{"id":"8274d215-ba37-4de3-8055-f6d2671f5bbd","arxiv_id":"2505.24115","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"FeatureSense exposes hand-picked audio features instead of raw audio and introduces the SILI metric, claiming 60.6% lower speaker attribute leakage while keeping sound classification accuracy.","lead":"This paper introduces FeatureSense, a library that replaces raw microphone audio with a small set of privacy-safe sound measurements for sensing tasks, plus the SILI metric to measure how much speaker information leaks. A generalist should care because it targets a blind spot: even after speech is masked, age, gender, and accent can still be inferred from audio.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The 'close to random guess' privacy claim is measured with the same data and classifier family used to select features, and the appendix's own pairwise-importance result shows interactions can leak much more than individual features; an interaction-aware or cross-corpus adversary could break the…","rationale":"The paper makes a plausible system contribution: a general-purpose, low-latency feature library for non-speech audio sensing, with an adaptive feature-selection procedure and reasonable utility results on ESC-50, AudioSet, and UrbanSound8k. The latency and Raspberry Pi measurements are encouraging, and the SILI/CSLI framing is a useful step toward evaluating speaker-attribute leakage. However, the headline privacy guarantee is exactly as strong as the leakage measurement, and that measurement has a real soft spot. The same corpus is used to select privacy-preserving features and to demonstrate that the selected features preserve privacy; the adversary is restricted to Random Forest classifiers; and the appendix's own result that feature pairs can have 6.6x higher permutation importance than individual features indicates that the screening step (§6.1) is not sufficient to rule out interaction-based inference. Section 9 explicitly concedes residual de-anonymization risk, which is consistent with the concern. My recommendation therefore does not change the reader's CONDITIONAL verdict: the system-level utility and cost claims are likely sound, but the privacy claim needs an independent adversarial evaluation and cross-dataset validation before it can be stated as a guarantee. I did not find evidence of internal inconsistency in the optimization or latency results, and I would not reject the paper; I would require the concrete test above as a condition for accepting the central privacy claim.","tokens_in":29902,"tokens_out":4080,"duration_ms":52358,"concrete_test":"Release the exact FeatureSense feature matrices and run one independent adversarial benchmark: (1) split CommonVoice by speaker so no speaker appears in both feature-selection and evaluation; (2) train XGBoost and 2-layer MLP classifiers, one with the raw feature set and one augmented with the top pairwise products from Appendix Figure 24, on gender/age/ethnicity labels; (3) train the same models on CommonVoice and evaluate on features extracted from an external labeled speech corpus (e.g., VoxCeleb2) to test cross-corpus generalization. Report mean accuracy and 95% bootstrap confidence intervals against the 33% chance baseline. If any adversary exceeds, say, 40% accuracy, or a classifier trained on CommonVoice transfers above chance to the external corpus, the headline privacy claim is not supported; if all remain at chance with overlapping CIs, the central concern is resolved.","verdict_should_be":"UNCHANGED","load_bearing_attack":"FeatureSense's central claim—that after removing Timbre and Chroma features the exposed features support only 'close to random guess' inference of gender (30%), age (40%), and ethnicity (31%)—rests on an evaluation (§8.3.1) whose adversary is a Random Forest trained on the same CommonVoice data that was used to select the feature set (§6.1). This does not upper-bound leakage. Feature selection used the target labels on CommonVoice to drop high-correlation features, so the subsequent low accuracies partly reflect selection on that corpus; a different speaker population with different acoustic distributions could reveal more. Moreover, the paper itself shows the screening procedure is incomplete: the appendix's pairwise permutation importance (Figure 24) identifies interactions such as Low Band Energy + Wavelet Features with 6.6x the importance of individual features, yet no final evaluation uses an interaction-aware adversary, and §9 acknowledges residual de-anonymization risk. Since FeatureSense transmits low-dimensional features to the server, an adversary is free to train any model, including MLP/XGBoost on pairwise products or models trained on external labeled speech, so near-chance Random Forest accuracy only demonstrates that a weak adversary fails. Without error bars, the 40% and 31% figures are also hard to interpret relative to chance on imbalanced three-class tasks. The utility, latency, and privacy-utility trade-off findings are still valuable; the unsupported part is the guarantee that speaker attributes are protected.