Pith. sign in

REVIEW 3 major objections 5 minor 35 references

Inference Attacks for X-Vector Speaker Anonymization

T0 review · 3 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A simple distance check defeats x-vector voice anonymization.

desk verdict A simple, training-free attack on x-vector anonymization with a clean control experiment, but the comparative claim needs a field-standard ASV baseline before it holds. read the letter →

arxiv 2505.08978 v1 pith:GTIJKBSF submitted 2025-05-13 cs.CR cs.SDeess.AS

Luke Bauer , Wenxuan Bao , Malvika Jadhav , Vincent Bindschaedler This is my paper · ORCID
classification cs.CRcs.SDeess.AS
keywords speakeranonymizationx-vectorpseudoinferenceattackde-anonymizationprivacyevaluationre-identificationvoice
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

X-vector speaker anonymization replaces a speaker's voice embedding with a pseudo x-vector drawn from a public pool, but this paper argues the replacement still leaks who the speaker is. The proposed attack is deliberately ML-free: the adversary re-runs the anonymization pipeline on every suspect's audio, extracts an x-vector from the anonymized target audio, and picks the suspect whose simulated x-vector is closest in Euclidean distance. On the paper's evaluations, this simple attack outperforms trained speaker-identification attacks, often reaching perfect accuracy when the adversary has the same utterances and high accuracy when the suspect's utterances differ. If correct, current privacy evaluations of x-vector anonymizers, which measure whether a trained verification or identification model can re-identify speakers, are systematically too optimistic because the construction of the pseudo x-vector itself encodes information about the original x-vector.

What carries the argument

The load-bearing object is the pseudo x-vector construction rule, parameterized by a 'world' of the 200 nearest (or farthest) pool vectors to the original x-vector, with 100 randomly chosen and averaged. The paper treats this rule as a replicable function: for each suspect, run the same extraction-anonymization-synthesis chain, then compare the resulting x-vector to the one extracted from the target anonymized audio using $\ell^2$ distance. The mechanism that carries the argument is the statistical dependence of the world on the original x-vector: the set of 200 nearest or farthest pool vectors is specific enough to act as a speaker fingerprint, so the only residual randomness the attack must overcome is which 100 of the 200 were averaged.

What would settle it

Compute, for the same speaker, the overlap between the 200 nearest (or farthest) x-vector sets selected from the pool by two different utterances, after both are run through synthesis and x-vector re-extraction; if the overlap is low, the fingerprint mechanism collapses and Different-scenario accuracy should fall toward chance.

Watch

Extended reading notes

Core claim

The central discovery is that the pseudo x-vector is not independent of the original speaker. The anonymizer selects the 200 nearest (or farthest) x-vectors from a public pool relative to the original x-vector, then averages a random 100 of them; that selection procedure depends on the original x-vector, so the chosen 'world' acts as a fingerprint of the speaker. An adversary who can replicate the pipeline, using the same pool, affinity metric, and world size, can simulate anonymized audio for each suspect, extract x-vectors from those simulations and from the target anonymized audio, and compare $\ell^2$ distances. In the Same-utterance scenario this yields 100% re-identification accuracy for every pseudo-vector construction method except the fully random ones; in the more realistic Different-utterance scenario, accuracy stays well above chance, for example 76.3% for the 200-farthest method, while trained speaker-identification attacks remain below 44%. For random pseudo-vector methods, the above-chance success is attributed to leakage of pitch and linguistic bottleneck features into the anonymized audio, since normalizing those features away drops accuracy to random guessing.

Load-bearing premise

The attack assumes the adversary can exactly reproduce the anonymizer's pipeline, including the same public x-vector pool and the same 200-nearest/farthest selection rule, and that the resulting world of x-vectors is stable enough across a speaker's utterances that the true speaker's simulated vector stays closest.

