Pith. sign in

REVIEW 4 major objections 4 minor 38 references

Multi-Level Privacy-Preserving Dementia Detection from Speech via Targeted Adversarial Obfuscation and Representation Learning

T0 review · 4 major / 4 minor · reviewed 2026-08-01 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Speech recordings for dementia screening can be anonymized against both transcription and speaker-identification eavesdroppers while retaining diagnostic prosodic information, the paper argues, reporting near-chance speaker identification a

desk verdict The multi-level architecture is sensible, but the headline privacy-utility claim collapses on its own tables and a likely participant leak in the split. read the letter →

arxiv 2607.17098 v1 pith:32J2UQQM submitted 2026-07-19 cs.SD cs.CR

Henriette Flore Kenne , Raphael Anaadumba , Mohammad Arif Ul Alam This is my paper · ORCID
classification cs.SDcs.CR
keywords privacy-preservingspeechanalysisdementiadetectionadversarialobfuscationspeakeranonymizationgradientreversallayermutualinformationautomaticrecognitioncorruptionBank
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish a practical privacy–utility trade-off for speech-based dementia detection: a two-level defense can strip away speaker identity and transcript content from clinical voice recordings without destroying the prosodic cues that reveal cognitive decline. At the signal level, a Cumulative Signal Attack (CSA) concentrates adversarial perturbations in keyword-aligned regions to drive automatic speech recognition to a 100% word error rate while leaving low-frequency prosodic structure intact. At the feature level, a Gradient Reversal Layer combined with mutual-information-guided noise injection suppresses speaker-discriminative embedding dimensions while protecting dimensions most relevant to dementia. On the DementiaBank Pitt corpus, the framework reports near-chance speaker identification (EER = 0.59, F1 = 0.003) and fully corrupted transcripts (WER = 1.00), while dementia classification holds at F1 = 0.78–0.79 and AUC = 0.86. If confirmed, this would allow clinical speech data to be shared more freely without exposing patient identity or conversation content.

What carries the argument

The framework hinges on two coupled mechanisms. The Cumulative Signal Attack (CSA) is a perturbation-shaping technique: it partitions the waveform into patches, retains only patches within keyword-aligned time windows, and applies discrete-time cumulative integration (a running sum) to produce low-frequency-dominated noise that maximizes ASR transcription error while minimizing perceptual degradation of prosodic cues. The feature-level mechanism combines a Gradient Reversal Layer (GRL)—which flips gradient signs during backpropagation to make the shared representation useless for speaker classification—with mutual-information-guided noise injection, which computes per-dimension mutual inform

What would settle it

Run the identical pipeline on a speaker-disjoint split of the same DementiaBank Pitt corpus, ensuring no participant contributes recordings to both training and test. If speaker identification EER falls well below 0.5 or dementia F1 drops substantially below 0.78, the claimed privacy–utility trade-off does not hold for real-world re-identification risk.

Watch

Extended reading notes

Core claim

The central claim is that a multi-level obfuscation pipeline can simultaneously neutralize two eavesdropping vectors on clinical speech: machine transcription and speaker re-identification. The signal-level CSA attack shapes adversarial noise through a cumulative integration operator, applying energy only to patches aligned with semantically informative keywords, which forces a surrogate ASR model (Wav2Vec2) to misdecode while preserving the low-frequency prosodic features used for dementia assessment. The feature-level stage then takes the obfuscated waveform's ECAPA-TDNN speaker embeddings and prosodic descriptors, passes them through a shared encoder with a gradient reversal layer to conf

Load-bearing premise

The evaluation assumes the stratified 80/20 split does not place recordings of the same participant in both the training and test sets, but the paper never specifies a speaker- or participant-disjoint split; if the same person's voice appears on both sides, the reported speaker-privacy and dementia-classification metrics are inflated.

