{"id":"6e26afe1-919c-47cb-82aa-7f135f4722f7","arxiv_id":"2509.22148","paper_version":2,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"Combining voice-conversion and text-to-speech anonymisation preserves suicide-risk detection accuracy near the original baseline (0.692 vs 0.702) while raising speaker-verification EER toward chance.","lead":"The paper tests whether speech can be anonymized before use in suicide-risk detection without losing diagnostic accuracy. Combining a voice-conversion method (RVC) with a text-to-speech method (CosyVoice) gives detection accuracy close to original speech while making speakers harder to identify.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"EER-based privacy claim rests on an unspecified speaker-verification protocol; original speech already has EER 0.185, so the anonymisation margin is not established.","rationale":"I read the paper as an empirical trade-off study: the contribution is that a CosyVoice+RVC fusion reaches near-original suicide-risk accuracy on anonymised adolescent speech. For that contribution to be true, both the accuracy figure and the anonymisation measurement must be trustworthy. The accuracy figure is also fragile (three seeds, no CI, post hoc ensemble), but it is at least a transparent number that can be re-computed. The EER column is the only evidence for the privacy half, and absent the protocol it cannot be audited or compared with the VoicePrivacy literature; the surprisingly high original EER of 0.185 reinforces that the measurement may be weak. Because this is a missing methodological specification rather than an observed contradiction, the appropriate action is to require the authors to provide the EER protocol and a union-of-copies evaluation, not to reject the work. This matches the reader's CONDITIONAL verdict, so no change is needed.","tokens_in":8326,"tokens_out":5420,"duration_ms":53204,"concrete_test":"Recompute the EER column with a specified strong verifier (e.g., ECAPA-TDNN trained on VoxCeleb2, as in the VoicePrivacy 2024 challenge): enroll on a 5 s segment of original speech, test on 5 s non-overlapping segments of (a) original, (b) RVC, (c) CosyVoice, and (d) both anonymised copies jointly; report EER for same/different-speaker trials with a fixed threshold. If the joint-copy EER is substantially below the 0.51 reported for RVC alone, the privacy half of the claim fails.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim has two load-bearing halves: utility (0.692 vs 0.702 accuracy) and privacy. The privacy half rests entirely on the EER column of Table 1, computed in Section 2.3 with no specification of the speaker-verification model, enrollment utterances, test segments, trial construction, or attack scenario. The 'Original' row already has EER 0.185, far from the near-zero value expected for unmodified speech, which indicates the verification conditions are unusually hard (short spontaneous adolescent audio, possibly a mismatched or weak verifier). Against such a weak baseline, RVC's 0.510 and CosyVoice's 0.497 are not interpretable as 'good' privacy; a stronger or better-calibrated attacker could yield much lower EER. Moreover, the headline CosyVoice+RVC ensemble is never given an EER evaluation. If deployed as a combined system, both anonymised copies of each speaker are exposed; an attacker holding both could exploit shared lexical content, timing, and F0 cues to link them, and the per-component EERs do not cover this union-of-outputs threat. Section 2.3 therefore does not support the 'while still ensuring good anonymisation' clause of the strongest claim.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper studies speaker anonymisation for speech-based suicide risk detection in adolescent speech. It evaluates a broad set of anonymisation methods (pitch modification, McAdams, SSL-SAS, FreeVC, SeedVC, RVC, and TTS-based SparkTTS/CosyVoice) under a five-metric framework (SNR, MOS, F0 deviation, semantic CER, emotion similarity, and speaker EER). The central claim is that a combination of CosyVoice and RVC, fused by averaging predicted probabilities, achieves suicide-risk detection accuracy of 0.692 against 0.702 for original speech, while still providing speaker anonymisation. The authors also test the effect of FRCRN speech enhancement prior to anonymisation and find no consistent benefit.","tokens_in":8506,"tokens_out":1985,"duration_ms":18001,"significance":"If the central claim holds, the paper makes a useful contribution by showing that anonymised speech can preserve enough clinical information for suicide risk detection while reducing speaker traceability in a vulnerable population. The study is the first systematic comparison of this kind