Pith. sign in

REVIEW 3 major objections 4 minor 45 references

Exploiting Context-dependent Duration Features for Voice Anonymization Attack Systems

T0 review · 3 major / 4 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Phone-duration embeddings carry enough speaker identity to break voice anonymization, cutting equal error rate to 1.8% on original and 3.9% on anonymized speech.

desk verdict The empirical attack result is real but the paper's central attribution to 'context-dependent' duration embeddings is not isolated from classifier capacity; still worth a serious referee. read the letter →

arxiv 2507.15214 v1 pith:5OZQBEKO submitted 2025-07-21 cs.SD cs.CLcs.CReess.AS

Natalia Tomashenko , Emmanuel Vincent , Marc Tommasi This is my paper
classification cs.SDcs.CLcs.CReess.AS
keywords automaticspeakerverificationvoiceanonymizationattackmodelcontext-dependentdurationfeaturesspeechtemporaldynamicsphonemeembeddingsECAPA-TDNNprivacy
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to show that the timing of individual speech sounds—how long each phoneme lasts—carries enough speaker identity to break voice anonymization, and that a learned embedding of that timing is a far stronger attack than averaging durations. The authors encode every phone as a vector of its duration in its phoneme class and train an ECAPA-TDNN speaker classifier on these sequences. On LibriSpeech test-clean, the resulting attack cuts equal error rate from 26.0% for the average-duration baseline to 1.8% with eight enrollment utterances, and on anonymized speech from 25.9% to 3.9%. Because the anonymizer under test preserves original phone durations, the same model trained on original data transfers to anonymized speech without retraining, making it a universal attack against any anonymizer that leaves timing untouched. If correct, this means current anonymization systems that keep rhythm intact are leaking speaker identity through their temporal dynamics.

What carries the argument

The load-bearing object is the context-dependent duration embedding. Each phone in an utterance is represented by an $N$-dimensional vector (with $N=336$ ARPABET phoneme classes including word position and stress) whose single nonzero component equals the phone's duration in acoustic frames, so the vector indicates both which phoneme occurred and how long it lasted in its context. Sequences of these vectors, sampled in variable-length chunks of 32–256 phones with random shifts, are passed through a projection layer and an ECAPA-TDNN trained with cross-entropy speaker classification; the 128-dimensional output of the last fully connected layer is the speaker embedding. This machinery lets the model learn speaker-specific timing patterns conditioned on phonetic context, rather than collapsing durations to per-speaker averages, and because the input is a purely symbolic timing sequence it is agnostic to acoustic modifications such as pitch and energy changes that anonymization applies.

What would settle it

Take the same anonymizer and re-synthesize audio with phone durations stretched or compressed by a per-utterance random factor, then run the A2 attack; if equal error rate rises back toward the 25–26% baseline rather than staying near 4%, the claim that duration embeddings transfer across anonymizers is falsified. A second check: replace exact transcripts with ASR output containing realistic errors and measure how much the EER degrades.

Watch

Extended reading notes

Core claim

On the paper's own terms, the central discovery is that representing speech solely by the sequence of context-dependent phoneme durations—each phone occurrence encoded as a one-hot vector scaled by its length in acoustic frames—and feeding this sequence to a standard ECAPA-TDNN yields speaker embeddings that identify speakers far better than average-phoneme-duration vectors. The attack model, trained only on original LibriSpeech data, achieves an equal error rate of 1.8% on original test-clean and 3.9% on anonymized test-clean when eight utterances are available, compared with 26.0% and 25.9% for the metric-based average-duration baseline. On anonymized data it approaches the 2.0% EER of a semi-informed attacker trained on anonymized filterbank features, while requiring no exposure to anonymized speech at all. The authors interpret this as evidence that speech temporal dynamics are a rich, largely unexploited channel for speaker verification and a source of vulnerability for voice anonymization systems that preserve original phoneme durations.

Load-bearing premise

The attack's success on anonymized speech rests on the tested anonymizer keeping every phoneme's duration exactly as in the original recording, so the timing patterns the attacker learned still match the anonymized signal.