Editorial extensions

If this is right

  • If the trade-off survives speaker-disjoint evaluation, clinical speech databases could be shared for research without requiring consent for raw voice data, easing HIPAA and GDPR compliance.
  • The CSA perturbation's concentration in keyword-aligned regions suggests that semantic content can be selectively destroyed while keeping prosodic rhythm and disfluency markers intact, which could extend to other prosody-sensitive clinical tasks.
  • The mutual-information dimension selection offers a tunable privacy knob: adjusting the preserved percentage (10–30%) lets a data custodian choose a point on the privacy–utility curve without retraining.
  • Because the obfuscation is irreversible, the protected waveform is the final artifact; downstream systems would need to work with the anonymized audio, meaning the method is compatible with but does not require a secure enclave or re-identification infrastructure.
  • Reported robustness against gradient-inversion and multi-stage attacks suggests the defense may hold even when an adversary knows the obfuscation strategy, which is relevant for adversarial threat modeling in clinical AI.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The most consequential untested assumption is the data split: DementiaBank Pitt contains multiple Cookie Theft recordings per participant, and the paper does not state a speaker-disjoint partition. A speaker-disjoint evaluation is the natural next experiment; if the same participant's voice appears in both training and test, both the speaker-privacy and dementia-accuracy numbers could be inflated.
  • Privacy is demonstrated only against two specific recognizers (Whisper for ASR and an ECAPA-TDNN-based speaker system). A broader threat model would test against alternative ASR models, speaker verification backends, and human listening, since the reported negative SNR suggests the perturbation is audible and may not fool all eavesdroppers.
  • The mutual-information selection could be adapted to a continuous trade-off slider in a real deployment, but the paper leaves open how the preservation ratio interacts with different datasets or recording conditions.
  • Because the method preserves only four coarse prosodic features, it may be less useful for fine-grained cognitive assessments that rely on richer acoustic or lexical information; extending the prosodic feature set might narrow the privacy–utility gap.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The manuscript proposes a multi-level privacy-preserving framework for speech-based dementia detection. At the signal level, a Cumulative Signal Attack (CSA) perturbs keyword-aligned waveform regions to make ASR transcription fail (WER = 1.00) while preserving prosody. At the feature level, a Gradient Reversal Layer (GRL) with mutual-information-guided noise injection suppresses speaker-discriminative dimensions in ECAPA-TDNN embeddings. The framework is evaluated on the DementiaBank Pitt Corpus, with the central claim that it achieves near-chance speaker identification (EER = 0.59, F1 = 0.003) while retaining dementia classification performance (F1 = 0.78, AUC = 0.86), and that it outperforms single-stage privacy baselines.

Significance. The problem is timely and important: speech-based dementia detection carries dual-use risks of speaker re-identification and transcript leakage. The two-level design (signal-level CSA plus feature-level GRL/MI) is a constructive and original combination, and the paper supplies a full implementation and a broad set of audio-quality, privacy, and utility metrics. If the results were reliable, this would be a useful step toward privacy-preserving clinical speech analytics. However, as presented, the empirical foundation is internally inconsistent and the evaluation protocol is not demonstrably participant-disjoint. The claimed significance is therefore not currently established.

