SEF-MK: Speaker-Embedding-Free Voice Anonymization through Multi-k-means Quantization

Beilong Tang; Ming Li; Xiaoxiao Miao; Xin Wang

REVIEW 4 major objections 6 minor 49 references

SEF-MK: Speaker-Embedding-Free Voice Anonymization through Multi-k-means Quantization

T0 review · 4 major / 6 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims that replacing a single k-means quantizer with a pool of per-utterance-randomly-selected k-means models improves content and emotion preservation in speaker-embedding-free anonymization, while making attackers' speaker-reco

desk verdict Useful empirical study of multi-k-means anonymization, but the utility gain is confounded with decoder retraining and the headline comparison uses the weakest attacker. read the letter →

arxiv 2508.07086 v2 pith:ZYWN2LKQ submitted 2025-08-09 cs.SD cs.LGeess.AS

Beilong Tang , Xiaoxiao Miao , Xin Wang , Ming Li This is my paper

classification cs.SDcs.LGeess.AS

keywords voiceanonymizationspeakerembedding-freemulti-k-meansquantizationself-supervisedlearningprivacy-utilitytrade-offverificationemotionpreservation

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper proposes SEF-MK, a voice anonymization system that never extracts an explicit speaker embedding. Instead, it quantizes self-supervised speech representations (from WavLM) by randomly selecting, for each utterance, one k-means model from a pool trained on different speaker subsets, then reconstructs speech with a Conformer decoder and HiFi-GAN vocoder. The paper's central claim is that this multi-quantizer design preserves linguistic and emotional content better than a single dataset-wide k-means model, while also, from an attacker's viewpoint, making speaker-recovery attacks more effective: an attacker who trains a pool of k-means models on anonymized speech achieves substantially lower equal error rates. The result matters because it shows the privacy-utility trade-off in speaker-embedding-free anonymization is controlled by the composition of the quantizer training data, and that user-side diversity can inadvertently arm an adaptive attacker.

What carries the argument

Multi-k-means quantization pool: a set of $N$ k-means models (1024 centroids each), each trained on a distinct subset of $L$ speakers ($L\in\{1,10,20\}$) from a speech corpus such as LibriSpeech or VoxCeleb2. At inference, one model is selected uniformly at random per utterance and applied to the WavLM frame-level features to produce discrete cluster assignments, which are mapped to centroid vectors; a Conformer-based decoder then reconstructs continuous representations for HiFi-GAN synthesis. The random selection across models is what separates this design from a single 'train-on-everything' k-means baseline, and it is the mechanism the paper varies to measure both user-side utility and att

What would settle it

Run speaker-verification attacks separately by gender on the libri-1-sep configuration: if an attacker recovers speakers of one gender with EER far below the published average (e.g., below 10% for male speakers), the claim that per-speaker quantizers avoid encoding identity fails for that subgroup. Alternatively, train an attacker with a single k-means model on a much larger, more diverse corpus; if its EER does not fall below 30%, the claim that multiple quantizers specifically boost attack efficacy is weakened.

Watch

Extended reading notes

Core claim

SEF-MK establishes that in a speaker-embedding-free, SSL-based anonymization pipeline, the composition of the k-means training data is a first-order control knob. Training one k-means model per speaker (or per small groups) and applying one of these models at random per utterance suppresses speaker identity as effectively as a single dataset-wide model in terms of average EER, but it improves WER (content) and UAR (emotion) scores. From the attacker's side, however, when the attacker uses multiple k-means models to generate anonymized training utterances for an ECAPA-TDNN speaker verifier, the attack EER drops markedly (e.g., from over 35% to around 15%) compared with an attacker using a sin

Load-bearing premise

The load-bearing premise is that a k-means model trained on a single speaker's data captures only intra-speaker phonetic variation and therefore encodes no speaker identity; the paper's own gender-cluster visualization and per-gender EER results show this premise holds only partially.