for this task, and the detection evaluation is largely external: the detector is fine-tuned on original speech and evaluated on anonymised speech, with anonymisation systems pretrained off-the-shelf. The multi-metric evaluation framework and the exploration of complementary information across anonymisation methods are strengths. However, the headline 'comparable performance' and 'good anonymisation' claims rest on statistical and measurement gaps that need to be addressed before the findings can be considered robust.","major_comments":[{"comment":"The claim of 'comparable performance' (0.692 vs 0.702, a 1% gap) is not supported by any measure of uncertainty. Accuracy is averaged over three random seeds on a test set of roughly 122 samples (1,223 participants, 8:1:1 split), so the standard error of the mean is large; a 0.01 difference is well within run-to-run variability. Please report per-run results, standard deviations or confidence intervals, and perform a paired significance test (e.g., McNemar or bootstrap) between the ensemble and original speech, and between the ensemble and RVC alone. Without this, the central 'comparable performance' conclusion is not established.","section":"Section 4.2, Fig. 4"},{"comment":"The EER values used to support the 'good anonymisation' half of the trade-off are not backed by any specification of the speaker verification protocol: the verification model (e.g., ECAPA-TDNN, WavLM-based), enrollment utterances, test segments, trial construction (same/different speakers, number of impostors), and attack scenario are all unspecified. This is particularly problematic because the original speech already has EER=0.185, which is far from the near-zero value expected for unmodified audio, indicating an unusually difficult or weak verification setup. Under a stronger attacker, the EER margins for RVC (0.510) and CosyVoice (0.497) could shrink substantially, undermining the 'protection of speaker identity' claim. Please describe the verification protocol in detail and, ideally, evaluate with a stronger or state-of-the-art verifier, reporting DET curves or EER with confidence intervals.","section":"Section 2.3, Table 1"},{"comment":"The final combined CosyVoice+RVC system is never evaluated for speaker anonymisation. The paper reports EER only for individual methods, but the deployed composite system exposes both anonymised versions of each speaker. An attacker holding both outputs could link them through shared lexical content, timing, and residual prosodic cues, and the per-component EERs do not cover this union-of-outputs threat. Please compute an EER for the combined system, ideally under a protocol where enrollment and test come from the same composite output distribution, or at least clearly state that the privacy guarantee does not extend to the ensemble.","section":"Section 4.2 and Table 1"},{"comment":"The CER metric used to assert that CosyVoice preserves semantic content is circular for TTS methods: CosyVoice synthesises audio from the Paraformer ASR transcript of the original speech, and the same Paraformer model is then used to transcribe the anonymised speech for CER computation. This inflates the semantic-preservation score of TTS methods by construction and weakens the complementarity claim (CosyVoice for semantics + RVC for acoustics) in Section 4.2. Please provide an external semantic evaluation, e.g., human transcription or a different ASR model, or re-frame the conclusion to acknowledge that the semantic benefit is measured through the same ASR pipeline that generated the TTS input.","section":"Section 2.3, semantic preservation metric"}],"minor_comments":[{"comment":"There are typos: 'yeilds' in the Abstract and 'hightlight' in the Conclusion should be 'yields' and 'highlight'.","section":"Abstract and Section 5"},{"comment":"The figure caption and text use inconsistent spelling: 'Anoymised' in Fig. 1 should be 'Anonymised'. Also 'ppe-bound' in Section 4.2 should be 'upper-bound'.","section":"Fig. 1 and Section 1"},{"comment":"The column header 'L1 PCC↑' is unclear and inconsistent with Table 1, which lists 'L1 F0↓' and 'PCC F0↑' as separate columns. Please fix the header.","section":"Table 2"},{"comment":"Please state explicitly the number of test samples (approximately 122) and clarify that all reported accuracies are on this test set. This context is essential for interpreting the differences in Fig. 4.","section":"Section 3.2"},{"comment":"The figure shows only point estimates with no error bars; adding error bars or shaded confidence intervals would substantially improve interpretability.","section":"Fig. 4"},{"comment":"The RVC description mentions 'retrieves segments or acoustic embeddings from a