{"paper":{"title":"TextSeal: A Localized LLM Watermark for Provenance & Distillation Protection","license":"http://creativecommons.org/licenses/by/4.0/","headline":"TextSeal adds a detectable watermark to LLM outputs that stays visible even after mixing with human text or distillation into new models.","cross_cats":["cs.CL","cs.LG"],"primary_cat":"cs.CR","authors_text":"Alexandre Mourachko, Christophe Ropers, Hady Elsahar, Hongyan Chang, Pierre Fernandez, Rashel Moritz, Surya Parimi, Sylvestre-Alvise Rebuffi, Tom\\'a\\v{s} Sou\\v{c}ek, Tom Sander, Tuan Tran, Valeriu Lacatusu, Vanessa Stark","submitted_at":"2026-05-12T17:44:41Z","abstract_excerpt":"We introduce TextSeal, a state-of-the-art watermark for large language models. Building on Gumbel-max sampling, TextSeal introduces dual-key generation to restore output diversity, along with entropy-weighted scoring and multi-region localization for improved detection. It supports serving optimizations such as speculative decoding and multi-token prediction, and does not add any inference overhead. TextSeal strictly dominates baselines like SynthID-text in detection strength and is robust to dilution, maintaining confident localized detection even in heavily mixed human/AI documents. The sche"},"claims":{"count":4,"items":[{"kind":"strongest_claim","text":"TextSeal strictly dominates baselines like SynthID-text in detection strength and is robust to dilution, maintaining confident localized detection even in heavily mixed human/AI documents. The scheme is theoretically distortion-free... Beyond its use for provenance detection, TextSeal is also 'radioactive': its watermark signal transfers through model distillation, enabling detection of unauthorized use.","source":"verdict.strongest_claim","status":"machine_extracted","claim_id":"C1","attestation":"unclaimed"},{"kind":"weakest_assumption","text":"That the watermark signal reliably transfers through model distillation with sufficient strength for detection, and that the theoretical distortion-free property and lack of quality impact hold under all practical serving conditions and adversarial mixing.","source":"verdict.weakest_assumption","status":"machine_extracted","claim_id":"C2","attestation":"unclaimed"},{"kind":"one_line_summary","text":"TextSeal provides a localized, distortion-free LLM watermark that enables provenance tracking and distillation detection while preserving performance and text quality.","source":"verdict.one_line_summary","status":"machine_extracted","claim_id":"C3","attestation":"unclaimed"},{"kind":"headline","text":"TextSeal adds a detectable watermark to LLM outputs that stays visible even after mixing with human text or distillation into new models.","source":"verdict.pith_extraction.headline","status":"machine_extracted","claim_id":"C4","attestation":"unclaimed"}],"snapshot_sha256":"31047e1bf7dbce6fda759c39cd25d5477b21fc4d8abcdead878fc5dcb085fad7"},"source":{"id":"2605.12456","kind":"arxiv","version":2},"verdict":{"id":"c7c692ae-1cb7-4065-99e7-24da8d6a73b3","model_set":{"reader":"grok-4.3"},"created_at":"2026-05-13T03:34:38.060163Z","strongest_claim":"TextSeal strictly dominates baselines like SynthID-text in detection strength and is robust to dilution, maintaining confident localized detection even in heavily mixed human/AI documents. The scheme is theoretically distortion-free... Beyond its use for provenance detection, TextSeal is also 'radioactive': its watermark signal transfers through model distillation, enabling detection of unauthorized use.","one_line_summary":"TextSeal provides a localized, distortion-free LLM watermark that enables provenance tracking and distillation detection while preserving performance and text quality.","pipeline_version":"pith-pipeline@v0.9.0","weakest_assumption":"That the watermark signal reliably transfers through model distillation with sufficient strength for detection, and that the theoretical distortion-free property and lack of quality impact hold under all practical serving conditions and adversarial mixing.","pith_extraction_headline":"TextSeal adds a detectable watermark to LLM outputs that stays visible even after mixing with human text or distillation into new models."},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2605.12456/integrity.json","findings":[],"available":true,"detectors_run":[{"name":"doi_title_agreement","ran_at":"2026-05-20T13:01:24.846075Z","status":"completed","version":"1.0.0","findings_count":0},{"name":"doi_compliance","ran_at":"2026-05-20T09:27:32.818983Z","status":"completed","version":"1.0.0","findings_count":0},{"name":"claim_evidence","ran_at":"2026-05-19T22:21:57.826561Z","status":"completed","version":"1.0.0","findings_count":0},{"name":"ai_meta_artifact","ran_at":"2026-05-19T10:35:00.565266Z","status":"completed","version":"1.0.0","findings_count":0}],"snapshot_sha256":"70df15265cfd71b29e09d8af67833cd4cf826a3d529567a555ca46c9ab96e640"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":2,"snapshot_sha256":"51b2310ce3a56864072327210d031495e90eafbb7b336e159ab841ff3b43ac3b"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"}