Editorial extensions

If this is right

If the utility claim holds, voice anonymization can improve emotion and word retention without explicit speaker embeddings, simply by partitioning quantizer training data into speaker groups and randomizing quantizer choice.
If the attacker-side claim holds, an adaptive adversary who also trains a multi-quantizer pool—even on different, noisier data—can erode the protection that a single-model attacker cannot, so single-model privacy evaluations overstate real-world safety.
The gender-cluster artifact implies privacy gains are not uniform across speaker subgroups; a configuration with strong average EER may still expose one gender, so subgroup-level metrics are needed.
Cleaner quantizer training data (audiobook speech vs. noisy celebrity interviews) improves utility, suggesting data selection for quantizer training is itself part of the privacy-utility trade-off.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The paper's own visualization shows per-speaker quantizers preserve coarse group structure (gender); a natural extension is to test whether an attacker can exploit residual cluster structure with a lightweight classifier rather than a full speaker-verification model, which might be even more effective.
The random-selection mechanism is a stochasticity knob left unexplored; selecting a quantizer per utterance based on content-fidelity scores might decouple the user's utility gains from the attacker's diversity advantage.
Because the attacker's benefit arises from diversity in the anonymized training utterances, a possible defense is to make quantizer selection deterministic but difficult to predict (e.g., based on a secret key or utterance hash), which could keep the user's utility while reducing the attacker's ability to match training and test distributions.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Worth reading for the attacker-side asymmetry, but the utility story is not as clean as the abstract says.

The new thing is a pool of k-means quantizers trained on speaker subsets and randomly selected at inference, instead of the usual single k-means. The paper shows this diversity helps user-side utility (lower WER, higher UAR) and, more interestingly, that an attacker with a diverse pool of their own gets much lower EER than a single-model attacker. That attacker-side finding holds across user configurations and is the most useful result for VPC-style design. The paper is also transparent about the full- vs semi-attacker distinction and releases code and audio samples.

The central utility claim has a confound. In Section II-C, the Conformer is trained with the matched k-means models for each configuration. So Libri-20-sep uses 58 quantizers and a decoder trained on all of them, while Libri-all uses one quantizer and a decoder trained on it. The WER/UAR gains could come from the more diverse decoder training rather than from multi-k-means quantization itself. There is no ablation holding the decoder fixed, so the abstract's 'better preserves' attribution is not supported.

Also, the Table III comparison gives SEF-MK the weakest attacker from Table II—Libri-all, which yields EERs around 38-43%—while the same paper shows an attacker using Vox-1-sep can push EER down to roughly 15%. The selection is stated, but it flatters the system. And the stated assumption that per-speaker k-means avoids identity encoding is undermined by the gender clusters in Figure 3(c); the paper admits this, but it means privacy for subgroups is weaker.

The empirical work is honestly reported and the attacker-side effect is large and consistent. It is not circular, just under-analyzed. A clean ablation separating quantizer pool from decoder training, plus a comparison against a strong attacker, would make this a solid contribution. I'd send it for review with that expectation.

For people working on voice anonymization and VPC baselines, this is a useful data point. I'd cite the attacker-diversity result.

Referee Report

4 major / 6 minor

Summary. The paper proposes SEF-MK, a speaker-embedding-free voice anonymization pipeline in which WavLM features are quantized by a randomly selected k-means model from a pool of models trained on different speaker subsets, then reconstructed by a Conformer/HiFi-GAN decoder. Experiments follow the VoicePrivacy 2024 protocol and compare single-model and multi-model k-means pools built from LibriSpeech and VoxCeleb2. The main empirical findings are: (i) under a full attacker, multi-k-means configurations, especially Libri-20-sep, give lower WER and higher UAR than a single Libri-all k-means model; and (ii) under a semi-attacker, an attacker who also uses multiple k-means models achieves lower EER than one using a single model. The paper makes no mathematical claim; all support is empirical, with code and audio samples promised.

Significance. If the causal interpretation holds, the result is practically useful: multi-k-means is a simple, speaker-embedding-free modification that appears to improve content and emotion preservation, and the attacker-side analysis is a useful warning that privacy gains are not unconditional. The paper follows a standard challenge protocol and compares against several baselines. However, the central utility claim is not yet isolated from decoder retraining, the privacy mechanism is partially contradicted by the paper's own subgroup analysis, and no variance estimates are provided. The contribution is therefore promising but needs targeted ablations and further analysis before the headline claims can be accepted.

major comments (4)