major comments (4)
  1. [Abstract; §5.1; §5.3] The headline speaker-privacy numbers are mutually inconsistent. The abstract reports speaker F1 = 0.003 and EER = 0.59; Table 1 (ADV + PRIV row) reports speaker F1 = 0.22 and EER = 0.54; Table 3 reports speaker F1 = 0.0033 and EER = 0.4979. This is not a rounding artifact: F1 = 0.22 and F1 = 0.003 differ by a factor of ~70. The paper must specify one reproducible evaluation protocol and report a single, consistent set of headline metrics. As written, the central empirical claim is not well-defined.
  2. [§4 (Dataset and Metrics)] The 80/20 split is described only as 'stratified'. DementiaBank Pitt contains multiple Cookie Theft recordings per participant; the paper never states that recordings of the same participant are confined to one split. If same-participant recordings appear in both training and test sets, the dementia F1/AUC are inflated because the model can exploit stable per-speaker voice/prosody, and the speaker-ID evaluation becomes an easier re-identification of seen speakers. A participant-disjoint split (e.g., grouped by participant ID) is mandatory, and all reported numbers must be regenerated under that protocol.
  3. [§5.1; Table 6] The claim that ADV + PRIV achieves the 'best privacy-utility trade-off' is contradicted by the paper's own baseline. Frequency masking reaches speaker F1 = 0.00 with dementia F1 = 0.77, whereas ADV + PRIV has speaker F1 = 0.22 with dementia F1 = 0.79. On the primary privacy axis, the frequency-masking baseline is strictly better, with only a small utility drop. No confidence intervals or significance tests are provided for the headline comparison, so the central superiority claim is unsupported by the evidence in the manuscript.
  4. [§3.2–3.3; §5.3] The privacy evaluation is partly self-referential. ECAPA-TDNN embeddings are used both as the representation that the GRL/MI pipeline is trained to suppress and as the input to the RBF-SVM that measures speaker F1/EER. It is expected that a representation-learning method trained adversarially against a specific embedding model will reduce that model's accuracy; this does not establish generalizable protection against other speaker recognizers. The threat model should include at least one held-out speaker-embedding architecture, or the claims must be limited to the specific evaluated recognizers.
minor comments (4)
  1. [Table 3] The row 'Human (ASR)' is inconsistent with the threat model in §2.2, where ASR is attributed to a machine eavesdropper and the human eavesdropper is linked to speaker recognition. Please align the terminology.
  2. [§5.1] 'dementia F1 = 0.79' is repeated twice in the same sentence; remove the duplication.
  3. [§4 (Hyperparameters)] The hyperparameter section reports grid search but does not specify the selection criterion for speaker suppression; WER and STOI are mentioned for CSA, but the metric used to choose α, λ, preservation ratio, and noise scale is not stated.
  4. [Table 2] The claim that STOI 0.76–0.84 indicates retained intelligibility should be nuanced: STOI was designed for ordinary noise, not adversarial perturbations, and the negative SNR/SI-SDR values indicate clearly audible distortion.

Circularity Check

1 steps flagged · score 4.0 of 10

Privacy evaluation is self-referential: the defense is optimized on and then scored against the same ECAPA-TDNN embeddings, so the near-chance speaker F1 partly restates the training objective; the CSA/WER and dementia-utility chains are independent.

  1. fitted input called prediction [Section 3.3 (Mutual Information-Guided Noise Injection, Eq. 9) and Section 4 (Metrics/Privacy evaluation)]
    "The top 20% of dimensions by MI score are preserved; the remaining 80% receive additive Gaussian noise: ˜Zij = ( Zij, j ∈ ImportantDims ; Zij + ϵij, otherwise ... The resulting embedding vectors are used exclusively for privacy evaluation: we assess how well a supervised classifier can recover speaker identity from the obfuscated representations ... Privacy evaluation employed Whisper [27] for ASR and an RBF-SVM for speaker identification."

    The feature-level defense operates on a vector that 'combines ECAPA-TDNN embeddings and prosodic features' (Sec. 3.3), and Eq. (9) directly corrupts all but the top-20% MI dimensions of that representation. The paper then measures speaker privacy by training an RBF-SVM on the same ECAPA-TDNN embeddings (Sec. 3.2, Sec. 4). Thus the reported near-chance speaker F1/EER is primarily the direct effect of the MI-noise/GRL objective on the exact features being scored; it is a restatement of the optimization target, not an independent test of re-identification risk against a distinct representation. The dementia-utility and WER results are not part of this loop, so the circularity is partial rather than total.

full rationale

The paper contains no self-citation chain and no equation-level derivation that reduces to its own inputs. The CSA/WER result is an adversarial-transfer outcome (optimizing a wav2vec2 surrogate and measuring Whisper WER), and the dementia-detection utility is evaluated on prosodic features/classifiers that are separate from the privacy-optimization target; these are not circular. The one substantive circularity concern is the privacy evaluation: the defense is explicitly designed to suppress speaker identity in ECAPA-TDNN embeddings via GRL and MI-guided noise (Eq. 8-9), and the 'eavesdropper' is an RBF-SVM trained on those same ECAPA-TDNN embeddings. Consequently, the headline privacy numbers (speaker F1 ≈ 0.003, EER ≈ 0.5) largely measure whether the defense succeeded at its own objective on the chosen representation, rather than demonstrating privacy against a genuinely independent or unseen representation. This is a partial, evaluation-level circularity, not a derivation-level one. Additional concerns noted in review—possible same-participant leakage in the 80/20 split, conflicting headline numbers across Abstract/Table 1/Table 3, and a frequency-masking baseline matching the proposed method—are correctness and reporting risks, not circularity per se, and do not change the partial-circularity score.

