RoVo: Robust Voice Protection Against Unauthorized Speech Synthesis with Embedding-Level Perturbations

Daeseon Choi; Donghyun Kim; Jisu Lee; Seungmin Kim; Sohee Park

REVIEW 4 major objections 5 minor 57 references

RoVo: Robust Voice Protection Against Unauthorized Speech Synthesis with Embedding-Level Perturbations

T0 review · 4 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read RoVo hides adversarial perturbations in neural-codec embedding vectors, making cloned speech fail speaker verification at high rates even after speech enhancement.

desk verdict RoVo's embedding-level perturbation axis is new and the core DSR claim holds, but the robustness-to-enhancement headline is inflated by counting quality destruction as defense success. read the letter →

arxiv 2505.12686 v1 pith:KFWGXUSQ submitted 2025-05-19 cs.LG cs.SDeess.AS

Seungmin Kim , Sohee Park , Donghyun Kim , Jisu Lee , Daeseon Choi This is my paper · ORCID

classification cs.LGcs.SDeess.AS

keywords voiceprotectionspeechsynthesisdefenseembedding-leveladversarialperturbationneuralaudiocodecspeakerverificationenhancementproactivespoofing

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

RoVo is a proposed defense against unauthorized voice cloning: it alters a person's audio so that when a speech-synthesis model tries to clone that voice, the resulting fake speech no longer matches the victim's identity in a speaker-verification check. The paper's core move is to inject the protective distortion into the embedding vectors of a neural audio codec rather than into the raw waveform, which makes the defense harder for speech-enhancement tools to strip away. In tests against four speech-synthesis models and three verification systems, RoVo raises the defense success rate by more than 70% relative to unprotected speech, reaching 99.5% against a commercial verification API. This matters because current reactive defenses only detect fakes after they exist, while RoVo aims to prevent a posted voice clip from ever being cloned convincingly.

What carries the argument

RoVo's central object is the embedding-level adversarial perturbation: a budget-limited change applied not to the waveform but to the vector representation produced by a neural audio codec (EnCodec and SoundStream) inside the BARK codec-language-model backbone, with the protected clip reconstructed by decoding the perturbed embedding. The perturbation is optimized by PGD under a PerC-AL (Perceptual Alternating Loss) controller that first minimizes target-based embedding distance to a wrong speaker and then switches to an SNR constraint to keep the distortion small. This machinery does the work of making the defense survive enhancement: the perturbation lives in the same representation as genuine speech structure, so removing it is indistinguishable from destroying the speech.

What would settle it

Filter the post-enhancement test set to samples that a speech recognizer transcribes correctly and that keep a fixed MOS floor, then recompute RoVo's DSR on that subset; if the filtered DSR falls to roughly the level of a signal-level defense, the claimed robustness is largely an artifact of destroyed audio.

Watch

Extended reading notes

Core claim

The paper claims that perturbing the high-dimensional embedding representation of speech—inside a neural audio codec language model—protects a voice from cloning while surviving speech-enhancement post-processing. Because the perturbation is entangled with the codec's representation of the entire acoustic signal, an enhancement model cannot remove it without damaging the speech itself, whereas signal-level perturbations such as Antifake's sit on the waveform and are easily filtered out. The optimization alternates between a target-based loss that pushes the protected audio's speaker embedding toward a different speaker and an SNR loss that caps distortion, under a PGD loop. Experiments report high DSR across SV2TTS, YourTTS, AdaptVC, and black-box Tortoise, small DSR drops after spectral masking, DeepFilterNet, and MP-SENet enhancement, and better transfer than Antifake. The paper also observes that some post-enhancement DSR gains come from enhancement severely distorting the protected audio rather than from perturbation persistence, an observation that frames how the robustness numbers should be interpreted.

Load-bearing premise

The load-bearing premise is that a high Defense Success Rate—synthesized audio failing speaker verification—signals genuine protection, yet the paper's own observation that speech enhancement sometimes raises DSR by severely distorting the protected audio means defense success and quality destruction are not cleanly separated.