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper addresses speaker-attribute leakage in always-on audio sensing. It proposes the SILI and CSLI metrics, a curated audio feature library (FeatureSense), and a task-specific linear-programming feature-selection algorithm that trades off privacy, utility, and computational cost. The authors evaluate leakage in existing privacy filters, show that speech suppression does not remove speaker attributes, and claim that after removing Chroma and Timbre features, gender/age/ethnicity classifiers achieve near-chance accuracy (30%, 40%, 31% on three-class tasks) while utility remains high on ESC-50 (81.2%), UrbanSounds8k (97.1%), and a cough-detection case study, with sub-15 ms latency.","tokens_in":30180,"tokens_out":6589,"duration_ms":73693,"significance":"The paper makes a useful contribution by separating speaker demographic leakage from speech-content leakage and by providing a concrete, open-source feature library with latency and utility measurements. If the privacy claim were established against a stronger adversary, the system would be a practical deployable privacy layer for non-speech audio sensing. However, the central privacy claim currently rests on a same-data, single-family classifier evaluation, so the significance is conditional on a more convincing privacy evaluation.","major_comments":[{"comment":"The 'close to random guess' claim is not an upper bound on leakage because the features were selected using the same CommonVoice labels and then evaluated with the same data. Section 6.1 removes features based on correlation, mutual information, and permutation importance computed on CommonVoice, and Section 8.3.1 measures Random Forest accuracy on the same corpus. The resulting 30%, 40%, and 31% accuracies therefore reflect selection on that corpus, not a bound for arbitrary corpora or adversaries. In addition, Section 9 acknowledges residual de-anonymization risk, which conflicts with the strong wording in the abstract and Section 1 that FeatureSense 'prevents' speaker leakage. Please evaluate on held-out speakers, on a second corpus with demographic labels, and with stronger adversaries (MLP, XGBoost, SVM), or revise the privacy claim to match the evidence.","section":"Sections 6.1 and 8.3.1"},{"comment":"The paper's own screening procedure shows that individual-feature analysis is insufficient: the pair Low Band Energy + Wavelet Features has 6.6x the permutation importance of individual features, and other feature pairs also leak more than single features. Yet the final privacy evaluation in Section 8.3.1 trains classifiers on individual features only and does not use an interaction-aware adversary. Because the server receives the full low-dimensional feature vector, an adversary can construct pairwise products or use tree ensembles with built-in interactions. Please include interaction-aware leakage measurements, or state explicitly that the guarantee excludes interaction attacks.","section":"Appendix, Figure 24"},{"comment":"The threat model grants the adversary pretrained models, external datasets, and auxiliary knowledge, but the evaluation uses only a Random Forest trained on the same corpus and features. This does not instantiate the stated adversary capability. Please implement at least one attack that matches the threat model, such as a pretrained demographic classifier applied to the exposed features or a model trained on an external labeled speech corpus and tested on CommonVoice features.","section":"Section 3.3 vs. Section 8.3.1"},{"comment":"The feature-selection optimization is described as a binary selection problem, but the 'Binary Selection Constraint' is stated as 0≤x_i≤1, and the implementation uses scipy.optimize.linprog, which solves a continuous linear program. The returned x_i therefore need not be 0 or 1, so the claimed 'optimal subset of features' is not well-defined unless rounding or an integer solver is used. Please clarify whether the implementation rounds, thresholds, or uses mixed-integer programming; if the variables are continuous, the objective and the latency constraint need to be reinterpreted.","section":"Section 6.3"}],"minor_comments":[{"comment":"The text says 'Figure 5 shows the APIs of FeatureSense library' but the API summary is in Table 5; please correct the cross-reference.","section":"Section 7"},{"comment":"The caption and text contain the typo 'Low Band Enegy'; it should be 'Low Band Energy'.","section":"Appendix and Figure 24"},{"comment":"The paper uses 'ethnicity' for CommonVoice labels that are actually regional accent or nationality labels (us, ireland, australia); please clarify the terminology consistently.","section":"Sections 4.3, 