Pith. sign in

REVIEW 3 major objections 4 minor 38 references

Speech obfuscation looks far weaker when the target is digits, not read speech.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Task-specific digit-recognition attacks show that temporal smoothing, resampling, and shredding protect spoken digits less—and differently—than read-speech word-error rates suggest.

T0 review reviewed 2026-08-01 challenge →

load-bearing objection A useful task-specific evaluation that undercuts WER read-speech heuristics, but the shredding arm is not actually informed and its digit-sequence results are compromised — worth refereeing, not desk rejection. the 3 major comments →

arxiv 2607.21393 v1 pith:XWKCRXV4 submitted 2026-07-23 eess.AS

From Read Speech to Spoken Digits: A Task-Specific Evaluation of Speech Privacy With Informed Attackers

Jule Pohlhausen , Anjana Rajasekhar , Anna Leschanowsky , Joerg Bitzer This is my paper
classification eess.AS
keywords speech privacyobfuscationdigit recognitioninformed attackertask-specific evaluationword error ratetemporal smoothingsound shredding
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to establish that current speech-privacy evaluations, which rely on word error rates for read speech, overstate how well obfuscation protects sensitive spoken content. It tests three lightweight obfuscation methods — temporal smoothing, low-pass resampling, and block shuffling — against two informed attackers: a general-purpose speech recognizer and a small digit-specific classifier. The central finding is that a task-specific attacker can recognize single digits even after obfuscation that looks strong on read speech, while concatenated digit sequences give the general ASR contextual clues that further erode protection. The authors conclude that privacy should be evaluated with task-specific metrics aimed at the actual sensitive content, such as the digit strings in phone and account numbers.

Core claim

The paper's central claim is that the word error rate on continuous read speech is the wrong yardstick for judging whether an obfuscation technique protects sensitive numeric content. Using digit recognition as a task-specific probe, the authors show that a lightweight DNN trained only on mean and variance of MFCC features recognizes obfuscated single digits almost as well as clean ones, while a general-purpose ASR recognizes concatenated digit sequences far better than read-speech WER would predict. They introduce a digit recognition error rate (DRER) with exact and fuzzy matching to measure this, and report that across two English digit datasets, the rank order of obfuscation techniques ch

What carries the argument

A task-specific evaluation protocol built around the digit recognition error rate (DRER), a metric that scores whether an attacker recovers the target digit rather than counting all word errors. The protocol pairs two attack models — a general-purpose ASR fine-tuned on obfuscated data and a small ten-class DNN that pools MFCC statistics over time — with three signal-processing obfuscation methods, and tests single digits versus concatenated digit chains at varying speech rates. The DRER isolates the privacy-relevant failure mode, and the comparison between single and concatenated digits reveals that sequence context itself is a privacy leak.

Load-bearing premise

For the shredding condition, the 'informed' ASR attacker is not actually informed: the authors apply the original model without fine-tuning on shredded audio, and the proposed reconstruction attack that would rearrange fixed-length blocks is never implemented — if a determined attacker can partially undo the shuffling, the reported shredding protection is overstated.