Editorial extensions

If this is right

Voice samples shared on social media or customer-service channels could be pre-protected, so cloning attempts yield fakes that fail speaker verification.
Because the defense survives standard enhancement tools, an attacker cannot trivially undo it by running a denoiser before synthesis.
The transfer results suggest a defense tuned on a few known synthesizers can partially protect against a held-out black-box synthesizer.
The 99.5% DSR on a commercial verification API suggests the method can plug into existing fraud-prevention pipelines without requiring the platform to change its verification model.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The reported MOS values (roughly 1.97–2.91 before enhancement) imply that protected audio is noticeably less natural than the original; 'preserves naturalness' should be read as preserving intelligibility rather than perceptual transparency.
Because the DSR metric counts any verification failure as success, a sharper evaluation is to compute DSR only on enhanced samples that remain intelligible; that would separate perturbation persistence from quality collapse.
An adaptive attacker could train a speech-enhancement model on RoVo-protected audio and try to learn the perturbation's signature; the paper tests only non-adaptive enhancement, so this is an open arms race.
The same embedding-level mechanism could be combined with watermarking or synthetic-speech detection to cover post-hoc attribution, but RoVo does not explore that layering.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Zhiyuan, quick take on 2505.12686 (RoVo). The genuinely new thing is moving adversarial perturbation into neural-codec embedding space: encode with BARK, PGD on embeddings, decode. That is distinct from Antifake's signal-level attack and from prior anonymization work, and the experiments are broad enough (four synthesis models, three enhancement models, three verification systems, including Azure) that the narrow claim—embedding-level perturbations raise DSR—is credible. Table 2 is the backbone and it holds up.

What the paper does well: it checks black-box transfer to Tortoise, tests ensemble optimization, and is honest in §6.2 that some post-enhancement DSR gains come from severe distortion of the protected audio itself. That admission is more than most papers offer, but it cuts against the headline "robust under enhancement" claim more than the authors seem to realize.

Soft spots, in order of size. First, DSR after enhancement is a compound of perturbation persistence and plain quality destruction; Table 4 shows MOS around 2–3, and the user study shows 80% of listeners find enhanced defended audio different. So claiming "preserves naturalness" while counting destroyed audio as defense success is not separated. They need a distortion-aware decomposition—report DSR conditional on intelligibility or perceptual quality, or measure perturbation-removal success separately. Second, thresholds tau_identity/tau_SNR and hyperparameters are not disclosed, so the PerC-AL switching is not reproducible. Third, Algorithm 1 optimizes over embeddings e_perturb while Eq. (1) writes the loss over audio signals x_U + delta; likely just notation, but it matters for a paper whose whole point is embedding-level. Fourth, no code release; given the claim rests on a specific BARK pipeline, that is a real gap.

The citation pattern is fine—Antifake, PerC-AL, speaker anonymization via codecs are all cited. No invented entities. I don't think the circularity burden is high; the target loss is from Antifake but evaluation uses independent verification systems.

Who this is for: security researchers working on proactive voice protection; people building voice-sharing platforms. It deserves a serious referee slot—conditional accept, not desk reject—because the core axis is new and the negative results are honestly reported. My recommendation: send to peer review, but the authors need to decompose DSR, release thresholds/code, and soften the naturalness claim.

Referee Report

4 major / 5 minor

Summary. The paper proposes RoVo, a proactive defense against unauthorized speech synthesis. Instead of adding perturbations at the waveform level, RoVo uses a neural audio codec (BARK) to encode speech, applies PGD-based adversarial perturbations to the resulting embeddings under a PerC-AL loss that alternates between a speaker-identity target loss and an SNR-preservation loss, and then decodes the perturbed embeddings into protected audio. The authors evaluate RoVo against SV2TTS, YourTTS, AVC, and black-box Tortoise TTS, using ECAPA-TDNN, Resemblyzer, and Microsoft Azure speaker verification to compute Defense Success Rate (DSR), and they measure quality with NISQA MOS and a user study. They report large DSR gains over unprotected speech, claim superior robustness to speech-enhancement post-processing relative to the signal-level Antifake baseline, and conclude that RoVo preserves naturalness and usability.

