TextSeal and the Economics of Watermarks That Survive Distillation

When a watermarking scheme works, the interesting questions are rarely about whether it can mark a single document. They are about what happens when that marked text travels: through paraphrasing, through translation, through the training pipeline of a competitor who scrapes your outputs and distills them into their own model. The recent paper TextSeal: A Localized LLM Watermark for Provenance and Distillation Protection from FAIR at Meta tackles precisely this set of downstream concerns, and it does so while pushing the detectability frontier past current production systems like SynthID. In this article I want to work through what TextSeal actually does, why its design choices matter, and where I think the real fault lines lie.

The Gumbel-Max Problem and Why Diversity Matters

To understand TextSeal you first need to understand the tradeoff it is navigating. The watermarking literature splits into two families: distortionary schemes that bias the token distribution (the green-red list approach of Kirchenbauer et al.), and distortion-free schemes that provably preserve the model's next-token distribution after marginalizing over the secret key. Distortion-free is the desirable property for production because it means the watermark costs nothing in quality. The decoding configuration the model was tuned for, temperature and top-p included, stays intact.

A recent large-scale comparison (Fernandez et al., 2025) found that the Gumbel-max watermark (Aaronson and Kirchner, 2023) achieves the best detectability-quality Pareto frontier among distortion-free methods. So Gumbel-max is the natural foundation. But it has a structural flaw: it is fully deterministic. A fixed prompt and secret key always produce the same output. This is not a minor inconvenience. It eliminates output diversity entirely, and worse, it can trigger degenerate generation loops when repeated n-grams used for hashing cause the pseudo-random function to lock onto the same token. Anyone who has watched a greedy decoder spiral into repetition will recognize the failure mode.

SynthID, deployed in Google's Gemini, solved this through tournament sampling. TextSeal solves it differently, and I think more elegantly, with three coordinated ideas.

The Three Mechanisms

Dual-key generation. Instead of a single secret key, TextSeal randomly alternates between two secret keys during generation. This restores diversity because the same prompt no longer maps deterministically to one output; the key alternation injects controlled randomness while keeping the scheme distortion-free. The clever consequence is that this design natively supports speculative decoding and Multi-Token Prediction without additional latency. The paper reports at most 0.3% sampling overhead, which they claim is roughly 3x faster than SynthID. For anyone running inference at scale, near-zero overhead is the difference between a watermark you can deploy and one you cannot.

Entropy-weighted detection. Once you have two keys, the detection test needs to account for that. TextSeal introduces statistical tests tailored to the dual-key structure, optionally leveraging the entropy of a proxy model and using moment-matched Gamma approximations to produce calibrated p-values. The entropy weighting is the part worth dwelling on: low-entropy regions of text (boilerplate, deterministic continuations) carry little watermark signal because the model had no real choice there, while high-entropy regions carry more. Weighting the score by entropy concentrates statistical power where it actually exists.

Localized detection. This is the mechanism I find most consequential. Rather than computing a single global statistic over a document, TextSeal performs a multi-region geometric cover search to identify individual watermarked segments. The payoff appears in Figure 1b of the paper: localized detection remains confident at 10x dilution, where global baselines fall apart. If a watermarked passage is embedded in a long human-written document, a global test averages the signal into noise. A localized test goes hunting for the specific region that carries the mark.

The empirical results back the design. On Qwen3.5-27B, TextSeal strictly dominates SynthID across the diversity-detectability frontier (ELI5, 400 tokens, T=0.8, top-p=0.9). Across 12 reasoning and knowledge benchmarks, including AIME, MATH, GSM8K, HumanEval, ARC, GPQA, and MMLU, the average accuracy is identical to the unwatermarked baseline at 70.6. A multilingual human evaluation with 6,000 A/B comparisons across five languages showed no perceptible quality difference. The distortion-free claim is theoretical, and the evaluation is consistent with it.

Radioactivity: The Property That Cuts Both Ways

The part of the paper that deserves the most attention is radioactivity, the term from Sander et al. (2024) for a watermark signal that transfers through model distillation. The claim is that if a student model is trained on watermarked outputs, it inherits a detectable trace. TextSeal demonstrates this experimentally and extends prior work to reasoning-trace distillation specifically.

This is where the economics get interesting, and where I want to push beyond what the paper states. Radioactivity reframes watermarking from a content-provenance tool into a data-protection and IP-monitoring tool. If a competitor scrapes your model's outputs and distills them into their own system, the watermark survives the distillation and lets you detect the unauthorized use. That is a meaningful deterrent.

But the property is symmetric in a way that should give everyone pause. The same mechanism that lets a model owner detect theft means that anyone who scrapes marked text inherits a trace they cannot easily strip. This is fine if you trust the entity holding the secret key. It is less fine when you consider that watermarking infrastructure becomes a form of persistent, hard-to-remove tracking embedded in generated language itself. The provenance benefit and the surveillance risk are the same technical fact viewed from two sides.

My Take: Robustness Benchmarks Lag the Attacks

Here is the question I keep returning to, and it is not one the paper fully answers: what happens under heavy paraphrase or cross-lingual translation?

Localized detection holding at 10x dilution is genuinely impressive, but dilution is a passive threat. The text is mixed with human writing, but the watermarked tokens themselves are untouched. The harder adversarial setting is active: an attacker who paraphrases the output, runs it through a translation round-trip, or, most concerning, optimizes specifically against the entropy-weighted scoring that TextSeal uses to flag regions. Because the localization mechanism concentrates on high-entropy segments, an adversary who knows this can preferentially rewrite exactly those segments while leaving low-entropy filler intact. The defense's strength becomes a roadmap for the attack.

There is a deeper asymmetry in the field here. Watermarking papers are evaluated against a fixed set of perturbations chosen by the defenders. Real adversaries get to choose their attacks after seeing the defense, and they get to iterate. Robustness benchmarks structurally lag the attacks because the benchmark is frozen and the adversary is not. I would want to see TextSeal evaluated against a watermark-aware paraphraser trained with knowledge of the entropy-weighted score, not just generic paraphrase models. Cross-lingual transfer is even less explored; the multilingual human eval addresses quality, not detection survival across translation.

The distillation radioactivity result invites a parallel concern. The paper shows the signal transfers, but the natural countermeasure is for a distiller to mix watermarked and clean data, or to apply aggressive paraphrasing to the training corpus before distillation. How much dilution and rewriting does it take to drive the radioactive signal below the detection threshold? That is the number that determines whether this is a real safeguard or a deterrent that sophisticated actors will route around.

Conclusion

TextSeal is a careful, well-engineered advance. The dual-key construction solves Gumbel-max determinism without sacrificing the distortion-free property, the entropy-weighted localized detection genuinely extends the operating envelope under dilution, and the near-zero inference overhead makes it deployable. The radioactivity result moves watermarking from a provenance curiosity toward a practical IP-monitoring tool.

The open questions are adversarial. A watermark's value is set not by its performance against the perturbations its authors chose, but by its performance against the attacks its authors did not anticipate. The localization that makes TextSeal strong against passive dilution may make it legible to an active adversary optimizing against the exact scoring function. Until we see watermark-aware paraphrase and cross-lingual robustness benchmarks, with attackers who get the last move, the honest answer about how durable this signal really is remains: we do not yet know.