What would settle it

Fine-tune the general ASR on shredded digit audio (or implement the block-rearrangement reconstruction and then fine-tune), and measure DRER on shredded single and concatenated digits; if the error rate drops substantially below the paper's reported values, its conclusion that shredding protects digit sequences does not hold for truly informed attackers.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • Privacy evaluations of speech obfuscation must include task-specific attackers and metrics, not just WER on read speech, or they will overestimate protection of numeric content.
  • Obfuscation methods like temporal smoothing that appear to protect read speech can leave single spoken digits recognizable by a simple ten-class model with near-original accuracy.
  • Concatenated digit strings (as in phone numbers) are substantially easier for a general ASR to recover than isolated digits, so speech-rate and context effects should be part of privacy benchmarks.
  • Because the DNN's time-averaged features make block shuffling invisible, shredding offers no protection against attackers relying on global spectral statistics, an insight that extends to other short, fixed-vocabulary utterances.
  • Comparisons among obfuscation techniques are attacker-dependent: the method that looks best against a general ASR may be the worst against a task-specific DNN, so no single metric can rank privacy solutions.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • A direct extension would be to test multi-digit numbers and accented or disfluent speech, since the closed ten-class vocabulary likely underestimates real-world difficulty.
  • The oracle-boundary assumption for segmenting digit sequences means real attackers must first locate digit segments; integrating a voice-activity or keyword-spotting front-end would test how segmentation errors change the privacy picture.
  • The shredding result suggests that any lossy transform preserving global statistics is weak against statistics-based classifiers; this could generalize to short entities like yes/no commands, which deserve explicit testing.
  • If task-specific metrics become standard, privacy-preserving speech systems may need to obfuscate the specific entities (digits, PINs, names) rather than generic intelligibility — a design shift the paper motivates but does not pursue.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. This paper proposes a task-specific evaluation of speech privacy for digit content, comparing the standard WER on read speech against a digit recognition error rate (DRER) on single and concatenated digits. Three lightweight obfuscation methods are tested: temporal smoothing with subsampling, resampling, and sound shredding. Two attacker models are considered: a general-purpose ASR system, fine-tuned on obfuscated data for smoothing and resampling, and a small DNN operating on mean/variance MFCC features. Using LibriSpeech, AudioMNIST, and Google Speech Commands, the authors report that the DNN recognizes obfuscated single digits better than ASR, while ASR benefits from sequence context, leading to the conclusion that task-specific metrics provide a more practically relevant privacy assessment than WER alone.

Significance. The paper addresses a real gap: WER on read speech may not capture the risk for short, high-value entities such as digits. The use of task-specific attack models, bootstrap confidence intervals, and public datasets and code is a methodological strength. If the shredding arm were valid, the conclusion would support moving toward task-specific evaluations; the DNN result on single digits is a concrete demonstration that a simple task-specific model can pose a threat under certain obfuscations. However, the shredding evaluation currently fails the paper's own informed-attacker definition, and the concatenated-digit DNN result is confounded by invalid segmentation, so the comparative claims involving shredding in Figures 2 and 3 are not reliable.

major comments (3)
  1. [§2.2, Table 1, Figures 2] The shredding ASR attack does not meet the paper's own definition of an informed attacker. Section 1 states that an informed attacker 'trains or finetunes models on obfuscated data [22]', yet for shredding the authors apply the original LibriSpeech ASR without adaptation. The justification that an informed attacker 'would potentially try to rearrange the fixed-length blocks' describes a reconstruction attack that is never implemented or measured. As a result, the shredding DRERs/WERs may overstate privacy protection, and the comparisons across methods in Figures 2 are between attackers with unequal information. Either implement and evaluate the rearrangement/reconstruction attack, or explicitly label the shredding condition as a non-informed baseline and adjust the conclusions.
  2. [§2.3, §3.2, Figure 3b] The oracle segmentation is invalid for shredded concatenated digit sequences unless the shredding randomization is applied within each digit. The text says the obfuscated sequences were segmented using oracle signal boundaries from the original signal. If, as §2.1 implies, shredding permutes fixed-length blocks over the whole sequence, those boundary timestamps no longer align with digit boundaries in the shredded signal; each segment then contains fragments of multiple digits and silences. The near-chance DNN DRER for shredded sequences is therefore an artifact of the segmentation procedure, not evidence about shredding. Specify the randomization scope and, if global, re-segment the shredded signal or drop these results.
  3. [§3.2, Figure 3a] The statement that 'shredding has no impact on the recognition of single digits' is a direct mathematical consequence of the DNN input features (mean and variance of MFCCs over time), which are invariant to block permutation, rather than an empirical attack outcome. The subsequent broader claim that shredding is 'entirely ineffective against this class of attacker model' should be framed as a limitation of permutation-invariant features, not as a general privacy finding. This is acknowledged in the text but the interpretation goes beyond the evidence.
minor comments (4)
  1. [Abstract, §3.2] The word 'significant'/'significantly' is used without any statistical significance test. Since only bootstrap confidence intervals are reported, either add formal tests (e.g., paired bootstrap or permutation tests with multiple-comparison correction) or rephrase to 'substantial'.
  2. [Table 1] The column header '80 Mel [14]' is unclear; it appears to be an additional smoothing configuration but is not explained in §2.1. Please clarify the parameter values and which column corresponds to which configuration.
  3. [References] References [17] and [24] are the same LibriSpeech corpus paper and should be merged.
  4. [§3.1] The observation that DRER is consistently lower than WER is partly by construction, because DRER ignores insertion errors. Consider stating this explicitly when interpreting the metric comparison.