Editorial extensions

If this is right

  • If the central claim is right, privacy scores reported by training an automatic speaker verifier on anonymized audio overstate the protection offered by x-vector anonymizers; the real threat model must include an adversary who simulates the transform.
  • Any x-vector anonymizer whose pseudo-vector construction depends on the original embedding, through nearest or farthest selection, ranking, or averaging, is vulnerable to this simulation attack regardless of how strong a downstream verifier is.
  • The attack doubles as an open-world detector: by thresholding the minimum l2 distance, the adversary can tell whether the target speaker is in the suspect set at all, with AUC far above chance in the Different-utterance scenario.
  • Fully random pseudo-vector methods are the private extreme when pitch and linguistic features are neutralized, but in practice those features leak identity; preserving utility therefore requires anonymizing or decorrelating F0 and bottleneck features, not just replacing the x-vector.
  • Because the attack needs no training and only a few minutes of x-vector extraction, privacy evaluations can be made dramatically cheaper and harder to game.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • An immediate scalable extension the paper leaves implicit: if the 200-nearest/farthest world is stable across a speaker's utterances, the per-suspect simulation could be replaced by a precomputed index mapping pool subsets to speakers, turning the attack into a nearest-neighbor lookup over millions of candidates; the paper lists scalability as a limitation.
  • The same simulation logic should transfer to any future embedding-based anonymizer whose transform is public and deterministic given the embedding, so designers should treat reproducing the transform as the baseline adversary before adding downstream ML attacks.
  • The F0/BN leakage finding suggests a testable design principle: measure re-identification accuracy under normalized F0/BN to isolate how much of the leak comes from the embedding transform versus prosodic features; this would let practitioners allocate privacy budget to the right component.
  • If the fingerprint interpretation is correct, the size and composition of the public pool directly controls privacy: a pool with many near-duplicate speakers should produce more overlapping worlds and lower attack accuracy, a prediction the paper does not test.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes a non-learned inference attack against x-vector speaker anonymization, specifically the VoicePrivacy 2024 baseline B1. The attack assumes the adversary knows the anonymization pipeline and the public x-vector pool; for each candidate speaker, the adversary simulates anonymization on the candidate's utterances, extracts an x-vector from the resulting anonymized audio, and returns the candidate whose simulated x-vector is closest in L2 distance to an x-vector extracted from the target anonymized audio. The authors evaluate the attack under Same, Different, and open-world (Unknown) knowledge levels, across six pseudo x-vector construction methods, and compare it to a trained ASI classifier. They report near-perfect attack accuracy in the Same setting, moderately high accuracy in the Different setting, high AUC for open-world detection, and a normalized F0/BN experiment (Table 4) that isolates x-vector leakage from prosody and linguistic leakage. The paper concludes that existing ML-based privacy evaluations are too optimistic and that simulation-based inference attacks should be part of the evaluation toolbox.

Significance. If the comparative claim were fully established, this would be a useful and conceptually important contribution: it shows that a simple, training-free attack that exploits the exact pseudo-x-vector construction mechanism can re-identify speakers at rates far above random, and the F0/BN control in Table 4 cleanly demonstrates why even 'random' pseudo-x-vector methods still leak speaker information on the evaluated pipeline. The attack is computationally cheap, and the evaluation covers both closed-world and open-world settings. However, the paper's central comparison is currently made against a weak ASI baseline that does not match the field-standard ASV/PLDA attacker used by the VoicePrivacy Challenge and in the related work the authors cite, so the stated conclusion that the attack outperforms existing approaches is not yet supported. The underlying mechanism and the empirical checks are valuable enough that this gap is fixable in revision.