target-speaker database' but no details are given about the target database, speaker coverage, or whether the database overlaps with the evaluation speakers. Please clarify.","section":"Section 2.2.2"}],"recommendation":"major_revision","confidential_remarks":"The paper addresses a socially important problem and the experimental scope is commendable, but the main claims require statistical substantiation and a clearly specified privacy evaluation protocol. The circularity of the CER metric for TTS methods is a real concern that should be addressed before publication. I recommend major revision rather than rejection because the central direction is credible and the issues are fixable within the manuscript's scope."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nThis paper is a competent, clearly scoped empirical comparison of speaker anonymisation methods for suicide risk detection. The genuinely new contribution is the systematic comparison across signal processing, voice conversion, and TTS anonymisation, and the complementary-ensemble result: combining CosyVoice (semantic) and RVC (acoustic) yields 0.692 accuracy versus 0.702 for original speech. That is a plausible, useful insight. The detection evaluation is properly external: the detector is fine-tuned on original speech and tested on anonymised speech, and the anonymisation systems are off-the-shelf models. Credit where due—this is the first study I know that teases apart what each anonymisation type preserves (F0, emotion, semantics) for this clinical task.\n\nThe soft spots are real. The privacy half of the central trade-off is not established. Table 1 reports EER for each method but never specifies the speaker-verification model, enrollment/test protocol, or attack scenario. Original speech already has EER 0.185, which is far too high for unmodified audio and suggests a weak or hard verifier. Against that baseline, RVC's 0.510 and CosyVoice's 0.497 are not interpretable as 'good anonymisation.' Worse, the headline CosyVoice+RVC ensemble is never evaluated for EER at all, so the 'while still ensuring good anonymisation' clause is unsupported. The stress-test note lands here.\n\nThe utility claim is also statistically thin. The accuracy is a three-run average on roughly 122 test speakers, with no variance or significance tests, and the best ensemble was chosen post hoc. The semantic-preservation metric is partially circular for the TTS methods: the same ASR both transcripts the source speech for synthesis and computes CER, so low CER partly reflects ASR consistency, not meaning preservation.\n\nNone of this is fatal. The flaws are addressable with a proper EER protocol, an attacker model, and confidence intervals. This is a paper for referees, not the desk. If you work in privacy-preserving speech or clinical speech processing, you will get value from the comparison itself. I would send it out, with the expectation of heavy revision.","headline":"Useful systematic comparison, but the privacy claim rests on an unspecified EER protocol and the utility claim lacks error bars.","tokens_in":9081,"tokens_out":3587,"would_cite":true,"duration_ms":26976,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper shows that ensembling a prosody-preserving voice converter with a semantic-preserving synthesizer yields suicide-risk detection accuracy of 0.692, within one percentage point of original speech, while anonymising the speaker.","keywords":["speaker anonymisation","suicide risk detection","adolescent speech","voice conversion","speech synthesis","privacy evaluation","speech large language model","ensemble of anonymisation methods"],"falsifier":"Run a realistic linkage attack: enroll a strong speaker-verification model on original speech and test it against the RVC+CosyVoice anonymised utterances. If the achieved EER under this protocol falls well below the reported ~0.5, or if the original-speech EER is far below 0.185 when measured properly, then the 'good anonymisation' claim fails even though detection accuracy may remain near 0.692.","tokens_in":8085,"feed_emoji":"🎙️","tokens_out":9682,"duration_ms":73074,"temperature":0.7,"pith_summary":"This paper asks whether adolescent speech can be anonymised without destroying the acoustic, prosodic, and semantic cues used to detect suicide risk, a privacy-utility trade-off that matters for a doubly vulnerable population. It systematically compares seven anonymisation pipelines—pitch shifting, McAdams formant modification, four neural voice-conversion systems, and two text-to-speech synthesizers—on Mandarin adolescent clinical recordings. The central claim is that no single method suffices, but combining RVC (which preserves prosodic and acoustic contours) with