Circularity Check

0 steps flagged

No significant circularity: the empirical comparisons are self-contained, and the few self-citations are non-load-bearing.

full rationale

The paper reports an experimental evaluation rather than a derivation chain. The two attacker models (ASR and DNN) are trained on external public datasets (LibriSpeech, AudioMNIST, Google Speech Commands) and evaluated on held-out speakers, so no fitted parameter is relabeled as a prediction. The DRER metric is newly defined and applied consistently; the fuzzy-matching threshold is a stated, fixed hyperparameter reported alongside exact matching. The only self-citations ([14], [15]) provide the implementations of temporal smoothing and resampling and baseline WER values; these are tools for the experiment, not load-bearing support for the paper's conclusion. The paper does acknowledge a strategic choice in the shredding attack (applying the original ASR model rather than fine-tuning), which is a methodological limitation or potential inconsistency, but it is not circular. No claim reduces to its own input by definition, and no uniqueness or ansatz is imported from prior work by the same authors. The central finding—that task-specific digit recognition reveals different privacy outcomes than read-speech WER—is an empirical observation grounded in independent training and test data.

Axiom & Free-Parameter Ledger

1 free parameters · 4 axioms · 0 invented entities

The paper makes no theoretical derivation; its claims rest on experimental assumptions about attacker models, dataset construction, and the DNN feature representation. The fuzzy-match threshold is the only hand-set scalar that affects a reported metric. No new physical or conceptual entities are postulated.

free parameters (1)
  • Fuzzy-matching Levenshtein threshold = 2
    Section 2.4: hand-set threshold for the fuzzy DRER, motivated by a preliminary analysis of common ASR confusions; reported alongside the stricter exact DRER. It affects one metric variant but not the central conclusions.
axioms (4)
  • domain assumption An informed attacker has complete knowledge of the obfuscation technique and its parameters and trains or fine-tunes models on obfuscated data.
    Stated in Section 1 and adopted from [22]; defines the attack scenario and justifies fine-tuning, but is not applied consistently for shredding (Section 2.2 uses the original ASR).
  • domain assumption A DNN operating on the mean and variance of MFCCs is a representative strong task-specific attacker for digit recognition.
    Section 2.2: this feature choice is what makes shredding appear completely ineffective for single digits (Section 3.2), so the conclusion depends on this representation being a meaningful attacker model.
  • domain assumption Concatenating ten digits from the same speaker with inserted silences simulates realistic digit sequences such as phone numbers.
    Section 2.3: used to study speech-rate effects; results may not transfer to natural connected-digit speech with coarticulation and disfluencies.
  • ad hoc to paper For shredding, an informed attacker would attempt block rearrangement, so the original ASR model is an appropriate attack model.
    Section 2.2: this untested assumption breaks the otherwise consistent informed-attacker setup and affects the comparability of shredding results with the other two obfuscation methods.

reviewed 2026-08-01 · how reviews work

0 comments
Cite this review

Pith. "Pith review of From Read Speech to Spoken Digits: A Task-Specific Evaluation of Speech Privacy With Informed Attackers." pith.science (2026). https://pith.science/paper/XWKCRXV4

@misc{pith2026260721393,
  author       = {Pith},
  title        = {Pith review of: From Read Speech to Spoken Digits: A Task-Specific Evaluation of Speech Privacy With Informed Attackers},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/XWKCRXV4}},
  note         = {Machine review of arXiv:2607.21393}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

Protecting speech privacy in real-life audio recordings is a growing concern. This contribution evaluates the effectiveness of three obfuscation techniques in protecting linguistic speech content, using digit recognition as a task-specific and practically motivated evaluation scenario. As a first baseline, a general-purpose speech recognition model and a digit-specific classifier were applied as informed attackers to recognise both single digits and concatenated digit sequences. Our experimental results demonstrate significant differences in recognition performance across digit modality, speech rate, and attack model. These findings emphasize the need for more comprehensive and application-oriented evaluation methods to ensure speech privacy.