Assumptions & free parameters 8 free parameters · 5 assumptions · 0 invented entities

The framework introduces no new physical entities. Its empirical claims rest on several tuned hyperparameters and domain assumptions about which acoustic features survive the attack, and whether the evaluation split and external ASR/speaker models faithfully model eavesdroppers.

free parameters (8)
  • ℓ∞ perturbation bound ϵ = 0.01
    Grid-searched over {0.005, 0.01, 0.02} on validation to jointly maximize WER and STOI; directly controls obfuscation strength.
  • PGD step size α = 0.01
    Grid-searched over {0.005, 0.01, 0.02}; selected with ϵ and iterations.
  • PGD iterations I = 100
    Grid-searched over {50, 100, 200}; final setting achieves WER=1.0 with STOI≥0.76.
  • patch size p = 5
    Chosen as part of the final configuration; defines temporal granularity of CSA shaping.
  • prosody-speaker trade-off α = 0.5
    Grid-searched over {0.3, 0.5, 0.7}; balances Lprosody and LGRL in Eq. 8.
  • GRL coefficient λ schedule = 2.0→1.0
    Tuned among {1, 2, 3}; scheduled λ affects speaker-gradient reversal strength.
  • MI preservation ratio = 20% (top 20% preserved, 80% noised)
    Evaluated over {10%, 20%, 30%}; 20% reported best privacy-utility balance.
  • MI noise scale σ = 0.6 × empirical std
    Evaluated over {0.4, 0.6, 0.8}; 0.6 selected for best privacy-utility balance.
assumptions (5)
  • domain assumption Four prosodic descriptors (mean F0, mean intensity, pause count, articulation rate) are sufficient to detect dementia after heavy waveform perturbation.
    Inherited from prior literature and used as the utility signal; if these features do not survive CSA or do not carry diagnostic information, dementia F1 collapses.
  • domain assumption ECAPA-TDNN embeddings trained on VoxCeleb capture the speaker identity an eavesdropper would recover.
    Privacy evaluation measures suppression of this pretrained embedding only; real eavesdroppers could use other representations or human perception.
  • domain assumption CTC-targeted perturbation optimized on Wav2Vec2 transfers to Whisper and measures semantic obfuscation.
    WER=1.00 is reported against Whisper, but the attack is optimized on Wav2Vec2; transfer to all ASR systems is assumed.
  • domain assumption The stratified 80/20 utterance split is representative and free of participant leakage.
    Paper does not state a speaker- or participant-disjoint split; if recordings from the same participant appear in train and test, the reported trade-off is not representative.
  • standard math Standard PGD, GRL, and mutual-information estimation machinery is valid.
    Background algorithmic components are taken as given.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Multi-Level Privacy-Preserving Dementia Detection from Speech via Targeted Adversarial Obfuscation and Representation Learning." pith.science (2026). https://pith.science/paper/32J2UQQM

@misc{pith2026260717098,
  author       = {Pith},
  title        = {Pith review of: Multi-Level Privacy-Preserving Dementia Detection from Speech via Targeted Adversarial Obfuscation and Representation Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/32J2UQQM}},
  note         = {Machine review of arXiv:2607.17098}
}
read the original abstract

Speech recordings used for dementia detection inherently expose speaker identity, raising critical privacy concerns. Existing methods typically address only singular threats and fail to resolve the privacy--utility trade-off. We propose a multi-level framework designed to neutralize two distinct eavesdropping vectors. At the signal level, a Cumulative Signal Attack (CSA) concentrates perturbations in keyword-aligned regions to maximize transcription error (Word Error Rate WER = 1.00) while preserving vital prosodic biomarkers. At the feature level, a Gradient Reversal Layer (GRL) with Mutual Information (MI)-guided noise injection suppresses speaker-discriminative dimensions while retaining dementia-relevant diagnostic structure. Evaluated on the DementiaBank Pitt Corpus, our framework achieves near-chance speaker identification (Equal Error Rate EER = 0.59, F1 = 0.003) while maintaining strong dementia classification performance (F1 = 0.78, AUC = 0.86).