Significance. The core idea of perturbing a learned audio-codec embedding rather than the raw waveform is a plausible and timely direction for making proactive voice defenses survive enhancement-based post-processing. The paper has notable strengths: evaluation uses three speaker-verification systems, including a commercial API; black-box transfer to Tortoise TTS is tested; an ensemble black-box setting under enhancement is included; and sound samples are publicly provided. However, the central robustness claim is currently confounded: the paper itself states that speech enhancement sometimes raises DSR because it severely distorts the protected audio, and the reported pre-enhancement MOS values are low. If the authors can separate perturbation persistence from quality collapse and align the optimization description with the algorithm, the work would be a useful contribution to the proactive-defense literature.

major comments (4)

[§6.2, Table 3] The robustness claim is not separable from quality destruction. In §6.2 the authors state that when enhancement raised DSR (e.g., +25.6 points for YourTTS/Resemblyzer/DeepFilterNet and +7.2 points for AVC/Resemblyzer/Spectral Masking), the enhancement models "severely distorted the protected audio itself" rather than leaving RoVo's perturbation intact. Because DSR counts any verification rejection as a success, a sample that is unintelligible after enhancement is scored identically to a sample whose speaker embedding remains perturbed. The abstract's statement that RoVo "remained robust even under strong speech enhancement" therefore requires a decomposition of post-enhancement DSR into cases where the perturbation survived and cases where the enhancement destroyed the signal. I recommend reporting DSR conditioned on a minimum post-enhancement quality threshold (e.g., MOS or STOI above a floor), or reporting joint distributions of DSR and quality for the same enhanced samples.
[§4.3, Eq. (1) and Algorithm 1] The objective is specified inconsistently. Eq. (1) defines L_identity as D(g(x_U + δx_U), g(x_T)) over audio signals, with g a speaker embedding encoder, while Algorithm 1 computes L_identity = ||G(e_perturb) - G(e_target)||_2 on embeddings and updates e_perturb before the codec decoder reconstructs audio. If the adversarial loss is actually evaluated on embeddings, Eq. (1) is not the optimized objective; if it is evaluated on reconstructed audio, the decoder and the inverse mapping from audio to embeddings must appear in the optimization loop. This distinction is central to the paper's "embedding-level perturbation" claim and needs to be stated precisely, including how gradients flow back to e_perturb.
[Table 4, §6.4, §7] The evidence does not support the naturalness claim. Table 4 reports pre-enhancement NISQA MOS of 2.09±0.27 to 2.91±0.67 for RoVo, whereas the text reports that BARK reconstruction without perturbations achieves MOS 4.53, so RoVo itself introduces a large quality drop. The user study in §6.4 additionally shows that only about 50% of participants rated RoVo-defended speech as "Very Similar" or "Somewhat Similar" to the original, and about 80% rated it "Somewhat Different" or "Very Different" after enhancement. Neither the abstract's "preserves naturalness and usability" nor the §7 conclusion that RoVo "maintains acceptable audio quality and naturalness" follows from these numbers. Please compare original, BARK-reconstructed, RoVo, and enhanced RoVo under the same protocol, with confidence intervals and a stated acceptability threshold.
[Table 3] The claim that RoVo "consistently maintained higher defense performance" than Antifake after enhancement is not supported by the full table. For example, with Spectral Masking and ECAPA-TDNN on SV2TTS, Antifake reaches 86.3% while RoVo reaches 77.1%, and with MP-SENet_VB and ECAPA-TDNN on SV2TTS, Antifake reaches 84.0% while RoVo reaches 81.5%. The paper should either qualify the claim or provide a systematic comparison (e.g., average rank or matched-pair differences across all configuration cells) rather than relying on selected examples.

minor comments (5)

[Figure 5] The label "Enhancment" is misspelled; it should be "Enhancement".
[Tables 2, 3, 5, 6] DSR values are reported without error bars or significance tests. Given the 1,090 protected samples and 5,045 synthesized samples per condition, bootstrapped confidence intervals would substantially strengthen the quantitative claims.
[§5.4] The speaker-verification thresholds are described only as "set using the VCTK dataset." Please state the threshold criterion (e.g., equal error rate), report the resulting false-accept and false-reject rates, and clarify whether the same thresholds are used for all synthesis and enhancement conditions.
[Reference [1]] Reference [1] is a Prolific OAuth callback URL that contains a live authorization code and state parameter. This looks like a leaked secret and should be replaced with the canonical Prolific URL.
[§6.3] The description of Table 5 says "the second row represents..." when the relevant information is in the column headers; please rephrase to describe the table structure accurately.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: DSR is externally evaluated on synthesized audio with separate verification models; the §6.2 distortion admission is a disclosed measurement confound, not a derivation loop.