Editorial extensions

If this is right

  • A single attack model trained on original recordings applies to any anonymization system that preserves phone durations, eliminating the need for retraining on anonymized data.
  • Voice anonymization systems that keep original phoneme durations are demonstrably vulnerable: timing alone identifies speakers with low error rates.
  • Attack accuracy improves steeply with more enrollment utterances: for the duration-embedding model, EER on original test-clean falls from 24.2% with one utterance to 1.8% with eight.
  • The proposed duration embeddings outperform average-duration baselines by 42–93% relative EER reduction on original data and 28–85% on anonymized data.
  • Speaker verification based on temporal dynamics can serve as a complementary or alternative signal to conventional spectral speaker embeddings.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If anonymizers respond by modifying or randomizing phone durations, this attack becomes a moving target; the reported gains hinge on the attacker's timing features matching the anonymized signal, so a duration-perturbing anonymizer would likely restore privacy.
  • Combining context-dependent duration embeddings with conventional spectral speaker embeddings could yield an even stronger attack than either alone, since the two channels capture largely independent aspects of identity.
  • In realistic settings where the attacker relies on ASR transcripts with errors, the need for accurate phonetic alignments may cap the achievable gains; this paper's exact-transcript setup is an upper bound for that scenario.
  • The same duration-embedding approach could also be turned defensive: it offers a way to measure how much temporal identity information an anonymizer leaks, and could guide development of anonymizers that alter rhythm.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper proposes a speaker verification attack model based on context-dependent duration embeddings. Phone durations are encoded as one-hot phoneme vectors scaled by duration, and an ECAPA-TDNN is trained to classify speakers from chunks of these sequences. The resulting 128-dimensional embedding is used for ASV scoring (attack model A2). The authors compare A2 with A1, a metric-based average-phoneme-duration baseline from their prior work, and with A3, a conventional filterbank ECAPA-TDNN trained on anonymized data. Experiments on LibriSpeech original and VoicePrivacy 2024 B3-anonymized data show large EER reductions for A2 relative to A1 (e.g., from 26.0% to 1.8% on test-clean with 8 utterances), and the attack requires no retraining on anonymized data. The paper concludes that learned context-dependent duration embeddings are a strong attack representation and should guide anonymization design.

Significance. If the attribution is confirmed, the result is a useful contribution to the VoicePrivacy attacker literature: it quantifies speaker information in phoneme timing beyond simple averages and demonstrates a concrete attack that defeats a state-of-the-art anonymizer without access to anonymized training data. The evaluation is well controlled on important axes: models are trained on LibriSpeech-train and tested on held-out dev/test sets, Table 1 includes confidence intervals, and A3 represents the current semi-informed attack standard. However, the headline comparison conflates the proposed representation with the classifier architecture, and the generalization claims rest on a single anonymizer that preserves phone durations and on exact-transcript alignments. Additional ablations and a timing-modifying anonymizer would substantially strengthen the conclusions.