CosyVoice (which preserves semantic content) yields a suicide-risk detection accuracy of 0.692, a gap of only one percentage point to the 0.702 obtained on original speech, while raising speaker-verification equal error rate to roughly 0.5. In plain terms, the paper argues that privacy protection and clinical utility are not mutually exclusive if anonymisation choices are treated as complementary.","feed_headline":"Anonymised speech retains 99% of suicide-risk accuracy","feed_subtitle":"The RVC plus CosyVoice ensemble hits 0.692 accuracy, a one-point gap to original audio, with speaker EER around 0.5.","key_machinery":"The load-bearing mechanism is the complementarity of two anonymisation families, operationalised through the paper's five-metric evaluation framework (signal quality via SNR and UTMOS MOS, F0-contour deviation via L1 distance and Pearson correlation, semantic preservation via character error rate, emotional preservation via Emotion2Vec cosine similarity) and speaker discrimination via equal error rate. RVC, a retrieval-based neural voice converter, preserves F0 contours and acoustic detail; CosyVoice, a cascaded ASR-plus-TTS synthesizer, discards acoustics but keeps semantic content. Their predicted-probability ensemble is the central object that carries the argument. The detection backbone is Qwen2.5-Omni-7B, a speech large language model fine-tuned with weight-decomposed low-rank adaptation (DoRA, rank 32, alpha 64).","core_discovery":"The paper's central discovery is that the information lost by one anonymisation method is often retained by another, and that a simple probability-average ensemble of two complementary pipelines can recover most of the original speech's clinical signal. In the authors' evaluation, RVC retains F0-contour shape and acoustic detail better than any TTS method, while CosyVoice preserves semantic content (character error rate 0.024 versus 0.332 for SparkTTS) at the cost of prosodic and emotional information. Averaging the suicide-risk probabilities predicted by detectors trained on RVC-anonymised and CosyVoice-anonymised speech yields 0.692 accuracy, surpassing every individual system and coming within 0.01 of the 0.702 accuracy of original recordings, with a speaker-verification EER around 0.5 indicating substantial identity masking. The paper takes this as evidence that hybrid anonymisation strategies are viable for privacy-preserving clinical speech analytics.","pith_inferences":["Inference: the privacy guarantee is only as strong as the unspecified speaker-verification evaluation—original speech already has an EER of 0.185, so a stronger attacker or a more realistic linkage protocol could shrink the apparent anonymity margin; reporting the verification model and enrollment/test conditions would settle this.","Inference: the ensemble's success hints that suicide-risk information is distributed redundantly across semantic and prosodic channels, so a testable prediction is that ablating either channel will consistently lose accuracy, and adding a third complementary anonymisation could close the remaining 1% gap.","Inference: the same complementarity principle could transfer to other privacy-sensitive speech tasks, and the simplest extension would be to replace the suicide-risk classifier with a different paralinguistic head while keeping the anonymisation ensemble fixed.","Inference: calibrated score fusion instead of simple probability averaging might yield further gains, but this is untested in the paper."],"forward_implications":["If the central claim holds, anonymised clinical speech can be safely shared for suicide-risk screening, since the 1% accuracy gap is small enough to preserve population-level utility.","Hybrid anonymisation—pairing an acoustic-preserving voice-conversion method with a semantic-preserving synthesis method—becomes a general template for balancing privacy and utility in other paralinguistic clinical tasks such as depression or voice-disorder screening.","The finding that speech enhancement before anonymisation does not consistently help (and can hurt) downstream accuracy implies that pipeline engineering should focus on compatibility between enhancement and anonymisation, not just signal-to-noise ratio.","The five-metric evaluation framework plus EER provides a reusable benchmark for future anonymisation methods targeting clinical speech.","Since different anonymisations degrade different cue channels, detector ensembles trained on multiple anonymised views may prove more robust than any single pipeline, a direct extension already demonstrated for RVC and CosyVoice."],"supporting_citations":[{"why":"Supplies the spontaneous-speech dataset and the prior Whisper/LLM detection