Figures

Figures reproduced from arXiv: 2607.21393 by Anjana Rajasekhar, Anna Leschanowsky, Joerg Bitzer, Jule Pohlhausen.

Figure 1
Figure 1. Figure 1: WER and DRER with exact and fuzzy matching for in￾formed ASR models on GSC digits [28] and AudioMNIST (AM) [19], evaluated for single and concatenated digits with varying silence durations, across different obfuscation parameters. said, say, so, some, the, there, tim, you) were considered incorrect. The DRER was calculated per speaker as the number of incor￾rectly recognised digits divided by the total num… view at source ↗
Figure 2
Figure 2. Figure 2: compares the different obfuscation techniques for both digit modalities and the influence of speech rate. As ex￾pected, the DRER increases with higher smoothing times τ , lower sampling rates, and lower shredding block lengths, re￾flecting the general trends on LibriSpeech test-clean (cf. Ta￾ble 1). For the original, smoothed, and resampled single digits, the DRER in [PITH_FULL_IMAGE:figures/full_fig_p003… view at source ↗
Figure 3
Figure 3. Figure 3: DRER of DNN models trained on unprotected signals (Orig.) and with temporal smoothing with subsampling (Smooth), resampling (RS), and shredding (Shred). The DNN models were trained and tested on AudioMNIST (AM) [19] and GSC digits [28] for (a) single and (b) concatenated digits with silence durations of 100, 200, and 500 ms. Vertical lines indicate 95 % confidence intervals. the need for evaluating speech … view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

38 extracted references · 4 linked inside Pith

  1. [1]

    Ex- amples include monitoring in smart homes [1] or elder care fa- cilities [2], acoustic surveillance systems [3], and the analysis of social behaviour [4]

    Introduction In many areas of everyday life, audio recordings have become an integral part of data collection and automated analysis. Ex- amples include monitoring in smart homes [1] or elder care fa- cilities [2], acoustic surveillance systems [3], and the analysis of social behaviour [4]. In particular, speech recordings con- stitute a rich source of pe...

  2. [2]

    Experimental setup Experiments were performed on two Nvidia RTX 3090 Ti GPU and one Intel Alder Lake CPU, based on the open-source arXiv:2607.21393v1 [eess.AS] 23 Jul 2026 Table 1:Total WER in % on LibriSpeech test-clean [24]: Tested with informed ASR models for temporal smoothing and resampling, while the original ASR model was applied for shredding. Ori...

    Pith/arXiv arXiv 2026

  3. [3]

    ASR-based attack models The comparison of evaluation metrics in Figure 1 reveals that the DRER is consistently lower than the WER, since it ignores in- sertion errors

    Results and discussion 3.1. ASR-based attack models The comparison of evaluation metrics in Figure 1 reveals that the DRER is consistently lower than the WER, since it ignores in- sertion errors. This difference remains stable for single (cf. pur- ple and blue dots) and concatenated digits, as the insertion rate is similar for both modalities at higher ob...

  4. [4]

    Conclusions This article analysed the recognition of single and concatenated digits against informed attacker models. The superior perfor- mance of the task-specific DNN on single digits highlights that even simple attack models pose a substantial privacy threat un- der optimal conditions, underscoring the importance of consid- ering a diverse range of in...