full rationale

RoVo's derivation chain is not circular. The defense is built from an external backbone (BARK/EnCodec), an external optimization framework (PerC-AL [54]) and Antifake's target-based loss [50]; none of these are the authors' own prior results, so there is no self-citation loop. The optimization in Algorithm 1 minimizes ||G(e_perturb)-G(e_target)|| along with an SNR constraint, where G is the speaker encoder of the targeted synthesis model. DSR, by contrast, is measured on audio synthesized by four TTS/VC models and scored by three independent verification systems (ECAPA-TDNN, Resemblyzer, MS Azure), so the reported DSR is not the same function that was optimized. The 70% improvement and 99.5% Azure DSR are empirical outputs, not fitted values renamed as predictions. The only in-text caveat is Section 6.2's admission that enhancement sometimes 'severely distorted the protected audio itself,' which inflates post-enhancement DSR by quality destruction. That is a measurement-validity concern about what DSR means under enhancement, not a case where an output equals an input by construction; the paper explicitly discloses the confound rather than hiding it. No equation reduces to its own premise, and no load-bearing claim rests on a self-citation.

Assumptions & free parameters 5 free parameters · 3 assumptions · 0 invented entities

The method introduces no new entities; it applies PGD to existing BARK embeddings. It does depend on several undisclosed fitted hyperparameters and on two domain assumptions about the validity of the evaluation proxy.

free parameters (5)

tau_identity = not disclosed
PerC-AL switching threshold for the identity loss, tuned via extensive experiments in Section 4.3 and not reported.
tau_SNR = not disclosed
PerC-AL termination threshold for the SNR loss, tuned in Section 4.3 and not reported.
epsilon = not disclosed
PGD perturbation budget in Algorithm 1; no value is given.
alpha = not disclosed
PGD step size in Algorithm 1; no value is given.
N = not disclosed
Number of PGD iterations in Algorithm 1; no value is given.

assumptions (3)

domain assumption BARK encoder and decoder are differentiable and preserve speaker identity well enough for the perturbation to transfer.
Section 4.2 relies on BARK for embedding extraction and reconstruction; if BARK alters speaker characteristics, the defended audio differs for reasons unrelated to the perturbation.
domain assumption DSR measured by speaker verification is a valid proxy for defense against speech synthesis.
Section 5.4 equates synthesized audio not being recognized as the original speaker with successful defense, but this also counts cases where enhancement destroys audio quality.
domain assumption The selected speech enhancement models represent realistic secondary attacks.
Section 3.1 assumes attackers will use speech enhancement, and Section 5.2 evaluates only Spectral Masking, DeepFilterNet, and MP-SENet variants.

how reviews work

0 comments

Cite this review

Pith. "Pith review of RoVo: Robust Voice Protection Against Unauthorized Speech Synthesis with Embedding-Level Perturbations." pith.science (2026). https://pith.science/paper/KFWGXUSQ

@misc{pith2026250512686,
  author       = {Pith},
  title        = {Pith review of: RoVo: Robust Voice Protection Against Unauthorized Speech Synthesis with Embedding-Level Perturbations},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/KFWGXUSQ}},
  note         = {Machine review of arXiv:2505.12686}
}

read the original abstract

With the advancement of AI-based speech synthesis technologies such as Deep Voice, there is an increasing risk of voice spoofing attacks, including voice phishing and fake news, through unauthorized use of others' voices. Existing defenses that inject adversarial perturbations directly into audio signals have limited effectiveness, as these perturbations can easily be neutralized by speech enhancement methods. To overcome this limitation, we propose RoVo (Robust Voice), a novel proactive defense technique that injects adversarial perturbations into high-dimensional embedding vectors of audio signals, reconstructing them into protected speech. This approach effectively defends against speech synthesis attacks and also provides strong resistance to speech enhancement models, which represent a secondary attack threat. In extensive experiments, RoVo increased the Defense Success Rate (DSR) by over 70% compared to unprotected speech, across four state-of-the-art speech synthesis models. Specifically, RoVo achieved a DSR of 99.5% on a commercial speaker-verification API, effectively neutralizing speech synthesis attack. Moreover, RoVo's perturbations remained robust even under strong speech enhancement conditions, outperforming traditional methods. A user study confirmed that RoVo preserves both naturalness and usability of protected speech, highlighting its effectiveness in complex and evolving threat scenarios.

Figures

Figures reproduced from arXiv: 2505.12686 by the authors.