[II-C, Table I] The headline utility gain is confounded with decoder retraining. Section II-C states that during Conformer training 'we use the matched k-means model trained on the same speaker as the input feature generator.' Thus the Table I comparison of Libri-all vs Libri-20-sep changes the quantizer pool and the Conformer jointly. A decoder trained on 58 diverse quantizers could improve WER/UAR independently of multi-k-means quantization. Please add an ablation that fixes the Conformer decoder and swaps only the k-means pool (or trains one decoder on all pools), and report matched/mismatched conditions. Without this, the abstract's causal claim is not supported.
[II-C, III-A1, Table II] The attacker-side comparison is not cleanly isolated. Table II varies the attacker's k-means pool and its size simultaneously (e.g., Vox-all with 1 model vs Vox-1-sep with 5,994 models), and the text does not state whether the attacker's anonymization pipeline uses a Conformer decoder trained for the attacker's pool or reuses the user's decoder. A mismatched quantizer-decoder pair can degrade speech quality and affect EER for reasons unrelated to pool multiplicity. Please specify the attacker's full pipeline and, ideally, control for pool size and decoder matching.
[II-C, IV-D, Figure 3(c), Table I] The claimed mechanism that a per-speaker k-means model 'focuses solely on intra-speaker phonetic variation, inherently avoiding the encoding of speaker identity' is contradicted by the paper's own evidence: Figure 3(c) shows gender clusters surviving in multi-k-means embeddings, and Section IV-A reports that libri-1-sep degrades EER for one gender relative to libri-all. Thus the privacy guarantee is not uniform across speaker subgroups. The recommended Libri-20-sep configuration should be evaluated per gender/subgroup, and the mechanism statement should be softened.
[Tables I and II] No error bars, repeated trials, or statistical tests are reported. Several key comparisons are small (e.g., Libri-20-sep vs Libri-10-sep WER 3.33 vs 3.37 and UAR 56.89 vs 55.50; attacker Vox-all vs Vox-1-sep dev-f 28.95 vs 25.98). Because model selection is randomized and training is stochastic, the rankings are not robust without variance estimates. Please provide confidence intervals or multiple-seed runs for the central comparisons.

minor comments (6)

[II-C] The text says D-L-sep yields S/L models, but for L=20 the counts in Table I are 58 for Libri (1172/20 = 58.6) and 299 for Vox (5994/20 = 299.7). Clarify how groups are formed and how leftover speakers are handled.
[II-C vs V] The method description says one k-means model is randomly selected for the utterance and applied to all frames, while the conclusion says selection is 'at either the frame level or the utterance level.' Please reconcile.
[II-C] Typo: 'may either improve the the extraction' should read 'improve the extraction'.
[III-B] The Conformer is described as trained on LibriSpeech-train-clean-460. For the VoxCeleb-based k-means pools, it is unclear whether the Conformer is trained on matched Vox k-means or always on LibriSpeech; this affects the interpretation of Table I Vox rows.
[IV-D, Figure 3] The t-SNE figure uses colors for 29 speakers but has no legend or colorbar; the reader cannot map colors to speaker identities. Also, the gender-cluster observation should be grounded in a quantitative cluster-quality or gender-ASV measure.
[IV-A] The phrase 'we did not observe significant changes in EER' is informal; without significance tests or confidence intervals, 'significant' is unsupported.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: SEF-MK's support is empirical comparison, not derivation from fitted inputs or load-bearing self-citations.

full rationale

The paper makes no mathematical derivation that reduces to its inputs. Its central claims are empirical comparisons in Tables I–III: WER, UAR, and EER are measured under different k-means pool configurations, not predicted from fitted parameters. The 'resyn' row is an explicit oracle/re-synthesis bound, not a fitted prediction. Self-citations to prior work ([20], [21], [49]) provide background and baselines; the key cited claim—that k-means can suppress speaker identity—is from a peer-reviewed, externally falsifiable study, and the paper tests this assumption empirically rather than treating it as axiomatic. The assumption in Section II-C that single-speaker k-means avoids speaker identity is explicitly stated as an intuition and is later partially contradicted by Figure 3(c) and Section IV-A, showing the authors do not force it. The skeptic's concern about decoder retraining confounding utility gains is a validity/causal-attribution issue, not circularity: the reported numbers are still measured outputs, not quantities made equal to inputs by construction. No equation or citation chain makes the conclusion equivalent to its premises.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The paper introduces no new physical or mathematical entities. The free parameters are system design choices, and the axioms are standard domain assumptions of the voice anonymization evaluation setup, several of which are only partially validated by the paper's own figures.

free parameters (3)

K (number of clusters per k-means model) = 1024
Chosen once for all quantizers; no ablation, so the effect of cluster count on the reported trade-off is untested.
L (speakers per k-means group) = 20 (selected from {1,10,20} on dev)
The paper reports L=20 as best for both LibriSpeech and VoxCeleb2, but this is model selection on the dev set and is then used for headline comparisons.
random model selection distribution = uniform 1/N
One of N models is picked at random; the distribution is not tuned and the paper does not analyze how much selection entropy contributes to privacy.