  5. [5]

    Acknowledgements This work was supported by the Graduation program of Jade University of Applied Sciences (Jade2Pro 2.0)

  6. [6]

    After using these tools, the authors reviewed and edited the content as required and take full responsibility for the content of the publication

    Generative AI Use Disclosure During the manuscript preparation, the authors used AI-assisted writing tools in order to improve language and readability. After using these tools, the authors reviewed and edited the content as required and take full responsibility for the content of the publication

  7. [7]

    European Parliament and Council, “Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 Apr. 2016 on the Protection of Natural Persons With Regard to the Processing of Personal Data and on the Free Movement of Such Data, and Repealing Directive 95/46/EC (General Data Protection Regula- tion),” 2016

    2016

  8. [8]

    V oice ac- tivity detection driven acoustic event classification for monitoring in smart homes,

    D. Hollosi, J. Schr ¨oder, S. Goetze, and J.-E. Appell, “V oice ac- tivity detection driven acoustic event classification for monitoring in smart homes,” inProc. Int. Symp. Appl. Sci. Biomed. Commun. Technol. (ISABEL), 2010, pp. 1–5

    2010

  9. [9]

    Real-time acoustic scene recognition for elderly daily routines using edge-based deep learning,

    H. Yang, R. Dong, R. Guo, Y . Che, X. Xie, J. Yang, and J. Zhang, “Real-time acoustic scene recognition for elderly daily routines using edge-based deep learning,”Sensors, vol. 25, no. 6, p. 1746, 2025

    2025

  10. [10]

    Scream and gunshot detection and localization for audio-surveillance systems,

    G. Valenzise, L. Gerosa, M. Tagliasacchi, F. Antonacci, and A. Sarti, “Scream and gunshot detection and localization for audio-surveillance systems,” inProc. IEEE Conf. Adv. Video Sig- nal Based Surveill. (AVSS), 2007, pp. 21–26

    2007

  11. [11]

    The Electronically Activated Recorder (EAR): A Method for the Naturalistic Observation of Daily Social Behav- ior,

    M. R. Mehl, “The Electronically Activated Recorder (EAR): A Method for the Naturalistic Observation of Daily Social Behav- ior,”Curr. Dir. Psychol. Sci., vol. 26, no. 2, pp. 184–190, 2017

    2017

  12. [12]

    Preserving privacy in speaker and speech characterisation,

    A. Nautsch, A. Jim ´enez, A. Treiber, J. Kolberg, C. Jasserand, E. Kindt, H. Delgado, M. Todisco, M. A. Hmani, A. Mtibaa, M. A. Abdelraheem, A. Abad, F. Teixeira, D. Matrouf, M. Gomez- Barrero, D. Petrovska-Delacr´etaz, G. Chollet, N. Evans, T. Schnei- der, J.-F. Bonastre, B. Raj, I. Trancoso, and C. Busch, “Preserving privacy in speaker and speech charac...

    2019

  13. [13]

    Revisiting speech content privacy,

    J. Williams, J. Yamagishi, P.-G. No ´e, C. V . Botinhao, and J.-F. Bonastre, “Revisiting speech content privacy,” inProc. Conf. of Int. Speech Commun. Assoc. (INTERSPEECH), 2021, pp. 42–46

    2021

  14. [14]

    Towards privacy- preserving conversation analysis in everyday life: Exploring the privacy-utility trade-off,

    J. Pohlhausen, F. Nespoli, and J. Bitzer, “Towards privacy- preserving conversation analysis in everyday life: Exploring the privacy-utility trade-off,”Comput. Speech and Language, vol. 95, p. 101823, 2026

    2026

  15. [15]

    The V oicePrivacy 2020 Challenge: Results and findings,

    N. Tomashenko, X. Wang, E. Vincent, J. Patino, B. M. L. Srivas- tava, P.-G. No´e, A. Nautsch, N. Evans, J. Yamagishi, B. O’Brien, A. Chanclu, J.-F. Bonastre, M. Todisco, and M. Maouche, “The V oicePrivacy 2020 Challenge: Results and findings,”Comput. Speech and Language, vol. 74, 2022

    2020

  16. [16]

    ficient utility for tasks such as conversation analysis or audio- based activity recognition

    to conceal linguistic content and simultaneously retain suf- **indicates the corresponding author. ficient utility for tasks such as conversation analysis or audio- based activity recognition. Such light-weighted methods are particularly relevant for resource-constrained edge devices, such as smart home sensors or wearable recording systems, where privacy...