major comments (3)
  1. [Section 3, Eq. (2), Table 1] The central claim that context-dependent duration embeddings outperform simpler duration representations is not isolated by the experiments. A1 uses a hand-crafted similarity over average per-speaker duration vectors (Eq. 2), while A2 is a full ECAPA-TDNN trained with cross-entropy on 2,338 speakers over raw duration sequences (Section 3). The large EER reductions in Table 1 (e.g., 26.0 to 1.8 on test-clean with 8 utterances) could be due to the sequence-level input, the learned classifier, or model capacity rather than to context dependence. I ask for an architecture-matched control, e.g., the same ECAPA-TDNN trained on average duration vectors, and a version of A2 with context removed (for instance, by shuffling phone order within chunks). Without such a control, the attribution of the gain to context-dependent duration is not supported.
  2. [Section 4.2, Section 5] The generalization to voice anonymization attacks is demonstrated for only one anonymizer, the VoicePrivacy 2024 B3 baseline, which explicitly preserves original phone durations during synthesis (Section 4.2, step 3). Because the proposed attack is based on phone timing, its success on anonymized data is expected exactly when durations are unchanged; the statement in Section 5 that the model is a 'single universal attack model' for 'different anonymization algorithms' is therefore not supported by the data. The paper should either evaluate a second anonymizer that modifies timing (e.g., a cascaded ASR-TTS system [17,18]) or restrict the claims to duration-preserving anonymizers.
  3. [Section 4.1] The attack assumes exact text transcripts for phonetic alignment. Section 4.1 acknowledges this and motivates it as a strong-attacker setting, but the paper's framing as an 'attack system' for real scenarios requires evidence about robustness to ASR-derived alignments. At minimum, the scope should be stated as a proof-of-concept under an ideal-transcript assumption; ideally, a robustness experiment with ASR output should be added. Without it, the gap between the reported EERs and any practical attack remains unquantified.
minor comments (4)
  1. [Table 2] Table 2 reports EERs without confidence intervals, despite the text discussing comparisons between A2 and A3 (e.g., test-clean (8,1): 14.5 vs 14.1). Those differences may be within noise; please add confidence intervals or refrain from comparative statements about Table 2.
  2. [Section 3] The test-time embedding computation is underspecified: it is not stated whether the network is applied to full utterances, to fixed-length chunks, or to averaged chunk embeddings. Please clarify for reproducibility.
  3. [Section 4.3] The description of the training procedure is incomplete. Please report the optimizer, learning rate, number of epochs, batch size, number of training steps, and whether random shift is applied at test time. The current description is insufficient to reproduce the model.
  4. [Throughout] There are several typographical errors: 'is uses' in Section 4.2, 'systems.The' in the abstract, 'Transcations' in reference [22], and the author email 'marc@tommasi@inria.fr' appears malformed.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the proposed attack model is trained on original LibriSpeech-train data and evaluated on held-out original and anonymized data, with the anonymized data used only for evaluation.

full rationale

The central derivation is self-contained. The raw duration feature sequences of Section 2 are defined directly from phonetic alignments via Eq. (1), and the context-dependent duration embeddings are obtained by training an ECAPA-TDNN with cross-entropy speaker classification on LibriSpeech-train-960. Evaluation is on held-out dev-clean and test-clean, both original and anonymized, and the anonymized data is never used in training the proposed A2 model. The baseline A1 is the authors' own metric-based approach from [23], but it is described explicitly in Section 4.4 with its own score formula (Eq. 2), and it is used as a legitimate comparison rather than as a fitted target or as the source of the proposed embeddings. No prediction reduces to a fitted value by construction, no uniqueness theorem is imported from prior work, and no ansatz is smuggled in via citation. The skeptic's concern about the missing architecture-matched ablation is a valid attribution gap about whether the gain comes from the representation or the classifier, but it is not a circularity: the claim is not true by definition of the inputs. The assumption that the anonymization system preserves original phone durations (Section 4.2) limits the scope of the conclusions but does not make the evaluation circular.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

No new physical entities are postulated. The context-dependent duration embedding is a learned representation, not an invented entity. The listed free parameters are design choices not fitted to the evaluation set; the axioms are domain assumptions made explicit in the paper's setup.

free parameters (4)
  • Number of phoneme classes N = 336
    Defines the one-hot duration vector dimensionality; based on CMU ARPAbet with stress and word position, not fitted to the evaluation set.
  • Chunk length range for training = 32 to 256 phones
    Used to sample training chunks with a random shift; no ablation is reported.
  • Embedding dimension = 128
    Standard ECAPA-TDNN output size; chosen without variation.
  • Random shift r in chunk sampling = U(0, min{len(u1), len(chunk)})
    Data augmentation scheme for training; fixed, not compared with alternatives.
assumptions (5)
  • domain assumption The anonymization system B3 preserves original phone durations
    Section 4.2 states synthesis uses original phone durations; the attack's transfer relies on this.
  • domain assumption Phonetic alignment is accurate
    Raw duration features are derived from GMM-HMM forced alignments; alignment errors propagate into the embeddings.
  • domain assumption The attacker has exact text transcripts
    Section 4.1 explicitly uses exact transcripts to remove ASR errors; real attackers would need a perfect transcriber.
  • domain assumption ECAPA-TDNN trained on duration features learns speaker-discriminative embeddings
    The method assumes the architecture generalizes from filter-bank features to sparse duration sequences.
  • domain assumption LibriSpeech dev/test-clean are representative
    Limits to read English audiobooks; conversational or noisy speech may behave differently.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Exploiting Context-dependent Duration Features for Voice Anonymization Attack Systems." pith.science (2026). https://pith.science/paper/5OZQBEKO