major comments (3)
  1. [§5.2, Table 1; §6] The paper's central comparative claim—that the proposed ML-free attack outperforms existing ML-based attacks—is not established because the only trained comparator is an ASI network trained on the small Libri_dev set. This ASI baseline reaches only 79.3% accuracy on original, non-anonymized audio (Table 1), which indicates a weak attacker; on anonymized audio its accuracy is at most 43.6%. The field-standard privacy attacker for x-vector anonymization, used in the VoicePrivacy Challenge and in the related work cited in Sections 2.1 and 2.3, is an x-vector plus PLDA ASV system evaluated with EER. The manuscript itself concedes in Section 6 that considering ASV is future work. Without an ASV/PLDA baseline under the same Same, Different, and Original knowledge levels, the headline claim that existing approaches are outperformed is unsupported; the authors should either add this baseline or substantially temper the claim.
  2. [§5.4] The open-world evaluation relies on a threshold that is estimated in a setting where the attacker knows the target speaker is in S' (the paper states that 'the adversary can perform the attack in a setting where the speaker s is within the set S′ to estimate the distribution of x-vector l2 distances'). In the actual open-world scenario, by definition the attacker does not know whether s is present, so labeled data of this form is not available. The paper does not explain how the threshold would be selected in practice without such privileged knowledge, nor does it report the sensitivity of the ROC and AUC results to the choice of threshold. This matters because the threshold is the one free parameter of the open-world attack and the open-world detection claim depends directly on it.
  3. [§5.2, Fig. 3] The Different adversary scenario, which the paper describes as more realistic, rests on the untested assumption that the 200-nearest or 200-farthest 'world' selected from the public pool is stable across different utterances of the same speaker. If two utterances of the same speaker yield substantially different worlds, the simulated x-vector for the true speaker would not be reliably closest to the target's anonymized x-vector. Table 1 and Fig. 3 report only aggregate top-1 accuracy over the 29-speaker set; the paper provides no run-to-run or utterance-level variance analysis, and no confidence intervals. Since this stability is an empirical premise of the Different scenario, the paper should report per-speaker or per-utterance consistency, or at least variance estimates over repeated runs.
minor comments (5)
  1. [Throughout] The phrase 'A x-vector' appears in several places (e.g., Section 2.2 and Section 4.1) and should be 'An x-vector'.
  2. [§5.5] The time comparison is not fully apples-to-apples: the paper should state whether the attacker is assumed to already have anonymized audio for the candidate pool or must generate it, since the reported 2-minute extraction time for the proposed attack excludes the anonymization step that both attacks need.
  3. [§3.1] The likelihood-ratio formulation Pr(Transf(x1)=p)/Pr(Transf(x2)=p) is introduced but the rest of the paper uses L2 distance without a formal derivation; a brief explanation of the connection would make the methodology clearer.
  4. [Table 1] Table 1 reports no confidence intervals or standard deviations despite the small 29-speaker cohort described in Section 5.1; at least per-condition variance should be reported to assess the reliability of the accuracy figures.
  5. [§4.1] The paper should specify the exact configuration of the VoicePrivacy baseline B1 used, including the affinity metric (cosine versus PLDA) and the precise composition of the public pool, since Section 4.1 leaves both choices open.

Circularity Check

1 steps flagged · score 2.0 of 10

Main nearest-neighbor attack is not circular; one minor threshold-fitting issue in the open-world evaluation warrants a low score.

  1. fitted input called prediction [Section 5.4 (Open World Evaluation)]
    "To determine a suitable threshold, the adversary can perform the attack in a setting where the speaker s is within the set S′ to estimate the distribution of x-vector l2 distances and then derive a threshold value from it (e.g., choosing a threshold at or above a given percentile). We found that in the Same adversary knowledge setting we again get perfect accuracy, i.e., we are able to select a threshold without any false positives or false negatives."

    The paper's open-world protocol estimates the decision threshold from a labeled setting where the target is known to be present in S′, then reports 'perfect accuracy' on the Same adversary-knowledge configuration without describing a separate development/test split. The decision boundary is therefore fitted to the same distribution that is later scored, so the perfect-accuracy statement is a property of the fitted threshold on its training data rather than an independent prediction. This is localized: the closed-set nearest-neighbor attack needs no fitted parameter, and the Fig. 4 ROC curves sweep thresholds and are not affected by this calibration step.