  17. [17]

    The V oicePrivacy 2022 Challenge: Progress and Perspectives in V oice Anonymisation,

    M. Panariello, N. Tomashenko, X. Wang, X. Miao, P. Champion, H. Nourtel, M. Todisco, N. Evans, E. Vincent, and J. Yamagishi, “The V oicePrivacy 2022 Challenge: Progress and Perspectives in V oice Anonymisation,”IEEE Trans. Audio, Speech, Language Process., vol. 32, pp. 3477–3491, 2024

    2022

  18. [18]

    Exploratory Evaluation of Speech Content Masking,

    J. Williams, K. Pizzi, and P.-G. No ´e, “Exploratory Evaluation of Speech Content Masking,” inProc. ITG Conf. on Speech Commun. VDE, 2023, pp. 215–219

    2023

  19. [19]

    Preech: A system for{Privacy-Preserving}speech transcrip- tion,

    S. Ahmed, A. R. Chowdhury, K. Fawaz, and P. Ramanathan, “Preech: A system for{Privacy-Preserving}speech transcrip- tion,” inProc. USENIX Secur. Symp., 2020, pp. 2703–2720

    2020

  20. [20]

    Privacy in speech technology,

    T. B ¨ackstr¨om, “Privacy in speech technology,”Proc. IEEE, vol. 113, no. 7, pp. 668–692, 2025

    2025

  21. [21]

    Preserving privacy in speaker and speech characterisation,

    A. Nautsch, A. Jim ´enez, A. Treiber, J. Kolberg, C. Jasserand, E. Kindt, H. Delgado, M. Todisco, M. A. Hmani, A. Mtibaaet al., “Preserving privacy in speaker and speech characterisation,”Com- put. Speech and Language, vol. 58, pp. 441–480, 2019

    2019

  22. [22]

    Revisiting the Privacy of Low- Frequency Speech Signals: Exploring Resampling Methods, Eval- uation Scenarios, and Speaker Characteristics,

    J. Pohlhausen and J. Bitzer, “Revisiting the Privacy of Low- Frequency Speech Signals: Exploring Resampling Methods, Eval- uation Scenarios, and Speaker Characteristics,” inProc. Symp. Se- cur. Privacy Speech Commun. (SPSC), 2025, pp. 85–89

    2025

  23. [23]

    Sound shredding: Privacy preserved audio sensing,

    S. Kumar, L. T. Nguyen, M. Zeng, K. Liu, and J. Zhang, “Sound shredding: Privacy preserved audio sensing,” inProc. Int. Work- shop Mobile Comput. Syst. Appl., 2015, pp. 135–140

    2015

  24. [25]

    Automatic speech recognition: Systematic literature review,

    S. Alharbi, M. Alrazgan, A. Alrashed, T. Alnomasi, R. Almojel, R. Alharbi, S. Alharbi, S. Alturki, F. Alshehri, and M. Almo- jil, “Automatic speech recognition: Systematic literature review,” IEEE Access, vol. 9, pp. 131 858–131 876, 2021

    2021

  25. [26]

    AudioMNIST: Exploring explainable artificial intelligence for audio analysis on a simple benchmark,

    S. Becker, J. Vielhaben, M. Ackermann, K.-R. M ¨uller, S. La- puschkin, and W. Samek, “AudioMNIST: Exploring explainable artificial intelligence for audio analysis on a simple benchmark,” J. Franklin Inst., vol. 361, no. 1, pp. 418–428, 2024

    2024

  26. [27]

    Spoken digit recognition using wavelet scalogram and convolutional neural networks,

    R. V . Sharan, “Spoken digit recognition using wavelet scalogram and convolutional neural networks,” inProc. IEEE Recent Adv. Intell. Comput. Syst. (RAICS), 2020, pp. 101–105

    2020

  27. [28]

    When sub-band features meet atten- tion mechanism while knowledge distillation for sound classifica- tion,

    A. M. Tripathi and K. Paul, “When sub-band features meet atten- tion mechanism while knowledge distillation for sound classifica- tion,”Appl. Acoust., vol. 195, p. 108813, 2022

    2022

  28. [29]

    Evaluating V oice Conversion- Based Privacy Protection against Informed Attackers,