**Figure 1.** Overview of RoVo: While signal-level protected audio can defend against the initial attack, its effectiveness significantly [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗

**Figure 2.** Architecture of speech synthesis the target speaker. Finally, the linguistic and speaker-specific embeddings are fused within a high-quality neural vocoder to synthesize speech closely resembling the target speaker’s vocal attributes and speaking style. Recent deep-learning-based TTS architectures have demonstrated remarkable capabilities in generating natural, expressive, and human-like speech. Speaker Encoder. A… view at source ↗

**Figure 3.** Overview of RoVo framework: RoVo injects adversarial perturbations directly into embedding vectors extracted by [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗

Figures from the paper (2 more)

**Figure 4.** Figure 4: Spectrogram comparison: showing Antifake and RoVo before and after speech enhancement. RoVo perturbations [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]

**Figure 5.** Figure 5: User Study Results: Comparison of Perceived Simi [PITH_FULL_IMAGE:figures/full_fig_p012_5.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

57 extracted references · 43 canonical work pages

[1]

[n. d.]. Prolific Platform Callback URL. https://app.prolific.com/ oauth/callback?code=eJSHnsSab4WaBRIpmvh1TkSGkFUCWs47uDF4- lK8yNRQ5&state=3e46342e3996430198a5c1367e8a8f8b. Accessed: Jan. 10, 2025

work page 2025
[2]

no evil

Hadi Abdullah, Muhammad Sajidur Rahman, Washington Garcia, Kevin Warren, Anurag Swarnim Yadav, Tom Shrimpton, and Patrick Traynor. 2021. Hear" no evil", see" kenansville": Efficient and transferable black-box attacks on speech recognition and voice identification systems. In 2021 IEEE Symposium on Security and Privacy (SP). IEEE, 712–729

work page 2021
[3]

Muhammad Ejaz Ahmed, Il-Youp Kwak, Jun Ho Huh, Iljoo Kim, Taekkyung Oh, and Hyoungshick Kim. 2020. Void: A fast and light voice liveness detection system. In 29th USENIX Security Symposium (USENIX Security 20) . 2685–2702

work page 2020
[4]

Resemble AI. 2019. Resemblyzer: A toolkit for analyzing and comparing voices. https://github.com/resemble-ai/Resemblyzer Accessed: 2025-01-10

work page 2019
[5]

Suno AI. 2023. Bark: A Transformer-based Text-to-Speech Model. https://github. com/suno-ai/bark. Accessed: 2025-04-12

work page 2023
[6]

Ehab A AlBadawy, Siwei Lyu, and Hany Farid. 2019. Detecting AI-Synthesized Speech Using Bispectral Analysis.. In CVPR workshops. 104–109

work page 2019
[7]

Kolesnikov Alexander, Dosovitskiy Alexey, Weissenborn Dirk, Heigold Georg, Uszkoreit Jakob, Beyer Lucas, Minderer Matthias, D Mostafa, H Neil, G Sylvain, et al. 2021. An image is worth 16x16 words: transformers for image recognition at scale. In International Conference on Learning Representations (ICLR)

work page 2021
[8]

James Betker. 2022. TorToiSe TTS. https://github.com/neonbjb/tortoise-tts Accessed: 2025-01-10

work page 2022

Show all 57 references

[9]

James Betker. 2023. Better speech synthesis through scaling. arXiv preprint arXiv:2305.07243 (2023)

2023 arXiv
[10]

Logan Blue, Kevin Warren, Hadi Abdullah, Cassidy Gibson, Luis Vargas, Jessica O’Dell, Kevin Butler, and Patrick Traynor. 2022. Who are you (i really wanna know)? detecting audio{DeepFakes} through vocal tract reconstruction. In 31st USENIX Security Symposium (USENIX Security 2...

2022
[11]

Lee Brown. 2024. Scammers swindle elderly California man out of $25k by using AI voice technology... https://nypost.com/2024/10/18/us-news/scammers- swindle-elderly-california-man. Accessed: yyyy-mm-dd

2024
[12]

Danwei Cai, Zexin Cai, and Ming Li. 2023. Identifying source speakers for voice conversion based spoofing attacks on speaker verification systems. In ICASSP 2023-2023 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). IEEE, 1–5

2023
[13]

Edresson Casanova, Julian Weber, Christopher D Shulby, Arnaldo Candido Junior, Eren Gölge, and Moacir A Ponti. 2022. Yourtts: Towards zero-shot multi-speaker tts and zero-shot voice conversion for everyone. In International Conference on Machine Learning. PMLR, 2709–2720

2022
[14]