assumptions (4)

domain assumption WavLM SSL features encode linguistic content, speaker identity, and emotion
Used throughout Section II-C and cited to SUPERB; the paper does not independently verify this decomposition beyond t-SNE plots.
domain assumption k-means centroid quantization suppresses speaker identity while retaining content
Stated as intuition in Section II-C; Figure 3(c) shows gender clusters survive, so the premise is only partially true.
domain assumption ECAPA-TDNN ASV trained on anonymized speech is a faithful privacy probe
Only this attacker model and the VPC protocol are used; no alternative attack models or calibration checks are reported.
domain assumption The attacker cannot tell which k-means model was randomly selected for a given utterance
All privacy numbers assume selection randomness is hidden; if the active quantizer can be inferred from the output, the user-side diversity gain disappears.

how reviews work

0 comments

Cite this review

Pith. "Pith review of SEF-MK: Speaker-Embedding-Free Voice Anonymization through Multi-k-means Quantization." pith.science (2026). https://pith.science/paper/ZYWN2LKQ

@misc{pith2026250807086,
  author       = {Pith},
  title        = {Pith review of: SEF-MK: Speaker-Embedding-Free Voice Anonymization through Multi-k-means Quantization},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ZYWN2LKQ}},
  note         = {Machine review of arXiv:2508.07086}
}

read the original abstract

Voice anonymization protects speaker privacy by concealing identity while preserving linguistic and paralinguistic content. Self-supervised learning (SSL) representations encode linguistic features but preserve speaker traits. We propose a novel speaker-embedding-free framework called SEF-MK. Instead of using a single k-means model trained on the entire dataset, SEF-MK anonymizes SSL representations for each utterance by randomly selecting one of multiple k-means models, each trained on a different subset of speakers. We explore this approach from both attacker and user perspectives. Extensive experiments show that, compared to a single k-means model, SEF-MK with multiple k-means models better preserves linguistic and emotional content from the user's viewpoint. However, from the attacker's perspective, utilizing multiple k-means models boosts the effectiveness of privacy attacks. These insights can aid users in designing voice anonymization systems to mitigate attacker threats.

Figures

Figures reproduced from arXiv: 2508.07086 by the authors.

**Figure 2.** Evaluation protocol following the VoicePrivacy 2024 guidelines. The [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗

**Figure 3.** Libri-dev-enroll: Comparison of WavLM representations and clustering-based embeddings across speaker and separation settings. Different speaker identities are marked using different colors. the results in Sec. IV-A that libri-1-sep degraded the privacy protection (i.e., higher EER) for one of the gender. V. CONCLUSION In this work, we propose a speaker-embedding-free voice anonymization system that leverages multi-k… view at source ↗

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

49 extracted references · 37 canonical work pages

[1]

General data protection regulation (GDPR),

“General data protection regulation (GDPR),” https://gdpr.eu/ what-is-gdpr
[2]

The V oicePrivacy 2020 challenge: Results and findings,

N. Tomashenko, X. Wang, E. Vincent, J. Patino, B. M. L. Srivastava, P.-G. No´e, A. Nautsch, N. Evans, J. Yamagishi, B. O’Brien et al., “The V oicePrivacy 2020 challenge: Results and findings,” Computer Speech & Language, 2022

work page 2020
[3]

The V oicePrivacy 2022 Challenge evaluation plan,

N. Tomashenko, X. Wang, X. Miao, H. Nourtel, P. Champion, M. Todisco, E. Vincent, N. Evans, J. Yamagishi, and J. F. Bonastre, “The V oicePrivacy 2022 Challenge evaluation plan,” arXiv preprint arXiv:2203.12468, 2022

arXiv 2022
[4]

The V oicePrivacy 2022 challenge: Progress and perspectives in voice anonymisation,

M. Panariello, N. Tomashenko, X. Wang, X. Miao, P. Champion, H. Nourtel, M. Todisco, N. Evans, E. Vincent, and J. Yamagishi, “The V oicePrivacy 2022 challenge: Progress and perspectives in voice anonymisation,” IEEE/ACM Transactions on Audio, Speech, and Lan- guage Processing, pp. 1–14, 2024

2022
[5]

