemble keeps -log10 p above 4 at 12k tokens (3.3% watermarked) where global detection fails.
• Benchmark accuracy across 12 benchmarks with TextSeal is within run-to-run variance of unwatermarked generation (overall average 70.6 vs 70.6 at T=0.6).
• Human A/B study on 6,000 pairs yields an overall preference rate of 50.9% for watermarked outputs, with TOST equivalence established overall (90% CI [-0.6%, +1.4%]).

Surprising findings

• Gumbel-Max dominates TextSeal in per-token detection under equal-token controls in the distillation experiment, while TextSeal wins only when it retains more traces.
• Entropy-weighted detection with a 4-bit 0.8B proxy recovers most of the 27B proxy's gain at a fraction of the memory cost.

Limitations

• Distortion-free sampling watermarks trade diversity for detectability, which may hurt best-of-N reranking and creative workflows.
• Code benchmarks show a 1-2 point drop on HumanEval and MBPP attributed to formatting omissions, and the human study is underpowered for per-language significance.
• The SynthID baseline is a re-implementation with a frequentist Z-test, since the authors could not reproduce the Bayesian detector.

Experimental setup

Datasets: ELI5 Wikipedia CaLMQA OpenR1-Math-220k GSM8K AIME MATH HumanEval MBPP MMLU GPQA SimpleQA

Benchmarks: AIME MATH GSM8K HumanEval MBPP MMLU GPQA SimpleQA HellaSwag WinoGrande ARC-Easy ARC-Challenge

Metrics: accuracy -log10 p-value Self-BLEU TPR at FPR mIoU net win rate perplexity draft acceptance rate empirical FPR

Baselines: Gumbel-Max SynthID-Text green-red list DiPMark MorphMark

Builds on: Gumbel-max watermark SynthID-Text radioactive watermarks speculative decoding repeated context masking

Closest papers by meaning

• PRO: Enabling Precise and Robust Text Watermark for Open-Source LLMs (NeurIPS 2026 · similarity 0.90)
• SAEMark: Steering Personalized Multilingual LLM Watermarks with Sparse Autoencoders (NeurIPS 2025 · similarity 0.89)
• StealthInk: A Multi-bit and Stealthy Watermark for Large Language Models (ICML 2025 · similarity 0.88)
• Black-Box Detection of Language Model Watermarks (ICLR 2025 · similarity 0.88)
• Provable Robust Watermarking for AI-Generated Text (ICLR 2024 · similarity 0.88)
• On the Reliability of Watermarks for Large Language Models (ICLR 2024 · similarity 0.88)