6.1, 8.3.1"},{"comment":"The mutual-information analysis with the first three formants is a useful screening tool, but the threshold of 0.22 is not justified; a sentence acknowledging that this is not a formal speech-leakage guarantee would help.","section":"Section 8.3.2"},{"comment":"The 'Leakage Reduction (%)' numbers are presented inconsistently as both percentage-point reductions and relative reductions; for example, at alpha=1.0 in Table 7 the text says leakage drops from 66.1% to 38.9%, which is a 27.2 percentage-point drop, while the table labels this as a 27.22% reduction. Please define whether reductions are relative or absolute.","section":"Tables 7 and 8"}],"recommendation":"major_revision","confidential_remarks":"The paper is a solid systems contribution with useful measurements, but the central privacy claim needs a substantially stronger evaluation before it can be accepted. The circularity between feature selection and leakage evaluation is the main risk; the interaction result in the appendix makes this concern concrete. The LP formulation issue in Section 6.3 is a separate technical flaw that should be fixed in revision. The paper fits the venue's scope and the authors should be encouraged to revise rather than resubmit elsewhere."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The paper is worth a serious referee. What it actually ships: a standardized leakage metric (SILI/CSLI), a systematic audit of four prior privacy techniques showing that speech leakage and speaker leakage come apart, and a deployable feature library with real latency measurements. The utility numbers (ESC-50 81.2%, UrbanSound 97.1%, cough detection retaining 92-99% utility) are credible, and the Raspberry Pi latency profile is a useful data point, not a sales pitch.\n\nThe central privacy claim is the soft spot. The feature-selection step (Section 6.1) uses gender/age/accent labels on CommonVoice to drop Timbre and Chroma; the leakage evaluation (Section 8.3.1) then trains Random Forests on the same data. That is evaluation on the selection corpus. It shows that a Random Forest trained on CommonVoice cannot do much with the remaining features, but it does not upper-bound what an adversary with a different population, a stronger model, or feature interactions can infer. The appendix (Figure 24) shows pairwise interactions with 6.6x the permutation importance of individual features, and Section 9 concedes residual de-anonymization risk. There are no error bars on the 30/40/31% figures, and random chance on the three-class tasks is 33%. The paper also uses ethnicity and accent labels interchangeably, which matters because CommonVoice's accent field is really a provenance label.\n\nThe \"60.6% improvement\" headline is an average of normalized accuracy reductions, not a guarantee; it should be read as a relative reduction under a specific adversary model.\n\nThe soft spots are proportionate. The system, the metrics, and the utility evaluation are solid; the privacy guarantee needs to be reframed. If the authors reposition the claim as \"measurable reduction in speaker-attribute inference under a specified weak adversary\" and add an independent evaluation on a different corpus with stronger adversaries (for example, an MLP or XGBoost on feature pairs), the core contribution survives intact.\n\nWho this is for: people building privacy-preserving audio sensing systems. The SILI/CSLI metrics and the comparative leakage audit are genuinely useful, and I would cite the paper for those. Recommendation: send to peer review with a conditional-accept path. The library and metrics are real; the privacy claim needs to be scaled back or re-verified against a stronger adversary on out-of-corpus data.","headline":"Useful leakage metric and a solid system paper; the headline privacy guarantee is not supported because the same data and classifier family are used to select and evaluate features.","tokens_in":30752,"tokens_out":1580,"would_cite":true,"duration_ms":20087,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Curated audio features can hide speaker age, gender, and ethnicity","keywords":["privacy-preserving audio sensing","speaker attribute leakage","audio feature selection","SILI metric","speaker demographics","environmental sound classification","cough detection","privacy-utility trade-off"],"falsifier":"Train a deep neural network, or a model that also uses pairwise feature interactions, on the pruned FeatureSense vectors from Common Voice to predict gender, age, or ethnicity: if held-out accuracy substantially exceeds the 33% random baseline, the privacy claim fails. A complementary check is to repeat the leakage evaluation on a conversational or noisy speech corpus and see whether attribute accuracy stays near chance.","tokens_in":29676,"feed_emoji":"🎙️","tokens_out":6414,"duration_ms":49465,"temperature":0.7,"pith_summary":"This paper argues that hiding