The V oicePri- vacy 2024 challenge evaluation plan,

N. Tomashenko, X. Miao, P. Champion, S. Meyer, X. Wang, E. Vincent, M. Panariello, N. Evans, J. Yamagishi, and M. Todisco, “The V oicePri- vacy 2024 challenge evaluation plan,” arXiv preprint arXiv:2404.02677, 2024

arXiv 2024
[6]

Design of voice privacy system using linear prediction,

P. Gupta, G. P. Prajapati, S. Singh, M. R. Kamble, and H. A. Patil, “Design of voice privacy system using linear prediction,” in Proc. APSIPA ASC. IEEE, 2020, pp. 543–549

work page 2020
[7]

Adjustable de- terministic pseudonymisation of speech: Idiap-NKI’s submission to V oicePrivacy 2020 challenge,

S. P. Dubagunta, R. Van Son, and M. M. Doss, “Adjustable de- terministic pseudonymisation of speech: Idiap-NKI’s submission to V oicePrivacy 2020 challenge,” URL: https://www. voiceprivacychal- lenge. org/docs/Idiap-NKI. pdf , 2020

work page 2020
[8]

S. E. McAdams, Spectral fusion, spectral parsing and the formation of auditory images. Stanford university, 1984

work page 1984

Show all 49 references

[9]

C. O. Mawalim, S. Okada, and M. Unoki. (2022) System description: Speaker anonymization by pitch shifting based on time-scale modification (PV-TSM). [Online]. Available: https://www.voiceprivacychallenge.org/results-2022/docs/1 T32.pdf

2022
[10]

Improving speaker de- identification with functional data analysis of f0 trajectories,

L. Tavi, T. Kinnunen, and R. G. Hautam ¨aki, “Improving speaker de- identification with functional data analysis of f0 trajectories,” Speech Communication, vol. 140, pp. 1–10, 2022

2022
[11]

Introducing the V oicePrivacy Initiative,

N. Tomashenko, B. M. L. Srivastava, X. Wang, E. Vincent, A. Nautsch, J. Yamagishi, N. Evans, J. Patino, J.-F. Bonastre, P.-G. No ´e, and M. Todisco, “Introducing the V oicePrivacy Initiative,” in Proc. Inter- speech, 2020, pp. 1693–1697

2020
[12]

Evaluating voice conversion-based privacy protection against informed attackers,

B. M. L. Srivastava, N. Vauquier, M. Sahidullah, A. Bellet, M. Tommasi, and E. Vincent, “Evaluating voice conversion-based privacy protection against informed attackers,” in Proc. ICASSP. IEEE, 2020, pp. 2802– 2806

2020
[13]

Hltcoe jhu submission to the voice privacy challenge 2024,

H. L. Xinyuan, Z. Cai, A. Garg, K. Duh, L. P. Garc ´ıa-Perera, S. Khu- danpur, N. Andrews, and M. Wiesner, “Hltcoe jhu submission to the voice privacy challenge 2024,” in Proc. 4th Symposium on Security and Privacy in Speech Communication , 2024, pp. 61–66

2024
[14]

Speaker anonymization using x-vector and neural waveform models,

F. Fang, X. Wang, J. Yamagishi, I. Echizen, M. Todisco, N. Evans, and J.-F. Bonastre, “Speaker anonymization using x-vector and neural waveform models,” Proc. 10th ISCA Speech Synthesis Workshop , pp. 155–160, 9 2019

2019
[15]

Prosody is not identity: A speaker anonymization approach using prosody cloning,

S. Meyer, F. Lux, J. Koch, P. Denisov, P. Tilli, and N. T. Vu, “Prosody is not identity: A speaker anonymization approach using prosody cloning,” in Proc. ICASSP. IEEE, 2023, pp. 1–5

2023
[16]

Differentially private speaker anonymization,

A. S. Shamsabadi, B. M. L. Srivastava, A. Bellet, N. Vauquier, E. Vincent, M. Maouche, M. Tommasi, and N. Papernot, “Differentially private speaker anonymization,” Proceedings on Privacy Enhancing Technologies, vol. 2023, no. 1, Jan. 2023. [Online]. Available: https://hal.inri...