Ju-chieh Chou, Cheng-chieh Yeh, and Hung-yi Lee. 2019. One-shot voice conver- sion by separating speaker and content representations with instance normaliza- tion. arXiv preprint arXiv:1904.05742 (2019)

2019 arXiv
[15]

Joseph Cox. 2023. How I Broke Into a Bank Account With an AI Gener- ated Voice. https://www.vice.com/en/article/dy7axa/how-i-broke-into-a-bank- account-with-an-ai-generated-voice

2023
[16]

Nabanita Das, Sayan Chakraborty, Jyotismita Chaki, Neelamadhab Padhy, and Nilanjan Dey. 2021. Fundamentals, present and future perspectives of speech enhancement. International Journal of Speech Technology 24, 4 (2021), 883–901

2021
[17]

Alexandre Défossez, Jade Copet, Gabriel Synnaeve, and Yossi Adi. 2022. High fidelity neural audio compression. arXiv preprint arXiv:2210.13438 (2022)

2022 arXiv
[18]

Héctor Delgado, Nicholas Evans, Tomi Kinnunen, Kong Aik Lee, Xuechen Liu, Andreas Nautsch, Jose Patino, Md Sahidullah, Massimiliano Todisco, Xin Wang, et al. 2021. ASVspoof 2021: Automatic speaker verification spoofing and counter- measures challenge evaluation plan. arXiv pre...

2021 arXiv
[19]

Brecht Desplanques, Jenthe Thienpondt, and Kris Demuynck. 2020. Ecapa- tdnn: Emphasized channel attention, propagation and aggregation in tdnn based speaker verification. arXiv preprint arXiv:2005.07143 (2020)

2020 arXiv
[20]

Thierry Dutoit. 1997. An introduction to text-to-speech synthesis . Vol. 3. Springer Science & Business Media

1997
[21]

Hee Soo Heo, Bong-Jin Lee, Jaesung Huh, and Joon Son Chung. 2020. Clova baseline system for the voxceleb speaker recognition challenge 2020. arXiv preprint arXiv:2009.14153 (2020)

2020 arXiv
[22]

Chien-yu Huang, Yist Y Lin, Hung-yi Lee, and Lin-shan Lee. 2021. Defending your voice: Adversarial attack on voice conversion. In2021 IEEE Spoken Language Technology Workshop (SLT). IEEE, 552–559

2021
[23]

Tzu-hsien Huang, Jheng-hao Lin, and Hung-yi Lee. 2021. How far are we from robust voice conversion: A survey. In 2021 IEEE Spoken Language Technology Workshop (SLT). IEEE, 514–521

2021
[24]

Corentin Jemine. 2019. Real-Time Voice Cloning. https://github.com/CorentinJ/ Real-Time-Voice-Cloning University of Liège, Liège, Belgium, Accessed: 2025- 01-10

2019
[25]

Ye Jia, Yu Zhang, Ron Weiss, Quan Wang, Jonathan Shen, Fei Ren, Patrick Nguyen, Ruoming Pang, Ignacio Lopez Moreno, Yonghui Wu, et al. 2018. Transfer learning from speaker verification to multispeaker text-to-speech synthesis. Advances in neural information processing systems ...

2018
[26]

Lauri Juvela and Xin Wang. 2024. Collaborative Watermarking for Adversarial Speech Synthesis. In ICASSP 2024-2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) . IEEE, 11231–11235

2024
[27]

Jungil Kong, Jaehyeon Kim, and Jaekyoung Bae. 2020. Hifi-gan: Generative adversarial networks for efficient and high fidelity speech synthesis. Advances in neural information processing systems 33 (2020), 17022–17033

2020
[28]

Zihao Liu, Yan Zhang, and Chenglin Miao. 2023. Protecting Your Voice from Speech Synthesis Attacks. In Proceedings of the 39th Annual Computer Security Applications Conference. 394–408

2023
[29]

Ye-Xin Lu, Yang Ai, and Zhen-Hua Ling. 2023. MP-SENet: A speech enhancement model with parallel denoising of magnitude and phase spectra. arXiv preprint arXiv:2305.13686 (2023)

2023 arXiv
[30]

Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2017. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083 (2017)

2017 arXiv
[31]

Microsoft. 2025. Speaker Recognition API. https://learn.microsoft.com/ko-kr/ rest/api/speakerrecognition/. Accessed: 2025-04-15