speech content is not enough to protect privacy in always-on audio sensing: even after speech is filtered, removed, or subsampled, low-level acoustic cues still let classifiers infer a speaker's gender, age, and ethnicity. To close that gap, it introduces FeatureSense, a library of granular audio features that expose only task-relevant signal statistics, and a metric, SILI, that quantifies speaker-attribute leakage as normalized classifier accuracy. On the Common Voice dataset, removing the few features that correlate with speaker attributes (Chroma and Timbre) drops gender, age, and ethnicity classification to near random-guess levels (30%, 40%, and 31% on three-class tasks) while environmental sound classification, cough detection, and urban sound detection stay at 81-97% accuracy. The paper's central claim is that a carefully curated feature set, selected automatically by a privacy-utility-cost optimization, can support real-world non-speech sensing without exposing who is speaking.","feed_headline":"Curated audio features can hide speaker age, gender, and ethnicity","feed_subtitle":"FeatureSense keeps sound classification above 81% accurate while demographic inference drops to near chance.","key_machinery":"The load-bearing mechanism is the curated feature library itself: roughly thirty granular features grouped into time-domain, spectral, perceptual, statistical, high-level, voice-specific, and derived categories, with phonetic/linguistic features (formants, MFCC, LPCC) excluded by appeal to the source-filter model of speech production, which ties those features to vocal tract resonances and thus to speaker identity. Feature selection first prunes features with high correlation, mutual information, or permutation importance for age, gender, and ethnicity (Chroma and Timbre are dropped), then a linear-programming optimizer selects a task-specific subset maximizing $\\sum_i (\\alpha u_i - (1-\\alpha) p_i) x_i$ subject to a latency budget, where $u_i$ is the feature's utility for a sound category, $p_i$ its privacy leakage, and $\\alpha$ the user's privacy-utility priority. Leakage is scored with the Speaker Information Leakage Index, SILI, the weighted average of normalized attribute-classification accuracies after processing.","core_discovery":"The central discovery is that speaker-attribute leakage is separable from speech leakage: techniques that effectively hide what is said (Kirigami, PrivacyMic, SAMoSA, Synthetic Sensors) still retain pitch, formant, spectral-envelope, and MFCC structure from which age, gender, and ethnicity can be inferred with high accuracy. FeatureSense addresses this by exposing only features that, individually and in combination, have low mutual information and low predictive power for speaker attributes after removing Chroma Features and Timbre, which are the most leakage-prone. With the pruned feature set, a Random Forest trained to predict gender, age, or ethnicity from Common Voice speech reaches close to random-chance accuracy (30%, 40%, and 31% against a 33% chance baseline), a 60.6% average reduction in speaker leakage compared with existing privacy techniques, while ESC-50 classification stays at 81.2% accuracy. The claim is that this feature-based approach is a general privacy layer for any non-speech, speaker-invariant audio sensing task.","pith_inferences":["The paper leaves implicit that the same feature-pruning recipe could transfer to other sensor modalities, such as accelerometer or radar microfeatures, that leak user traits while retaining event-detection utility.","The appendix's finding that feature pairs like Low Band Energy plus Wavelet Features show 6.6x higher permutation importance than any single feature suggests a testable hardening step: extend the pruning to pairwise interactions, which the current selection algorithm does not yet model.","Because leakage is measured on Common Voice read speech, the guarantees may not transfer to conversational or noisy recordings; a natural extension is to measure SILI on emotional or spontaneous speech corpora before deployment."],"forward_implications":["A device running FeatureSense can expose only derived audio features to the cloud and still support environmental sound classification, cough detection, and urban sound event detection at 81-97% accuracy, making 'privacy mode' practical for always-on microphones.","The SILI/CSLI pair gives developers a unified way to compare both speaker and speech leakage across privacy techniques, replacing the current reliance on word-error-rate alone.","The task-specific optimizer lets non-experts pick a feature subset for a given sound category and latency budget without manual feature engineering, at the cost of a tunable $\\alpha$ trade-off between utility and privacy.","In the two case studies, reducing $\\alpha$ from 1.0 to 0.3 cuts feature-extraction latency from about 9 ms to under 1.5 ms while keeping 92-93% of