@misc{pith2026250715214,
  author       = {Pith},
  title        = {Pith review of: Exploiting Context-dependent Duration Features for Voice Anonymization Attack Systems},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/5OZQBEKO}},
  note         = {Machine review of arXiv:2507.15214}
}
read the original abstract

The temporal dynamics of speech, encompassing variations in rhythm, intonation, and speaking rate, contain important and unique information about speaker identity. This paper proposes a new method for representing speaker characteristics by extracting context-dependent duration embeddings from speech temporal dynamics. We develop novel attack models using these representations and analyze the potential vulnerabilities in speaker verification and voice anonymization systems.The experimental results show that the developed attack models provide a significant improvement in speaker verification performance for both original and anonymized data in comparison with simpler representations of speech temporal dynamics reported in the literature.

Figures

Figures reproduced from arXiv: 2507.15214 by the authors.

Figure 1
Figure 1. Attack model training on raw duration feature sequences, yielding a 128-dimensional context-dependent duration embedding (yellow). 2. Raw duration feature sequences Previous works [23, 24] show that speaking rate and average durations of phonemes contain a significant amount of speaker information. In this study, our objective is to discover represen￾tations that more efficiently capture speaker information con￾veye… view at source ↗

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

45 extracted references · 40 canonical work pages

  1. [1]

    Introduction The widespread use of speech data today raises major privacy concerns, leading to its protection under the scope of privacy regulations like the European General Data Protection Regula- tion (GDPR) [1]. V oice recordings contain a large amount of personal information, and beyond revealing a speaker’s identity, speech data can disclose other s...

    work page Pith review arXiv 2025

  2. [2]

    In this study, our objective is to discover represen- tations that more efficiently capture speaker information con- veyed by speech temporal dynamics

    Raw duration feature sequences Previous works [23, 24] show that speaking rate and average durations of phonemes contain a significant amount of speaker information. In this study, our objective is to discover represen- tations that more efficiently capture speaker information con- veyed by speech temporal dynamics. We also aim to better un- derstand how ...

    work page

  3. [3]

    This model is expected to be robust to modifications of the speech signal during anonymization other than changes in the temporal dynamics

    Context-dependent duration embeddings and attack model The raw duration feature sequences proposed in Section 2 allow us to build an efficient speaker verification model that learns a context-dependent duration embedding for the given utter- ance(s) of each speaker. This model is expected to be robust to modifications of the speech signal during anonymiza...

    work page

  4. [4]

    Data Experiments were conducted on theLibriSpeech1 [26] corpus of read English audiobooks

    Experimental setup 4.1. Data Experiments were conducted on theLibriSpeech1 [26] corpus of read English audiobooks. It contains approximately 1,000 hours of speech from 2,484 speakers sampled at 16 kHz. The training data is the LibriSpeech-train-960 subset with 2,338 speakers. For development and evaluation we used the , dev-clean and test-clean subsets of...

    work page

  5. [5]

    The EER values are reported with 95% con- fidence intervals, calculated as suggested in [30]

    Results The results on the original evaluation data for different attack models are summarized in Table 1 in terms of equal error rate (EER, %). The EER values are reported with 95% con- fidence intervals, calculated as suggested in [30]. In this ta- ble, the results are given for development and evaluation data, on the original unprocessed (the third and...

    work page

  6. [6]

    extraction of the speaker embedding, phonetic transcription, pitch, energy, and phone duration from the original audio waveform

    work page

  7. [7]

    speaker embedding anonymization, pitch and energy modifi- cation

    work page

  8. [8]

    synthesis of an anonymized speech waveform from the anonymized speaker embedding, modified pitch and energy features, original phonetic transcripts and original phone du- rations. The automatic speaker verification results in terms of equal error rate (EER) on the LibriSpeech test set for anonymized data, according to [29], are around 27 − 28% for the str...