2023
[17]

Speaker anonymization by modifying fundamental frequency and x- vector singular value,

C. O. Mawalim, K. Galajit, J. Karnjana, S. Kidani, and M. Unoki, “Speaker anonymization by modifying fundamental frequency and x- vector singular value,” Computer Speech & Language , vol. 73, p. 101326, 2022

2022
[19]

Musa: Multi-lingual speaker anonymization via serial disentanglement,

J. Yao, Q. Wang, P. Guo, Z. Ning, Y . Yang, Y . Pan, and L. Xie, “Musa: Multi-lingual speaker anonymization via serial disentanglement,” IEEE/ACM Transactions on Audio, Speech and Language Processing , vol. 33, pp. 1664–1674, 2025

2025
[20]

Language-independent speaker anonymization approach using self- supervised pre-trained models,

X. Miao, X. Wang, E. Cooper, J. Yamagishi, and N. Tomashenko, “Language-independent speaker anonymization approach using self- supervised pre-trained models,” in Proc. The Speaker and Language Recognition Workshop (Odyssey 2022) , 2022, pp. 279–286

2022
[21]

Speaker anonymization using orthogonal Householder neural network,

——, “Speaker anonymization using orthogonal Householder neural network,” IEEE/ACM Trans. Audio, Speech, and Language Processing , vol. 31, pp. 3681–3695, 2023

2023
[22]

Distinctive and natural speaker anonymization via singular value transformation-assisted matrix,

J. Yao, Q. Wang, P. Guo, Z. Ning, and L. Xie, “Distinctive and natural speaker anonymization via singular value transformation-assisted matrix,” IEEE/ACM Transactions on Audio, Speech, and Language Processing, 2024

2024
[23]

Probing the feasibility of multilingual speaker anonymization,

S. Meyer, F. Lux, and N. T. Vu, “Probing the feasibility of multilingual speaker anonymization,” Proc. Interspeech, 2024

2024
[24]

A benchmark for multi- speaker anonymization,

X. Miao, R. Tao, C. Zeng, and X. Wang, “A benchmark for multi- speaker anonymization,” IEEE Transactions on Information Forensics and Security, vol. 20, pp. 3819–3833, 2025

2025
[25]

HuBERT: Self-supervised speech representation learning by masked prediction of hidden units,

W.-N. Hsu, B. Bolte, Y .-H. H. Tsai, K. Lakhotia, R. Salakhutdinov, and A. Mohamed, “HuBERT: Self-supervised speech representation learning by masked prediction of hidden units,” IEEE/ACM Transactions on Audio, Speech, and Language Processing, vol. 29, pp. 3451–3460, 2021

2021
[26]

Wavlm: Large-scale self-supervised pre- training for full stack speech processing,

S. Chen, C. Wang, Z. Chen, Y . Wu, S. Liu, Z. Chen, J. Li, N. Kanda, T. Yoshioka, X. Xiao et al. , “Wavlm: Large-scale self-supervised pre- training for full stack speech processing,” IEEE Journal of Selected Topics in Signal Processing , vol. 16, no. 6, pp. 1505–1518, 2022

2022
[27]

wav2vec 2.0: A framework for self-supervised learning of speech representations,

A. Baevski, Y . Zhou, A. Mohamed, and M. Auli, “wav2vec 2.0: A framework for self-supervised learning of speech representations,” in Proc. NeurIPS, vol. 33, 2020, pp. 12 449–12 460

2020
[28]

X-vectors: Robust DNN embeddings for speaker recognition,

D. Snyder, D. Garcia-Romero, G. Sell, D. Povey, and S. Khudanpur, “X-vectors: Robust DNN embeddings for speaker recognition,” in Proc. ICASSP. IEEE, 2018, pp. 5329–5333

2018
[29]

ECAPA-TDNN: Emphasized channel attention, propagation and aggregation in TDNN based speaker verification,

B. Desplanques, J. Thienpondt, and K. Demuynck, “ECAPA-TDNN: Emphasized channel attention, propagation and aggregation in TDNN based speaker verification,” in Proc. Interspeech, 2020, pp. 3830–3834

2020
[31]

Design choices for x-vector based speaker anonymization,

B. M. L. Srivastava, N. A. Tomashenko, X. Wang, E. Vincent, J. Yam- agishi, M. Maouche, A. Bellet, and M. Tommasi, “Design choices for x-vector based speaker anonymization,” in Proc. Interspeech, 2020, pp. 1713–1717

2020
[32]

Privacy and utility of x-vector based speaker anonymization,

B. M. L. Srivastava, M. Maouche, M. Sahidullah, E. Vincent, A. Bellet, M. Tommasi, N. Tomashenko, X. Wang, and J. Yamagishi, “Privacy and utility of x-vector based speaker anonymization,” IEEE/ACM Transac- tions on Audio, Speech, and Language Processing , vol. 30, pp. 2383– 2395, 2022