baseline this work extends.","marker":"[8]"},{"why":"Provides Qwen2.5-Omni-7B, the speech LLM backbone used for downstream detection.","marker":"[14]"},{"why":"Defines the McAdams-coefficient formant modification, one of the traditional anonymisation baselines.","marker":"[15]"},{"why":"Supplies SSL-SAS, the HuBERT/ECAPA/HiFi-GAN conversion baseline.","marker":"[16]"},{"why":"Supplies FreeVC, a text-free one-shot voice-conversion baseline.","marker":"[17]"},{"why":"Supplies SeedVC, the diffusion-based voice-conversion baseline.","marker":"[18]"},{"why":"Supplies SparkTTS, a TTS baseline at the semantic-preserving end of the trade-off.","marker":"[21]"},{"why":"Supplies CosyVoice 2.0, one half of the winning ensemble.","marker":"[22]"},{"why":"Supplies FRCRN, the speech-enhancement front-end whose interaction with anonymisation is analysed in Section 4.3.","marker":"[26]"}],"fun_headline_variants":["Hybrid anonymisation keeps suicide-risk accuracy near original","Ensemble anonymisers preserve suicide risk signal, hide identity","Two anonymisers beat one: near-original risk detection, low EER","RVC+CosyVoice blend: 99% risk accuracy with identity mask","Complementary anonymisers retain suicide-risk cues, protect speakers"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing assumption is that the paper's equal-error-rate numbers really capture how hard it is to identify the original speaker from anonymised audio; but the verification model and attack protocol are not specified, and even the original recordings already show a 0.185 error rate, so the privacy guarantee could be much weaker against a stronger attacker.","fun_headline_variants_meta":{"raw":{"variants":["Hybrid anonymisation keeps suicide-risk accuracy near original","Ensemble anonymisers preserve suicide risk signal, hide identity","Two anonymisers beat one: near-original risk detection, low EER","RVC+CosyVoice blend: 99% risk accuracy with identity mask","Complementary anonymisers retain suicide-risk cues, protect speakers"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000228,"raw_usage":{"total_tokens":1436,"prompt_tokens":866,"completion_tokens":570,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":482,"completion_tokens_details":{"reasoning_tokens":481}},"tokens_in":482,"tokens_out":570,"duration_ms":4260,"temperature":1.0,"reasoning_tokens":481,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T15:45:08.393446+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run a realistic linkage attack: enroll a strong speaker-verification model on original speech and test it against the RVC+CosyVoice anonymised utterances. If the achieved EER under this protocol falls well below the reported ~0.5, or if the original-speech EER is far below 0.185 when measured properly, then the 'good anonymisation' claim fails even though detection accuracy may remain near 0.692.","supporting_citations":[{"cited_title":"Trust is the basis for effective suicide risk screening and as- sessment in veterans,","cited_arxiv_id":null,"evidence_quote":"Supplies the spontaneous-speech dataset and the prior Whisper/LLM detection baseline this work extends."},{"cited_title":"Anonymizing and sharing med- ical text records,","cited_arxiv_id":null,"evidence_quote":"Provides Qwen2.5-Omni-7B, the speech LLM backbone used for downstream detection."},{"cited_title":"GANonymization: A GAN-based face anonymization framework for preserving emotional expres- sions,","cited_arxiv_id":null,"evidence_quote":"Defines the McAdams-coefficient formant modification, one of the traditional anonymisation baselines."},{"cited_title":"PrivECG: Generating private ECG for end-to-end anonymiza- tion,","cited_arxiv_id":null,"evidence_quote":"Supplies SSL-SAS, the HuBERT/ECAPA/HiFi-GAN conversion baseline."},{"cited_title":"Your substance abuse disorder is an open secret! Gleaning sensitive personal infor- mation from templates in an EEG-based authentication sys- tem,","cited_arxiv_id":null,"evidence_quote":"Supplies FreeVC, a text-free one-shot voice-conversion baseline."},{"cited_title":"Addressing challenges in speaker anonymization to maintain utility while ensuring privacy of pathological speech,","cited_arxiv_id":null,"evidence_quote":"Supplies SeedVC, the diffusion-based voice-conversion baseline."},{"cited_title":"Analyzing language-independent speaker anonymization framework under unseen conditions,","cited_arxiv_id":null,"evidence_quote":"Supplies SparkTTS, a TTS baseline at the semantic-preserving end of the trade-off."},{"cited_title":"FreeVC: Towards high- quality text-free one-shot voice conversion,","cited_arxiv_id":null,"evidence_quote":"Supplies CosyVoice 2.0, one half of the winning ensemble."}],"review_version":2}