    work page 2024

Show all 45 references
  1. [9]

    Privacy and utility of x-vector based speaker anonymiza- tion,

    B. M. L. Srivastava, M. Maouche, M. Sahidullah, E. Vincent, A. Bellet, M. Tommasi, N. Tomashenko, X. Wang, and J. Yam- agishi, “Privacy and utility of x-vector based speaker anonymiza- tion,” IEEE/ACM Transactions on Audio, Speech and Language Processing, vol. 30, pp. 2383–2395, 2022

    2022

  2. [10]

    metric – the baseline metric-based approach [23] de- scribed in Section 4.4

    A1. metric – the baseline metric-based approach [23] de- scribed in Section 4.4

  3. [11]

    duration features – the proposed attack model relying on learned context-dependent duration embeddings

    A2. duration features – the proposed attack model relying on learned context-dependent duration embeddings

  4. [12]

    fbanks (only for anonymized data) – a semi-informed attack model trained on anonymized data using conventional filter bank features

    A3. fbanks (only for anonymized data) – a semi-informed attack model trained on anonymized data using conventional filter bank features. It’s important to note that models trained using only tempo- ral dynamics information do not require retraining when used with anonymized da...

  5. [13]

    Conclusions Our introduction of context-dependent duration embeddings provides new possibilities for robust speaker verification and privacy-preserving voice technologies. The proposed context- dependent duration embeddings and attack model allowed us to significantly outperfo...

  6. [14]

    Experiments were carried out using the Grid’5000 testbed

    Acknowledgements This work was supported by the French National Research Agency under project Speech Privacy and project IPoP of the Cybersecurity PEPR. Experiments were carried out using the Grid’5000 testbed

  7. [15]

    The GDPR & speech data: Reflections of legal and technology communities, first steps towards a common under- standing,

    A. Nautsch, C. Jasserand, E. Kindt, M. Todisco, I. Trancoso, and N. Evans, “The GDPR & speech data: Reflections of legal and technology communities, first steps towards a common under- standing,” in Interspeech, 2019, pp. 3695–3699

    2019

  8. [16]

    Introducing the V oicePrivacy Initiative,

    N. Tomashenko, B. M. L. Srivastava, X. Wang, E. Vincent, A. Nautsch, J. Yamagishi, N. Evans, J. Patino, J.-F. Bonastre, P.-G. No´e, and M. Todisco, “Introducing the V oicePrivacy Initiative,” in Interspeech, 2020, pp. 1693–1697

    2020

  9. [17]

    Speaker anonymisation using the McAdams coefficient,

    J. Patino, N. Tomashenko, M. Todisco, A. Nautsch, and N. Evans, “Speaker anonymisation using the McAdams coefficient,” in In- terspeech, 2021, pp. 1099–1103

    2021

  10. [18]

    Speaker anonymiza- tion by pitch shifting based on time-scale modification,

    C. O. Mawalim, S. Okada, and M. Unoki, “Speaker anonymiza- tion by pitch shifting based on time-scale modification,” in 2nd Symposium on Security and Privacy in Speech Communication , 2022, pp. 35–42

    2022

  11. [19]

    Design of voice privacy system using linear prediction,

    P. Gupta, G. P. Prajapati, S. Singh, M. R. Kamble, and H. A. Patil, “Design of voice privacy system using linear prediction,” in 2020 Asia-Pacific Signal and Information Processing Association An- nual Summit and Conference (APSIPA ASC), 2020, pp. 543–549

    2020

  12. [20]

    Improving speaker de-identification with functional data analysis of f0 trajectories,

    L. Tavi, T. Kinnunen, and R. G. Hautam ¨aki, “Improving speaker de-identification with functional data analysis of f0 trajectories,” Speech Communication, vol. 140, pp. 1–10, 2022

    2022

  13. [21]

    Speaker anonymization using x-vector and neural waveform models,

    F. Fang, X. Wang, J. Yamagishi, I. Echizen, M. Todisco, N. Evans, and J.-F. Bonastre, “Speaker anonymization using x-vector and neural waveform models,” in Speech Synthesis Workshop, 2019, pp. 155–160