2022
[33]

Analyzing language-independent speaker anonymization framework under unseen conditions,

X. Miao, X. Wang, E. Cooper, J. Yamagishi, and N. Tomashenko, “Analyzing language-independent speaker anonymization framework under unseen conditions,” in Proc. Interspeech, 2022, pp. 4426–4430

2022
[34]

HiFi-GAN: Generative adversarial net- works for efficient and high fidelity speech synthesis,

J. Kong, J. Kim, and J. Bae, “HiFi-GAN: Generative adversarial net- works for efficient and high fidelity speech synthesis,” in Proc. NeurIPS, 2020, pp. 17 022–17 033

2020
[35]

Privacy versus emotion preservation trade-offs in emotion-preserving speaker anonymization,

Z. Cai, H. L. Xinyuan, A. Garg, L. P. Garc ´ıa-Perera, K. Duh, S. Khudan- pur, N. Andrews, and M. Wiesner, “Privacy versus emotion preservation trade-offs in emotion-preserving speaker anonymization,” in Proc. SLT. IEEE, 2024, pp. 409–414

2024
[36]

Anonymising elderly and pathological speech: V oice conversion using ddsp and query-by-example,

S. Ghosh, M. Jouaiti, A. Das, Y . Sinha, T. Polzehl, I. Siegert, and S. Sto- ber, “Anonymising elderly and pathological speech: V oice conversion using ddsp and query-by-example,” Proc. Interspeech, 2024

2024
[37]

Comparing speech anonymization efficacy by voice conversion using knn and disentangled speaker feature representations,

A. Das, C. Franzreb, T. Herzig, P. Pirlet, and T. Polzehl, “Comparing speech anonymization efficacy by voice conversion using knn and disentangled speaker feature representations,” in Proc. SPSC 2024, 2024, pp. 121–126

2024
[39]

Conformer: Convolution-augmented transformer for speech recognition,

A. Gulati, J. Qin, C.-C. Chiu, N. Parmar, Y . Zhang, J. Yu, W. Han, S. Wang, Z. Zhang, Y . Wu et al., “Conformer: Convolution-augmented transformer for speech recognition,” Proc. Interspeech, 2020

2020
[40]

Private knn-vc: Interpretable anonymization of converted speech,

C. Franzreb, A. Das, T. Polzehl, and S. M ¨oller, “Private knn-vc: Interpretable anonymization of converted speech,” in Proc. Interspeech, 2025

2025
[41]

SUPERB: Speech Processing Universal PERformance Benchmark,

S.-w. Yang, P.-H. Chi, Y .-S. Chuang, C.-I. J. Lai, K. Lakhotia, Y . Y . Lin, A. T. Liu, J. Shi, X. Chang, G.-T. Lin, T.-H. Huang, W.-C. Tseng, K.-t. Lee, D.-R. Liu, Z. Huang, S. Dong, S.-W. Li, S. Watanabe, A. Mohamed, and H.-y. Lee, “SUPERB: Speech Processing Universal PERfo...

2021
[42]

LibriSpeech: an ASR corpus based on public domain audio books,

V . Panayotov, G. Chen, D. Povey, and S. Khudanpur, “LibriSpeech: an ASR corpus based on public domain audio books,” in Proc. ICASSP. IEEE, 2015, pp. 5206–5210

2015
[43]

V oxceleb2: Deep speaker recognition,

J. S. Chung, A. Nagrani, and A. Zisserman, “V oxceleb2: Deep speaker recognition,” in Proc. Interspeech, 2018, pp. 1086–1090

2018
[44]

V oice conversion with just nearest neighbors,

M. Baas, B. van Niekerk, and H. Kamper, “V oice conversion with just nearest neighbors,” in Proc. Interspeech, 2023, pp. 2053–2057

2023
[45]

Speaker anonymization using x-vector and neural waveform models,

F. Fang, X. Wang, J. Yamagishi, I. Echizen, M. Todisco, N. Evans, and J.-F. Bonastre, “Speaker anonymization using x-vector and neural waveform models,” in Proc. 10th ISCA Speech Synthesis Workshop , 2019, pp. 155–160

2019
[46]

Anonymiz- ing speech with generative adversarial networks to preserve speaker privacy,

S. Meyer, P. Tilli, P. Denisov, F. Lux, J. Koch, and N. T. Vu, “Anonymiz- ing speech with generative adversarial networks to preserve speaker privacy,” in Proc. SLT, 2023, pp. 912–919