full rationale

The core attack is not circular. It simulates the public anonymization pipeline on each suspect's utterances and compares the extracted x-vector l2 distances; the target identity is not used to construct the simulated candidates or the distances. The attack exploits the fact that the pseudo x-vector is derived from the original x-vector through a public pool, which is exactly the empirical premise under test rather than an assumed conclusion. No load-bearing self-citations appear: the references to prior VoicePrivacy and x-vector anonymization work are external baselines, and the paper does not invoke a uniqueness theorem or ansatz from its own prior work. The main comparative claim against the ASI baseline is weakened by the lack of the field-standard ASV/PLDA attacker, which the paper itself concedes in Section 6 as future work; however, a missing or weak baseline is an experimental-design issue, not a circular derivation. The only circular element is the threshold calibration in the open-world setting, which fits the decision boundary to the same data used for reporting. That is a secondary result, so the overall circularity score is low rather than severe.

Assumptions & free parameters 1 free parameters · 4 assumptions · 0 invented entities

The attack introduces no new entities. It reuses the x-vector extractor, the pseudo x-vector, and the public pool from prior work. The only ad hoc element is the distance threshold in the open-world evaluation, which is fit to ground truth.

free parameters (1)
  • open-world distance threshold = not disclosed (selected as a percentile of in-set distances)
    In Section 5.4, the adversary derives a threshold from a run where the target is known to be in S', then uses it to report open-world accuracy. This is effectively a parameter fit to ground truth.
assumptions (4)
  • domain assumption The adversary knows and can re-run the full anonymization pipeline, including the public x-vector pool and the pseudo x-vector construction rule.
    This white-box threat model is stated in Section 3.2 and Algorithm 1. If the attacker only had black-box access, the simulation step would be impossible.
  • domain assumption The x-vector extractor's output on synthesized audio is close enough to the pseudo x-vector used for synthesis that l2 distances among extracted vectors are informative.
    Section 4.2 admits there are significant differences due to generation, yet the attack's accuracy depends on this proximity holding well enough that the true speaker is the nearest candidate.
  • domain assumption Normalizing F0 and BN features across all candidates removes their speaker-identity leakage.
    The controlled experiment in Section 5.6 relies on this to attribute Random Average and Random Single improvement to F0 and BN leakage. It is an empirical assumption validated by the drop to random-guess accuracy.
  • domain assumption The l2 distance between extracted x-vectors is a valid ranking for speaker identity similarity.
    Algorithm 1 returns the argument minimizing l2 distance. No calibration or learned metric is used, so the attack's validity depends on this geometric assumption.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Inference Attacks for X-Vector Speaker Anonymization." pith.science (2026). https://pith.science/paper/GTIJKBSF

@misc{pith2026250508978,
  author       = {Pith},
  title        = {Pith review of: Inference Attacks for X-Vector Speaker Anonymization},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/GTIJKBSF}},
  note         = {Machine review of arXiv:2505.08978}
}
read the original abstract

We revisit the privacy-utility tradeoff of x-vector speaker anonymization. Existing approaches quantify privacy through training complex speaker verification or identification models that are later used as attacks. Instead, we propose a novel inference attack for de-anonymization. Our attack is simple and ML-free yet we show experimentally that it outperforms existing approaches.

Figures

Figures reproduced from arXiv: 2505.08978 by the authors.

Figure 1
Figure 1. Model architecture for x-vector speaker anonymization. [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Illustration of our proposed attack. The target speaker, [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Attack accuracy for different pseudo x-vector construc [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: ROC curves for identifying if a speaker is within the [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

35 extracted references · 23 canonical work pages

  1. [1]

    Yu and L

    D. Yu and L. Deng, Automatic speech recognition. Springer, 2016, vol. 1

    2016

  2. [2]

    Fastspeech: Fast, robust and controllable text to speech,

    Y . Ren, Y . Ruan, X. Tan, T. Qin, S. Zhao, Z. Zhao, and T.-Y . Liu, “Fastspeech: Fast, robust and controllable text to speech,” Advances in neural information processing systems , vol. 32, 2019

    2019

  3. [3]

    An overview of speaker identification: Accuracy and robustness issues,

    R. Togneri and D. Pullella, “An overview of speaker identification: Accuracy and robustness issues,”IEEE circuits and systems magazine, vol. 11, no. 2, pp. 23–61, 2011

    work page 2011

  4. [4]