    2019

  14. [22]

    Speaker anonymization using orthogonal Householder neural network,

    X. Miao, X. Wang, E. Cooper, J. Yamagishi, and N. Tomashenko, “Speaker anonymization using orthogonal Householder neural network,” IEEE/ACM Transactions on Audio, Speech, and Lan- guage Processing, vol. 31, pp. 3681–3695, 2023

    2023

  15. [23]

    Analysis of speech temporal dynamics in the context of speaker verification and voice anonymization,

    N. Tomashenko, E. Vincent, and M. Tommasi, “Analysis of speech temporal dynamics in the context of speaker verification and voice anonymization,” in ICASSP 2025-2025 IEEE Interna- tional Conference on Acoustics, Speech and Signal Processing (ICASSP). IEEE, 2025, pp. 1–5

    2025

  16. [24]

    Anonymizing speech: evaluating and designing speaker anonymization techniques,

    P. Champion, “Anonymizing speech: evaluating and designing speaker anonymization techniques,” Ph.D. dissertation, Universit´e de Lorraine, 2023

    2023

  17. [25]

    MUSA: Multi-lingual speaker anonymization via serial disentan- glement,

    J. Yao, Q. Wang, P. Guo, Z. Ning, Y . Yang, Y . Pan, and L. Xie, “MUSA: Multi-lingual speaker anonymization via serial disentan- glement,” arXiv preprint arXiv:2407.11629, 2024

    2024 arXiv

  18. [26]

    Language-independent speaker anonymization approach using self-supervised pre-trained models,

    X. Miao, X. Wang, E. Cooper, J. Yamagishi, and N. Tomashenko, “Language-independent speaker anonymization approach using self-supervised pre-trained models,” arXiv preprint arXiv:2202.13097, 2022

    2022 arXiv

  19. [27]

    The second model was used to perform segmentation of the anonymized development and evaluation datasets

    on the following training data: (1) original LibriSpeech- train-960; and (2) LibriSpeech-train-clean-360 anonymized by the voice anonymization system. The second model was used to perform segmentation of the anonymized development and evaluation datasets. In our experiments, w...

    2024

  20. [28]

    NPU-NTU system for V oice Privacy 2024 challenge,

    J. Yao, N. Kuzmin, Q. Wang, P. Guo, Z. Ning, D. Guo, K. A. Lee, E.-S. Chng, and L. Xie, “NPU-NTU system for V oice Privacy 2024 challenge,” arXiv preprint arXiv:2409.04173, 2024

    2024 arXiv

  21. [29]

    Speaker anonymity and voice conversion vulnerability: A speaker recognition analysis,

    S. Saini and N. Saxena, “Speaker anonymity and voice conversion vulnerability: A speaker recognition analysis,” in2023 IEEE Con- ference on Communications and Network Security (CNS). IEEE, 2023, pp. 1–9

    2023

  22. [30]

    V oice conversion-based privacy through adversarial information hiding,

    J. J. Webber, O. Watts, G. E. Henter, J. Williams, and S. King, “V oice conversion-based privacy through adversarial information hiding,” arXiv preprint arXiv:2409.14919, 2024

    2024 arXiv

  23. [31]

    Speaker anonymization using neural audio codec language models,

    M. Panariello, F. Nespoli, M. Todisco, and N. Evans, “Speaker anonymization using neural audio codec language models,” in IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), 2024, pp. 4725–4729

    2024

  24. [32]

    Why Eli Roth should not use TTS-systems for anonymization,

    Y . Sinha, J. Hintz, M. Busch, T. Polzehl, M. Haase, A. Wende- muth, and I. Siegert, “Why Eli Roth should not use TTS-systems for anonymization,” in Proceedings of the 2nd Symposium on Se- curity and Privacy in Speech Communication, 2022, pp. 17–22

    2022

  25. [33]

    Hltcoe jhu sub- mission to the voice privacy challenge 2024,

    H. L. Xinyuan, Z. Cai, A. Garg, K. Duh, L. P. Garc ´ıa-Perera, S. Khudanpur, N. Andrews, and M. Wiesner, “Hltcoe jhu sub- mission to the voice privacy challenge 2024,” arXiv preprint arXiv:2409.08913, 2024