2023
[47]

Speaker anonymization using neural audio codec language models,

M. Panariello, F. Nespoli, M. Todisco, and N. Evans, “Speaker anonymization using neural audio codec language models,” in Proc. ICASSP, 2024, pp. 4725–4729

2024
[48]

Anonymizing speech: Evaluating and designing speaker anonymization techniques,

P. Champion, “Anonymizing speech: Evaluating and designing speaker anonymization techniques,” arXiv preprint arXiv:2308.04455 , 2023

2023 arXiv
[49]

Adapting general disentanglement-based speaker anonymization for enhanced emotion preservation,

X. Miao, Y . Zhang, X. Wang, N. Tomashenko, D. C. L. Soh, and I. Mcloughlin, “Adapting general disentanglement-based speaker anonymization for enhanced emotion preservation,” Computer Speech & Language, p. 101810, 2025

2025
[50]

Speaker anonymisation using the mcadams coefficient,

J. Patino, N. Tomashenko, M. Todisco, A. Nautsch, and N. Evans, “Speaker anonymisation using the mcadams coefficient,” in Proc. In- terspeech, 2021, pp. 1099–1103

2021
[51]

V ocoder drift compensation by x-vector alignment in speaker anonymisation,

M. Panariello, M. Todisco, and N. Evans, “V ocoder drift compensation by x-vector alignment in speaker anonymisation,” in Proc. 3rd Sym- posium on Security and Privacy in Speech Communication , 2023, pp. 16–20

2023
[52]

Visualizing data using t-SNE

L. Van der Maaten and G. Hinton, “Visualizing data using t-SNE.” Journal of machine learning research , vol. 9, no. 11, 2008

2008

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.

[1] [1]

General data protection regulation (GDPR),

“General data protection regulation (GDPR),” https://gdpr.eu/ what-is-gdpr

[2] [2]

The V oicePrivacy 2020 challenge: Results and findings,

N. Tomashenko, X. Wang, E. Vincent, J. Patino, B. M. L. Srivastava, P.-G. No´e, A. Nautsch, N. Evans, J. Yamagishi, B. O’Brien et al., “The V oicePrivacy 2020 challenge: Results and findings,” Computer Speech & Language, 2022

work page 2020

[3] [3]

The V oicePrivacy 2022 Challenge evaluation plan,

N. Tomashenko, X. Wang, X. Miao, H. Nourtel, P. Champion, M. Todisco, E. Vincent, N. Evans, J. Yamagishi, and J. F. Bonastre, “The V oicePrivacy 2022 Challenge evaluation plan,” arXiv preprint arXiv:2203.12468, 2022

arXiv 2022

[4] [4]

The V oicePrivacy 2022 challenge: Progress and perspectives in voice anonymisation,

M. Panariello, N. Tomashenko, X. Wang, X. Miao, P. Champion, H. Nourtel, M. Todisco, N. Evans, E. Vincent, and J. Yamagishi, “The V oicePrivacy 2022 challenge: Progress and perspectives in voice anonymisation,” IEEE/ACM Transactions on Audio, Speech, and Lan- guage Processing, pp. 1–14, 2024

2022

[5] [5]

The V oicePri- vacy 2024 challenge evaluation plan,

N. Tomashenko, X. Miao, P. Champion, S. Meyer, X. Wang, E. Vincent, M. Panariello, N. Evans, J. Yamagishi, and M. Todisco, “The V oicePri- vacy 2024 challenge evaluation plan,” arXiv preprint arXiv:2404.02677, 2024

arXiv 2024

[6] [6]

Design of voice privacy system using linear prediction,

P. Gupta, G. P. Prajapati, S. Singh, M. R. Kamble, and H. A. Patil, “Design of voice privacy system using linear prediction,” in Proc. APSIPA ASC. IEEE, 2020, pp. 543–549

work page 2020

[7] [7]

Adjustable de- terministic pseudonymisation of speech: Idiap-NKI’s submission to V oicePrivacy 2020 challenge,

S. P. Dubagunta, R. Van Son, and M. M. Doss, “Adjustable de- terministic pseudonymisation of speech: Idiap-NKI’s submission to V oicePrivacy 2020 challenge,” URL: https://www. voiceprivacychal- lenge. org/docs/Idiap-NKI. pdf , 2020

work page 2020

[8] [8]

S. E. McAdams, Spectral fusion, spectral parsing and the formation of auditory images. Stanford university, 1984

work page 1984