task utility and more than halving age or ethnicity leakage."],"supporting_citations":[{"why":"Supplies the Common Voice speech data with age, gender, and accent labels used to measure speaker-attribute leakage and to score feature privacy.","marker":"[23]"},{"why":"Provides the ESC-50 environmental sound dataset whose per-category gini importance defines feature utility in the optimization.","marker":"[26]"},{"why":"Provides the cough and non-cough audio samples for the cough-detection case study.","marker":"[27]"},{"why":"Provides the dog-bark, gun-shot, and air-conditioner classes for the smart-speaker privacy-mode case study.","marker":"[28]"},{"why":"Kirigami is a speech-filtering baseline whose speaker leakage and utility FeatureSense is compared against.","marker":"[11]"},{"why":"SAMoSA is a subsampled-audio baseline used in the leakage comparison.","marker":"[16]"},{"why":"PrivacyMic is a low-pass-filter baseline used in the leakage comparison.","marker":"[29]"},{"why":"Synthetic Sensors is a reduced-FFT baseline used in the leakage comparison.","marker":"[30]"},{"why":"The source-filter model of speech production is the theoretical basis for excluding formant and phonetic features that carry speaker identity.","marker":"[25]"},{"why":"A pretrained Wav2Vec2 model is used to compute WER and PER for the speech-leakage side of the evaluation.","marker":"[47]"}],"fun_headline_variants":["Hide speaker attributes in audio without sacrificing sensing accuracy","Audio features that stop age, gender, and ethnicity leaks","FeatureSense: keep audio sensing, drop speaker attribute leakage","Demographic inference falls to chance with curated audio features","Privacy-preserving audio features beat existing methods by 60.6%"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that near-chance accuracy of Random Forest classifiers trained on Common Voice features is an adequate proxy for what a real adversary can infer from the exposed feature set, because the same data and classifier family are used both to select the features and to measure leakage.","fun_headline_variants_meta":{"raw":{"variants":["Hide speaker attributes in audio without sacrificing sensing accuracy","Audio features that stop age, gender, and ethnicity leaks","FeatureSense: keep audio sensing, drop speaker attribute leakage","Demographic inference falls to chance with curated audio features","Privacy-preserving audio features beat existing methods by 60.6%"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000211,"raw_usage":{"total_tokens":1420,"prompt_tokens":957,"completion_tokens":463,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":573,"completion_tokens_details":{"reasoning_tokens":382}},"tokens_in":573,"tokens_out":463,"duration_ms":4738,"temperature":1.0,"reasoning_tokens":382,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-07T12:34:35.060336+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train a deep neural network, or a model that also uses pairwise feature interactions, on the pruned FeatureSense vectors from Common Voice to predict gender, age, or ethnicity: if held-out accuracy substantially exceeds the 33% random baseline, the privacy claim fails. A complementary check is to repeat the leakage evaluation on a conversational or noisy speech corpus and see whether attribute accuracy stays near chance.","supporting_citations":[{"cited_title":"A dataset and taxonomy for urban sound research","cited_arxiv_id":null,"evidence_quote":"Provides the dog-bark, gun-shot, and air-conditioner classes for the smart-speaker privacy-mode case study."},{"cited_title":"Kirigami: Lightweight speech filtering for privacy- preserving activity recognition using audio","cited_arxiv_id":null,"evidence_quote":"Kirigami is a speech-filtering baseline whose speaker leakage and utility FeatureSense is compared against."},{"cited_title":"Samosa: Sensing activities with motion and subsampled audio","cited_arxiv_id":null,"evidence_quote":"SAMoSA is a subsampled-audio baseline used in the leakage comparison."},{"cited_title":"Privacymic: Utilizing inaudible frequencies for privacy preserving daily activity recognition","cited_arxiv_id":null,"evidence_quote":"PrivacyMic is a low-pass-filter baseline used in the leakage comparison."},{"cited_title":"Synthetic sensors: Towards general-purpose sensing","cited_arxiv_id":null,"evidence_quote":"Synthetic Sensors is a reduced-FFT baseline used in the leakage comparison."},{"cited_title":"The source–filter theory of speech","cited_arxiv_id":null,"evidence_quote":"The source-filter model of speech production is the theoretical basis for excluding formant and phonetic features that carry speaker identity."},{"cited_title":"Automatic speech disfluency detection using wav2vec2","cited_arxiv_id":null,"evidence_quote":"A pretrained Wav2Vec2 model is used to compute WER and PER for the speech-leakage side of the evaluation."}],"review_version":1}