    B. M. L. Srivastava, N. Vauquier, M. Sahidullah, A. Bellet, M. Tommasi, and E. Vincent, “Evaluating V oice Conversion- Based Privacy Protection against Informed Attackers,” inProc. IEEE Int. Conf. on Acoust., Speech and Signal Process. (ICASSP), 2020, pp. 2802–2806

    2020

  29. [30]

    SpeechBrain: A General-Purpose Speech Toolkit,

    M. Ravanelli, T. Parcollet, P. Plantinga, A. Rouhe, S. Cornell, L. Lugosch, C. Subakan, N. Dawalatabad, A. Heba, J. Zhong, J.-C. Chou, S.-L. Yeh, S.-W. Fu, C.-F. Liao, E. Rastorgueva, F. Grondin, W. Aris, H. Na, Y . Gao, R. D. Mori, and Y . Ben- gio, “SpeechBrain: A General-Purpose Speech Toolkit,”arXiv preprint arXiv:2106.04624, 2021

    Pith/arXiv arXiv 2021

  30. [31]

    Librispeech: An ASR corpus based on public domain audio books,

    V . Panayotov, G. Chen, D. Povey, and S. Khudanpur, “Librispeech: An ASR corpus based on public domain audio books,” inProc. IEEE Int. Conf. on Acoust., Speech and Signal Process. (ICASSP), 2015, pp. 5206–5210

    2015

  31. [32]

    Privacy-aware acoustic as- sessments of everyday life,

    J. Bitzer, S. Kissner, and I. Holube, “Privacy-aware acoustic as- sessments of everyday life,”J. Audio Eng. Soc. (AES), vol. 64, no. 6, pp. 395–404, 2016

    2016

  32. [33]

    TorchAudio 2.1: Advancing Speech Recognition, Self- Supervised Learning, and Audio Processing Components for Py- torch,

    J. Hwang, M. Hira, C. Chen, X. Zhang, Z. Ni, G. Sun, P. Ma, R. Huang, V . Pratap, Y . Zhang, A. Kumar, C.-Y . Yu, C. Zhu, C. Liu, J. Kahn, M. Ravanelli, P. Sun, S. Watanabe, Y . Shi, and Y . Tao, “TorchAudio 2.1: Advancing Speech Recognition, Self- Supervised Learning, and Audio Processing Components for Py- torch,” inProc. IEEE Autom. Speech Recognit. Un...

    2023

  33. [34]

    Audio MNIST digit vocal recognition,

    P. Bacher, “Audio MNIST digit vocal recognition,” Com- puter software, https://www.kaggle.com/code/paulbacher/ audio-mnist-digit-vocal-recognition, 2022

    2022

  34. [35]

    Speech commands: A dataset for limited-vocabulary speech recognition,

    P. Warden, “Speech commands: A dataset for limited-vocabulary speech recognition,”arXiv preprint arXiv:1804.03209, 2018

    Pith/arXiv arXiv 2018

  35. [36]

    Phone number length by coun- try 2026,

    World Population Review, “Phone number length by coun- try 2026,” https://worldpopulationreview.com/country-rankings/ phone-number-length-by-country, [Accessed 22-02-2026]

    2026

  36. [37]

    Binary codes capable of correcting deletions, insertions, and reversals,

    V . I. Levenshtein, “Binary codes capable of correcting deletions, insertions, and reversals,” inSov. Phys.-Dokl., vol. 10, no. 8, 1966, pp. 707–710

    1966

  37. [38]

    Good practices for evaluation of machine learning systems,

    L. Ferrer, O. Scharenborg, and T. B ¨ackstr¨om, “Good practices for evaluation of machine learning systems,” 2024. [Online]. Available: https://arxiv.org/abs/2412.03700

    Pith/arXiv arXiv 2024

  38. [39]

    Analysis of speech temporal dynamics in the context of speaker verification and voice anonymization,

    N. Tomashenko, E. Vincent, and M. Tommasi, “Analysis of speech temporal dynamics in the context of speaker verification and voice anonymization,” inProc. IEEE Int. Conf. on Acoust., Speech and Signal Process. (ICASSP), 2025, pp. 1–5

    2025

This paper was first reviewed by deepseek-v4-flash on August 1, 2026.