    Speaker anonymization using x-vector and neural waveform models,

    F. Fang, X. Wang, J. Yamagishi, I. Echizen, M. Todisco, N. Evans, and J.-F. Bonastre, “Speaker anonymization using x-vector and neural waveform models,” arXiv preprint arXiv:1905.13561 , 2019

    arXiv 1905

  5. [5]

    Differentially private speaker anonymization,

    A. S. Shamsabadi, B. M. L. Srivastava, A. Bellet, N. Vauquier, E. Vin- cent, M. Maouche, M. Tommasi, and N. Papernot, “Differentially private speaker anonymization,” arXiv preprint arXiv:2202.11823 , 2022

    arXiv 2022

  6. [6]

    The voiceprivacy 2020 challenge evaluation plan,

    N. Tomashenko, B. M. L. Srivastava, X. Wang, E. Vincent, A. Nautsch, J. Yamagishi, N. Evans, J. Patino, J.-F. Bonastre, P.-G. No ´e et al. , “The voiceprivacy 2020 challenge evaluation plan,” Ph.D. dissertation, LIA-Laboratoire Informatique d’Avignon; MULTISPEECH-Speech Modeling for . . . , 2020

    work page 2020

  7. [7]

    The voiceprivacy 2024 challenge evaluation plan,

    N. Tomashenko, X. Miao, P. Champion, S. Meyer, X. Wang, E. Vin- cent, M. Panariello, N. Evans, J. Yamagishi, and M. Todisco, “The voiceprivacy 2024 challenge evaluation plan,” arXiv preprint arXiv:2404.02677, 2024

    arXiv 2024

  8. [8]

    The voiceprivacy 2022 challenge: Progress and perspectives in voice anonymisation,

    M. Panariello, N. Tomashenko, X. Wang, X. Miao, P. Champion, H. Nourtel, M. Todisco, N. Evans, E. Vincent, and J. Yamagishi, “The voiceprivacy 2022 challenge: Progress and perspectives in voice anonymisation,” IEEE/ACM Transactions on Audio, Speech, and Lan- guage Processing, 2024

    work page 2022

Show all 35 references
  1. [9]

    The voiceprivacy 2020 challenge: Results and findings,

    N. Tomashenko, X. Wang, E. Vincent, J. Patino, B. M. L. Srivastava, P.-G. No´e, A. Nautsch, N. Evans, J. Yamagishi, B. O’Brien et al. , “The voiceprivacy 2020 challenge: Results and findings,” Computer Speech & Language , vol. 74, p. 101362, 2022

    2020

  2. [10]

    X-vectors: Robust dnn embeddings for speaker recognition,

    D. Snyder, D. Garcia-Romero, G. Sell, D. Povey, and S. Khudanpur, “X-vectors: Robust dnn embeddings for speaker recognition,” in 2018 IEEE international conference on acoustics, speech and signal processing (ICASSP). IEEE, 2018, pp. 5329–5333

    2018

  3. [11]

    Membership inference attacks against machine learning models,

    R. Shokri, M. Stronati, C. Song, and V . Shmatikov, “Membership inference attacks against machine learning models,” in 2017 IEEE symposium on security and privacy (SP) . IEEE, 2017, pp. 3–18

    2017

  4. [12]

    A comprehensive survey on poisoning attacks and countermeasures in machine learning,

    Z. Tian, L. Cui, J. Liang, and S. Yu, “A comprehensive survey on poisoning attacks and countermeasures in machine learning,” ACM Computing Surveys, vol. 55, no. 8, pp. 1–35, 2022

    2022

  5. [13]

    V oxceleb2: Deep speaker recognition,

    J. S. Chung, A. Nagrani, and A. Zisserman, “V oxceleb2: Deep speaker recognition,” arXiv preprint arXiv:1806.05622 , 2018

    2018 arXiv

  6. [14]

