Imagine you're running a casino, and every card dealt must carry an invisible ink stamp proving it came from your house. The problem: you've just switched to a faster dealing system where a junior dealer pre-deals cards and the pit boss only checks them, replacing the bad ones. Your old invisible ink only works when the pit boss deals directly — every replaced card comes out unmarked. TextSeal2 solves this by stamping the replacement cards with the same ink, using a mathematical property of the replacement process itself. The committed claim: TextSeal2 is the first distortion-free LLM watermark that maintains full detection power under speculative decoding, with no measurable inference latency and no loss of output diversity. This matters because speculative decoding is now standard infrastructure at every major LLM provider — if your watermark breaks under it, your watermark is decorative. The mechanism is built on two ideas. First, copula mixing: instead of TextSeal's coin-flip routing between two keys (where the detector wastes half its signal guessing which key was used), TextSeal2 merges multiple keys into a single virtual key via a Gaussian copula. This means any number of keys — including publicly shared ones — can be combined without diluting the watermark signal. Second, memoryless races: under speculative decoding, when a draft token is rejected, the replacement token is drawn from the "leftover" distribution. TextSeal2 runs one additional exponential race on these leftovers, and by the memoryless property of exponential distributions, this race is statistically identical to drawing from the target model directly. The output distribution is unchanged — distortion-free by construction, not by approximation. The ladder numbers are concrete. Against TextSeal on 100-token answers at a false-positive rate of 10⁻³, TextSeal2 detects 8 to 22 percentage points more watermarked text at equal output diversity. Against textGrain (which requires post-logits optimization), it matches detection without that overhead. Under speculative decoding specifically — the scenario that breaks other methods — it detects 18 pp more than TextSeal and 22 pp more than textGrain on 200-token answers, at the same acceptance rate. Three LLMs were evaluated, though the abstract doesn't name them. The integrity picture is reasonable for a Meta Research paper: code is released on GitHub at submission, the comparison is against the paper's direct predecessors (TextSeal, textGrain) and the foundational Gumbel-max scheme — these are the relevant baselines, not stale ones. The evaluation metrics (detection rate at fixed FPR, acceptance rate preservation, diversity measurement) are standard and appropriate. The gap is that there's no independent replication yet, no pre-registration, and the three test LLMs aren't named in the abstract. The field fight here is real: can you watermark LLM output without degrading it? The Gumbel-max family (Aaronson-Kirchner lineage) achieves distortion-free watermarking in theory, but speculative decoding broke the link between watermark insertion and actual token generation. TextSeal tried to patch this with key routing; TextSeal2 argues that the right fix is copula-based key merging plus exploiting the memoryless property of the race mechanism itself. This is a clean architectural argument, not incremental tuning. The milestone to watch is deployment-scale validation: does this watermark survive real-world attacks (paraphrasing, translation, truncation) at production token volumes across the full model zoo? The 100-200 token evaluation window is short; real deployment needs robustness on 1000+ token outputs under adversarial conditions. The obvious next experiment the authors didn't run — robustness to active watermark removal attacks and cross-lingual paraphrase — is likely being saved for a deployment paper or is already underway internally at Meta.