    2024 arXiv

  26. [34]

    V oice privacy using CycleGAN and time-scale modification,

    G. P. Prajapati, D. K. Singh, P. P. Amin, and H. A. Patil, “V oice privacy using CycleGAN and time-scale modification,”Computer Speech & Language, vol. 74, 2022

    2022

  27. [35]

    The first V oicePrivacy Attacker Challenge evaluation plan,

    N. Tomashenko, X. Miao, E. Vincent, and J. Yamagishi, “The first V oicePrivacy Attacker Challenge evaluation plan,”arXiv preprint arXiv:2410.07428, 2024

    2024 arXiv

  28. [36]

    Phoneme duration modeling using speech rhythm-based speaker embeddings for multi-speaker speech synthesis,

    K. Fujita, A. Ando, and Y . Ijima, “Phoneme duration modeling using speech rhythm-based speaker embeddings for multi-speaker speech synthesis,” in Interspeech, 2021, pp. 3141–3145

    2021

  29. [37]

    Speech rhythm-based speaker embeddings extraction from phonemes and phoneme duration for multi-speaker speech synthe- sis,

    ——, “Speech rhythm-based speaker embeddings extraction from phonemes and phoneme duration for multi-speaker speech synthe- sis,” IEICE Transcations on Information and Systems , vol. 107, no. 1, pp. 93–104, 2024

    2024

  30. [38]

    Speaker verification using spectral and durational segmental characteristics,

    E. Bulgakova, A. Sholohov, N. Tomashenko, and Y . Matveev, “Speaker verification using spectral and durational segmental characteristics,” in 17th International Conference on Speech and Computer, 2015, pp. 397–404

    2015

  31. [39]

    ECAPA- TDNN: Emphasized channel attention, propagation and aggrega- tion in TDNN based speaker verification,

    B. Desplanques, J. Thienpondt, and K. Demuynck, “ECAPA- TDNN: Emphasized channel attention, propagation and aggrega- tion in TDNN based speaker verification,” in Interspeech, 2020, pp. 3830–3834

    2020

  32. [40]

    Lib- riSpeech: an ASR corpus based on public domain audio books,

    V . Panayotov, G. Chen, D. Povey, and S. Khudanpur, “Lib- riSpeech: an ASR corpus based on public domain audio books,” in IEEE International Conference on Acoustics, Speech and Sig- nal Processing (ICASSP), 2015, pp. 5206–5210

    2015

  33. [41]

    The Kaldi speech recognition toolkit,

    D. Povey, A. Ghoshal, G. Boulianne, L. Burget, O. Glembek, N. Goel, M. Hannemann, P. Motl ´ıˇcek et al., “The Kaldi speech recognition toolkit,” in IEEE Automatic Speech Recognition and Understanding Workshop (ASRU), 2011

    2011

  34. [42]

    Prosody is not identity: A speaker anonymization approach using prosody cloning,

    S. Meyer, F. Lux, J. Koch, P. Denisov, P. Tilli, and N. T. Vu, “Prosody is not identity: A speaker anonymization approach using prosody cloning,” inIEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), 2023, pp. 1–5

    2023

  35. [43]

    The V oicePrivacy 2024 challenge evaluation plan,

    N. Tomashenko, X. Miao, P. Champion, S. Meyer, X. Wang, E. Vincent et al., “The V oicePrivacy 2024 challenge evaluation plan,” arXiv preprint arXiv:2404.02677, 2024

    2024 arXiv

  36. [44]

    A statistical significance test for per- son authentication,

    S. Bengio and J. Mari ´ethoz, “A statistical significance test for per- son authentication,” inProceedings of Odyssey 2004: The Speaker and Language Recognition Workshop, no. CONF, 2004

    2004

  37. [45]

    The First V oicePrivacy Attacker Challenge,

    N. Tomashenko, X. Miao, E. Vincent, and J. Yamagishi, “The First V oicePrivacy Attacker Challenge,” in ICASSP 2025-2025 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). IEEE, 2025, pp. 1–2

    2025

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.