    Speech emotion recognition using deep learning techniques: A review,

    R. A. Khalil, E. Jones, M. I. Babar, T. Jan, M. H. Zafar, and T. Alhus- sain, “Speech emotion recognition using deep learning techniques: A review,” IEEE access, vol. 7, pp. 117 327–117 345, 2019

    2019

  7. [15]

    Preserving privacy in speaker and speech characterisation,

    A. Nautsch, A. Jim ´enez, A. Treiber, J. Kolberg, C. Jasserand, E. Kindt, H. Delgado, M. Todisco, M. A. Hmani, A. Mtibaa et al. , “Preserving privacy in speaker and speech characterisation,” Com- puter Speech & Language , vol. 58, pp. 441–480, 2019

    2019

  8. [16]

    Design choices for x-vector based speaker anonymization,

    B. M. L. Srivastava, N. Tomashenko, X. Wang, E. Vincent, J. Yamagishi, M. Maouche, A. Bellet, and M. Tommasi, “Design choices for x-vector based speaker anonymization,” arXiv preprint arXiv:2005.08601, 2020

    2005 arXiv

  9. [17]

    Pri- vacy and utility of x-vector based speaker anonymization,

    B. M. L. Srivastava, M. Maouche, M. Sahidullah, E. Vincent, A. Bel- let, M. Tommasi, N. Tomashenko, X. Wang, and J. Yamagishi, “Pri- vacy and utility of x-vector based speaker anonymization,”IEEE/ACM Transactions on Audio, Speech, and Language Processing , vol. 30, pp. 2383–2395, 2022

    2022

  10. [18]

    A study of f0 modification for x-vector based speech pseudonymization across gender,

    P. Champion, D. Jouvet, and A. Larcher, “A study of f0 modification for x-vector based speech pseudonymization across gender,” arXiv preprint arXiv:2101.08478, 2021

    2021 arXiv

  11. [19]

    Speaker anonymization for personal information protection using voice con- version techniques,

    I.-C. Yoo, K. Lee, S. Leem, H. Oh, B. Ko, and D. Yook, “Speaker anonymization for personal information protection using voice con- version techniques,” IEEE Access, vol. 8, pp. 198 637–198 645, 2020

    2020

  12. [20]

    X-vector singular value modification and statistical-based decomposition with ensemble regression modeling for speaker anonymization system

    C. O. Mawalim, K. Galajit, J. Karnjana, and M. Unoki, “X-vector singular value modification and statistical-based decomposition with ensemble regression modeling for speaker anonymization system.” in Interspeech, 2020, pp. 1703–1707

    2020

  13. [21]

    Anonymizing speech with generative adversarial networks to pre- serve speaker privacy,

    S. Meyer, P. Tilli, P. Denisov, F. Lux, J. Koch, and N. T. Vu, “Anonymizing speech with generative adversarial networks to pre- serve speaker privacy,” in 2022 IEEE Spoken Language Technology Workshop (SLT). IEEE, 2023, pp. 912–919

    2022

  14. [22]

    On the invertibility of a voice privacy system using embedding alignment,

    P. Champion, T. Thebaud, G. Le Lan, A. Larcher, and D. Jouvet, “On the invertibility of a voice privacy system using embedding alignment,” in 2021 IEEE Automatic Speech Recognition and Un- derstanding Workshop (ASRU). IEEE, 2021, pp. 191–197

    2021

  15. [23]

    Introducing the voiceprivacy initiative,

    N. Tomashenko, B. M. L. Srivastava, X. Wang, E. Vincent, A. Nautsch, J. Yamagishi, N. Evans, J. Patino, J.-F. Bonastre, P.-G. No´e et al. , “Introducing the voiceprivacy initiative,” arXiv preprint arXiv:2005.01387, 2020

    2005 arXiv

  16. [24]

    Evaluating x-vector-based speaker anonymization under white-box assessment,

    P. Champion, D. Jouvet, and A. Larcher, “Evaluating x-vector-based speaker anonymization under white-box assessment,” in Speech and Computer: 23rd International Conference, SPECOM 2021, St. Pe- tersburg, Russia, September 27–30, 2021, Proceedings 23. Springer, 2021, pp. 100–111