Figures

Figures reproduced from arXiv: 2607.17098 by the authors.

Figure 1
Figure 1. Overview of the proposed multi-level privacy-preserving framework: target generation and CSA-based signal obfuscation (left), feature extraction via ECAPA-TDNN and Parselmouth (centre), and adversarial MI-guided representation learning with privacy and utility evaluation (right) speaker-discriminative information. For the human eavesdrop￾per scenario, Whisper ASR produces a WER of 1.00 on all obfuscated recordings, … view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

38 extracted references · 3 linked inside Pith

  1. [1]

    Introduction Dementia, including Alzheimer’s disease, is an escalating global health concern, where early detection is essential for timely intervention and improved patient outcomes [1]. Speech analysis has gained attention as a scalable and non-invasive biomarker of cognitive decline, since neurological impairment manifests in measurable changes in pros...

  2. [2]

    Background 2.1. Adversarial Perturbations for Privacy Protection Adversarial perturbations, originally introduced as threats to deep learning models [14, 15], have been repurposed as active privacy mechanisms for speech. By solving xadv = x + ϵ · sign(∇xℓ(x, y)) (1) where x is the input, y the true label, and ϵ the perturba- tion scale. Imperceptible wave...

    arXiv 2026

  3. [3]

    Methods Our framework addresses the dual eavesdropping threat at two levels, as shown in Fig. 1: (1) a signal-level CSA-based ob- fuscation pipeline disrupting ASR transcription in keyword- aligned regions while preserving prosodic biomarkers, and (2) a feature-level adversarial representation learning stage suppressing speaker-discriminative dimensions w...

  4. [4]

    Experiments Dataset. We evaluate our framework on the DementiaBank Pitt Corpus [12, 13], comprising 552 Cookie Theft picture descrip- tion recordings [26] (309 Alzheimer’s disease, 243 healthy con- trols). Manual transcripts are used exclusively for WER-based privacy evaluation. Implementation. Experiments were implemented in PyTorch and conducted on an N...

  5. [5]

    Results 5.1. Comparison with Privacy-Preserving Baselines Table 1 demonstrates our framework over baseline anonymi- sation strategies, where an RBF-SVM serves as the speaker identification classifier. While shuffle-based methods achieve speaker suppression (F1 ≈ 0.05), they do so at an unacceptable utility cost, with dementia F1 collapsing to as low as 0....

  6. [6]

    ,0.002}), fre- quency masking (M = 3Mel bands), and time stretching (τ = 2.5)

    Ablation Study We probe the privacy-utility trade-off against three signal-level baselines: Gaussian noise ( σ ∈ {0.0009, . . . ,0.002}), fre- quency masking (M = 3Mel bands), and time stretching (τ = 2.5). As shown in Table 6, frequency masking achieves the Table 5: Robustness evaluation against adversarial attacks on the Pitt Corpus. Attack Method SR ↓ ...

  7. [7]

    Conclusion This paper proposes a multi-level privacy-preserving frame- work for speech-based dementia detection that jointly addresses machine and human eavesdropping threats. Using CSA-based adversarial obfuscation at the signal level and MI-guided adver- sarial representation learning at the feature level, our framework effectively suppresses both trans...

  8. [8]

    Acknowledgments No funding was received for conducting this study

Show all 38 references
  1. [9]

    Use of Generative AI Disclosure The authors did not use generative artificial intelligence (AI) tools for the generation of scientific content, analysis, results, or conclusions presented in this work

  2. [10]

    Estimation of the global prevalence of dementia in 2019 and forecasted preva- lence in 2050: an analysis for the global burden of disease study 2019,

    GBD 2019 Dementia Forecasting Collaborators, “Estimation of the global prevalence of dementia in 2019 and forecasted preva- lence in 2050: an analysis for the global burden of disease study 2019,” Lancet Public Health , vol. 7, no. 2, pp. e105–e125, Feb. 2022, epub 2022 Jan 6

    2019

  3. [11]

    V oice biomarkers in middle and later adult- hood as predictors of cognitive changes,