2025
[32]

Gabriel Mittag, Babak Naderi, Assmaa Chehadi, and Sebastian Möller. 2021. NISQA: A deep CNN-self-attention model for multidimensional speech quality prediction with crowdsourced datasets. arXiv preprint arXiv:2104.09494 (2021)

2021 arXiv
[33]

Irina Mutica, Serban Mihalache, and Dragos Burileanu. 2024. Synthetic Speech Detection Using Deep Neural Networks. In 2024 47th International Conference on Telecommunications and Signal Processing (TSP) . IEEE, 53–57

2024
[34]

Douglas O’Shaughnessy. 2024. Speech enhancement—A review of modern meth- ods. IEEE Transactions on Human-Machine Systems 54, 1 (2024), 110–120

2024
[35]

Michele Panariello, Francesco Nespoli, Massimiliano Todisco, and Nicholas Evans
[36]

Kaizhi Qian, Yang Zhang, Shiyu Chang, Xuesong Yang, and Mark Hasegawa- Johnson. 2019. Autovc: Zero-shot voice style transfer with only autoencoder loss. In International Conference on Machine Learning . PMLR, 5210–5219

2019
[37]

Yi Ren, Yangjun Ruan, Xu Tan, Tao Qin, Sheng Zhao, Zhou Zhao, and Tie-Yan Liu. 2019. Fastspeech: Fast, robust and controllable text to speech. Advances in neural information processing systems 32 (2019). CCS ’25, 978-1-4503-XXXX-X/2018/06 s.Kim et al

2019
[38]

Reuters. 2025. Italian police freeze cash in AI voice scam that targeted business leaders. Reuters (12 February 2025). https://www.reuters.com/technology/ artificial-intelligence/italian-police-freeze-cash-ai-voice-scam-that-targeted- business-leaders-2025-02-12/

2025
[39]

Hendrik Schroter, Alberto N Escalante-B, Tobias Rosenkranz, and Andreas Maier
[40]

Devanshi Shah, Rachit Shah, Yash Bhadania, Priteshkumar Prajapati, Parth Shah, and Dharmendrasinh Rathod. 2024. DeepVerify: Ensuring Authenticity through Deepfake and Liveness Analysis. InInternational Conference on ICT for Sustainable Development. Springer, 189–199

2024
[41]

Mayank Kumar Singh, Naoya Takahashi, Weihsiang Liao, and Yuki Mitsufuji
[42]

Berrak Sisman, Junichi Yamagishi, Simon King, and Haizhou Li. 2020. An overview of voice conversion and its challenges: From statistical modeling to deep learning. IEEE/ACM Transactions on Audio, Speech, and Language Processing 29 (2020), 132–157

2020
[43]

Christophe Veaux, Junichi Yamagishi, and Kirsten MacDonald. 2017. CSTR VCTK corpus: English multi-speaker corpus for CSTR voice cloning toolkit. Available at https://datashare.ed.ac.uk/handle/10283/3443

2017
[44]

arXiv preprint arXiv:2406.03822 (2024)

SilentCipher: Deep Audio Watermarking. arXiv preprint arXiv:2406.03822 (2024)

2024 arXiv
[45]

Run Wang, Felix Juefei-Xu, Yihao Huang, Qing Guo, Xiaofei Xie, Lei Ma, and Yang Liu. 2020. Deepsonar: Towards effective and robust detection of ai-synthesized fake voices. In Proceedings of the 28th ACM international conference on multimedia. 1207–1216

2020
[46]

Yong Xu, Jun Du, Li-Rong Dai, and Chin-Hui Lee. 2014. A regression approach to speech enhancement based on deep neural networks. IEEE/ACM transactions on audio, speech, and language processing 23, 1 (2014), 7–19

2014
[47]

Li Wan, Quan Wang, Alan Papir, and Ignacio Lopez Moreno. 2018. Generalized end-to-end loss for speaker verification. In 2018 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) . IEEE, 4879–4883

2018
[48]

Ziwei Yan, Yanjie Zhao, and Haoyu Wang. 2024. Voicewukong: Benchmarking deepfake voice detection. arXiv preprint arXiv:2409.06348 (2024)

2024 arXiv
[49]

Jiangyan Yi, Chenglong Wang, Jianhua Tao, Xiaohui Zhang, Chu Yuan Zhang, and Yan Zhao. 2023. Audio deepfake detection: A survey. arXiv preprint arXiv:2308.14970 (2023)

2023 arXiv
[50]

Junichi Yamagishi, Massimiliano Todisco, Md Sahidullah, Héctor Delgado, Xin Wang, Nicholas Evans, Tomi Kinnunen, K Aik Lee, Ville Vestman, and Andreas Nautsch. 2019. Asvspoof 2019: Automatic speaker verification spoofing and countermeasures challenge evaluation plan. ASV Spoof...

