A watermark stops flipping coins between keys: merging two keys detects 18 to 22 points more under speculative decoding
Synopsis
LLM watermarks must keep output diversity under a fixed key and must not lower draft acceptance under speculative decoding, and the two have been hard to hold together. TextSeal2 merges two keys' Gaussian values into one virtual key and couples it to fresh noise through a Gaussian copula, so the detector reads full signal on every token; under speculative decoding it decides each round's last token with one more exponential race on the leftovers of the draft races. At equal diversity on three models it detects 8 to 22 percentage points more 100-token answers than TextSeal, and under speculative decoding 18 and 22 points more 200-token answers than TextSeal and textGrain, at unchanged acceptance.
Interpretation
An LLM watermark can now keep speculative decoding's draft acceptance unchanged while the positions that replace rejected drafts still carry the same key's watermark signal. Earlier options either drew the replacement token under an independent key, so that part of the text carried only the second key's signal, or verified between watermarked distributions, which accepts fewer drafts. TextSeal routes each token to one of two keys by a coin flip, and the detector, not knowing which key was used, averages both keys' scores, which lowers the signal-to-noise ratio. textGrain solves an entropy-regularised optimal transport at every decoding step and detects more, but its own speculative recipe emits about 5% fewer tokens per round. On Qwen3.5-9B with 8 drafts and block verification, unwatermarked decoding emits 2.74 tokens per round; TextSeal2's residual race differs from that by a paired amount indistinguishable from zero, as Proposition 1 predicts, and the baselines by at most a similarly small amount. At TextSeal's Self-BLEU, TextSeal2 detects 59%/89% of 100/200-token answers, against 31%/71% for TextSeal and 31%/67% for textGrain.
The sampler maps each key's uniform values into Gaussian space, adds them into a single virtual key, and couples that key to fresh noise at every position through AutoMark's Gaussian copula. The detector scores the virtual key directly, so every token contributes signal rather than half of them. This is exactly AutoMark's single-key copula applied to the merged key, so the two-key scheme has the same diversity and detection power as the single-key copula at the same coupling strength, while one key can still be published for a weaker public test. Interpolated at TextSeal's Self-BLEU on Llama-3.1-8B, Qwen3.5-9B and Qwen3.5-27B, TextSeal2 detects 10, 22 and 8 percentage points more 100-token answers than the coin flip; it stays within 3 points of AutoMark's copula, which coincides with it in distribution. Merging four keys detects as much as merging two.
Under speculative decoding, each round's last token is no longer drawn under a separate key; one more exponential race on the leftovers of all draft races picks the stopping position and that position's token together. Memorylessness of the exponential race guarantees that, given the drafts, the losing lanes' leftovers are again independent exponentials, so this relay race reproduces block verification's outcome, keeps the output exactly distortion-free and keeps block verification's acceptance rate. On Qwen3.5-9B the last token of each round is 36% to 37% of the text; under the draft key those tokens average 1.34, against 1.42 for kept drafts, whereas AutoMark's last tokens drawn under an independent key average 0.84, below the null mean of 1. On AIME math problems TextSeal2 detects 41% at 2048 tokens, against 38% for textGrain's own recipe and 7% to 22% for the other baselines, with accuracy unchanged.
Perspective
Evaluation covers three domains (open-ended ELI5 answers, MBPP code problems, and AIME math problems under speculative decoding) and three open-weight models at temperatures between 0.7 and 1; the speculative-decoding experiments use Qwen3.5-0.8B drafting for Qwen3.5-9B, with block verification throughout.
With block verification and 8 drafts, speculative decoding costs 2 to 4 percentage points of detection relative to standard decoding, and the speculative implementation is unbatched, so no wall-clock speedups are measured. Attacks exploiting knowledge of the public key are not analysed, and textGrain's code is not public, so the comparison uses a reimplementation whose deployed parameters may differ.