    2021

  17. [25]

    V oice privacy through x-vector and cyclegan-based anonymization

    G. P. Prajapati, D. K. Singh, P. P. Amin, and H. A. Patil, “V oice privacy through x-vector and cyclegan-based anonymization.” in In- terspeech, 2021, pp. 1684–1688. 8

    2021

  18. [26]

    Privacy versus emotion preser- vation trade-offs in emotion-preserving speaker anonymization,

    Z. Cai, H. L. Xinyuan, A. Garg, L. P. Garc ´ıa-Perera, K. Duh, S. Khu- danpur, N. Andrews, and M. Wiesner, “Privacy versus emotion preser- vation trade-offs in emotion-preserving speaker anonymization,” in 2024 IEEE Spoken Language Technology Workshop (SLT) . IEEE, 2024, pp. 409–414

    2024

  19. [27]

    Fr \’echet audio distance: A metric for evaluating music enhancement algorithms,

    K. Kilgour, M. Zuluaga, D. Roblek, and M. Sharifi, “Fr \’echet audio distance: A metric for evaluating music enhancement algorithms,” arXiv preprint arXiv:1812.08466 , 2018

    2018 arXiv

  20. [28]

    Libritts: A corpus derived from librispeech for text-to- speech,

    H. Zen, V . Dang, R. Clark, Y . Zhang, R. J. Weiss, Y . Jia, Z. Chen, and Y . Wu, “Libritts: A corpus derived from librispeech for text-to- speech,” arXiv preprint arXiv:1904.02882 , 2019

    1904 arXiv

  21. [29]

    Deep neural network embeddings for text-independent speaker verification

    D. Snyder, D. Garcia-Romero, D. Povey, and S. Khudanpur, “Deep neural network embeddings for text-independent speaker verification.” in Interspeech, vol. 2017, 2017, pp. 999–1003

    2017

  22. [30]

    Librispeech: an asr corpus based on public domain audio books,

    V . Panayotov, G. Chen, D. Povey, and S. Khudanpur, “Librispeech: an asr corpus based on public domain audio books,” in 2015 IEEE international conference on acoustics, speech and signal processing (ICASSP). IEEE, 2015, pp. 5206–5210

    2015

  23. [31]

    Skydocs/speaker-identification: Speaker identification using neural net

    H. Ruwali, “Skydocs/speaker-identification: Speaker identification using neural net.” 2020. [Online]. Available: https://github.com/ SkyDocs/speaker-identification

    2020

  24. [32]

    Robust speech recognition via large-scale weak super- vision (arxiv: 2212.04356). arxiv,

    A. Radford, J. Kim, T. Xu, G. Brockman, C. McLeavey, and I. Sutskever, “Robust speech recognition via large-scale weak super- vision (arxiv: 2212.04356). arxiv,” 2022

    2022 arXiv

  25. [33]

    ” better be computer or i’m dumb

    K. Warren, T. Tucker, A. Crowder, D. Olszewski, A. Lu, C. Fedele, M. Pasternak, S. Layton, K. Butler, C. Gates et al. , “” better be computer or i’m dumb”: A large-scale evaluation of humans as audio deepfake detectors,” in Proceedings of the 2024 on ACM SIGSAC Conference on C...

    2024

  26. [34]

    Deepfake audio detection via mfcc features using machine learning,

    A. Hamza, A. R. R. Javed, F. Iqbal, N. Kryvinska, A. S. Almadhor, Z. Jalil, and R. Borghol, “Deepfake audio detection via mfcc features using machine learning,” IEEE Access, vol. 10, pp. 134 018–134 028, 2022

    2022

  27. [35]

    Dp-voicepub: Differential privacy-based voice publication,

    X. Yao and S. An, “Dp-voicepub: Differential privacy-based voice publication,” in 2023 IEEE International Symposium on Circuits and Systems (ISCAS). IEEE, 2023, pp. 1–5. 9

    2023

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.