2019
[51]

Asri Rizki Yuliani, M Faizal Amri, Endang Suryawati, Ade Ramdan, and Hilman Ferdinandus Pardede. 2021. Speech enhancement using deep learning methods: A review. Jurnal Elektronika dan Telekomunikasi 21, 1 (2021), 19–26

2021
[52]

Neil Zeghidour, Alejandro Luebs, Ahmed Omran, Jan Skoglund, and Marco Tagliasacchi. 2021. Soundstream: An end-to-end neural audio codec. IEEE/ACM Transactions on Audio, Speech, and Language Processing 30 (2021), 495–507

2021
[53]

Zhiyuan Yu, Shixuan Zhai, and Ning Zhang. 2023. Antifake: Using adversarial audio to prevent unauthorized speech synthesis. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security . 460–474

2023
[54]

Zhengyu Zhao, Zhuoran Liu, and Martha Larson. 2020. Towards large yet im- perceptible adversarial image perturbations with perceptual color distance. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition . 1039–1048

2020
[56]

Anna Zhadan. 2023. Emma Watson reads Mein Kampf while Biden announces invasion of Russia in latest AI voice clone abuse. https://cybernews.com/news/ai- voice-clone-misuse/ Accessed: 2025-01-10

2023
[2022]

In ICASSP 2022-2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)

DeepFilterNet: A low complexity speech enhancement framework for full-band audio based on deep filtering. In ICASSP 2022-2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) . IEEE, 7407–7411

2022
[2024]

In ICASSP 2024-2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)

Speaker anonymization using neural audio codec language models. In ICASSP 2024-2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). IEEE, 4725–4729

2024

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.

[1] [1]

[n. d.]. Prolific Platform Callback URL. https://app.prolific.com/ oauth/callback?code=eJSHnsSab4WaBRIpmvh1TkSGkFUCWs47uDF4- lK8yNRQ5&state=3e46342e3996430198a5c1367e8a8f8b. Accessed: Jan. 10, 2025

work page 2025

[2] [2]

no evil

Hadi Abdullah, Muhammad Sajidur Rahman, Washington Garcia, Kevin Warren, Anurag Swarnim Yadav, Tom Shrimpton, and Patrick Traynor. 2021. Hear" no evil", see" kenansville": Efficient and transferable black-box attacks on speech recognition and voice identification systems. In 2021 IEEE Symposium on Security and Privacy (SP). IEEE, 712–729

work page 2021

[3] [3]

Muhammad Ejaz Ahmed, Il-Youp Kwak, Jun Ho Huh, Iljoo Kim, Taekkyung Oh, and Hyoungshick Kim. 2020. Void: A fast and light voice liveness detection system. In 29th USENIX Security Symposium (USENIX Security 20) . 2685–2702

work page 2020

[4] [4]

Resemble AI. 2019. Resemblyzer: A toolkit for analyzing and comparing voices. https://github.com/resemble-ai/Resemblyzer Accessed: 2025-01-10

work page 2019

[5] [5]

Suno AI. 2023. Bark: A Transformer-based Text-to-Speech Model. https://github. com/suno-ai/bark. Accessed: 2025-04-12

work page 2023

[6] [6]

Ehab A AlBadawy, Siwei Lyu, and Hany Farid. 2019. Detecting AI-Synthesized Speech Using Bispectral Analysis.. In CVPR workshops. 104–109

work page 2019

[7] [7]

Kolesnikov Alexander, Dosovitskiy Alexey, Weissenborn Dirk, Heigold Georg, Uszkoreit Jakob, Beyer Lucas, Minderer Matthias, D Mostafa, H Neil, G Sylvain, et al. 2021. An image is worth 16x16 words: transformers for image recognition at scale. In International Conference on Learning Representations (ICLR)

work page 2021

[8] [8]

James Betker. 2022. TorToiSe TTS. https://github.com/neonbjb/tortoise-tts Accessed: 2025-01-10

work page 2022