    E. Mahon and et. al., “V oice biomarkers in middle and later adult- hood as predictors of cognitive changes,”Frontiers in Psychology, vol. 15, p. 1422376, oct 2024

    2024

  4. [12]

    Speech-based detection of alzheimer’s dis- ease: A survey of ai techniques, datasets and challenges,

    K. Ding and et. al., “Speech-based detection of alzheimer’s dis- ease: A survey of ai techniques, datasets and challenges,” Artifi- cial Intelligence Review, vol. 57, no. 1, pp. 1–28, 2024

    2024

  5. [13]

    Speech pause distribution as an early marker for alzheimer’s disease,

    P. Pastoriza-Dom ´ınguez and et. al., “Speech pause distribution as an early marker for alzheimer’s disease,”Speech Communication, vol. 136, pp. 107–117, 2022

    2022

  6. [14]

    Researchers develop computational tools to safeguard privacy without degrading voice- based cognitive markers,

    Boston University School of Medicine, “Researchers develop computational tools to safeguard privacy without degrading voice- based cognitive markers,” https://www.sciencedaily.com/releases/ 2025/03/250314113805.htm, Mar. 2025, accessed: 2025-05-23

    2025

  7. [15]

    Prosody-driven privacy-preserving de- mentia detection,

    D. Woszczyk and et. al., “Prosody-driven privacy-preserving de- mentia detection,” in Proceedings of Interspeech 2024, 2024

    2024

  8. [16]

    Network information security protection method based on additive gaussian noise and mutual information neural network in cloud computing background,

    Y . Zhong and X. Li, “Network information security protection method based on additive gaussian noise and mutual information neural network in cloud computing background,” Egyptian Infor- matics Journal, vol. 30, p. 100673, 2025

    2025

  9. [17]

    Addressing challenges in speaker anonymization to maintain utility while ensuring privacy of patho- logical speech,

    S. T. Arasteh and et. al., “Addressing challenges in speaker anonymization to maintain utility while ensuring privacy of patho- logical speech,” in Communications Medicine , vol. 4, 2024, p. 182

    2024

  10. [18]

    Differential privacy enabled dementia classification: An exploration of the privacy-accuracy trade-off in speech signal data,

    B. N. Suhas and et. al., “Differential privacy enabled dementia classification: An exploration of the privacy-accuracy trade-off in speech signal data,” in Interspeech 2023, 2023, pp. 346–350

    2023

  11. [19]

    Crowdotic: A privacy-preserving hospital waiting room crowd density estimation with non- speech audio,

    F. Al Hossain and et. al., “Crowdotic: A privacy-preserving hospital waiting room crowd density estimation with non- speech audio,” arXiv preprint arXiv:2309.10280, 2023. [Online]. Available: https://arxiv.org/abs/2309.10280

    2023 arXiv

  12. [20]

    Io-rae: Information-obfuscation reversible ad- versarial example for audio privacy protection,

    J. Zhu and et. al., “Io-rae: Information-obfuscation reversible ad- versarial example for audio privacy protection,” 01 2026

    2026

  13. [21]

    Dementiabank: Theoretical rationale, protocol, and illustrative analyses,

    R. Au and et. al., “Dementiabank: Theoretical rationale, protocol, and illustrative analyses,” American Journal of Speech-Language Pathology, vol. 32, no. 2S, pp. 883–900, 2023

    2023

  14. [22]

    The natural history of alzheimer’s disease. description of study cohort and accuracy of diagnosis,

    J. Becker and et. al., “The natural history of alzheimer’s disease. description of study cohort and accuracy of diagnosis,” Archives of neurology, vol. 51, no. 6, p. 585—594, June 1994

    1994

  15. [23]

    Intriguing properties of neural networks,

    C. Szegedy et al., “Intriguing properties of neural networks,” in ICLR, 2014

    2014

  16. [24]

    Explaining and harnessing adversar- ial examples,

    I. J. Goodfellow and et. al., “Explaining and harnessing adversar- ial examples,” in ICLR, 2015

    2015

  17. [25]

    Audio adversarial examples: Targeted attacks on speech-to-text,

    N. Carlini and D. Wagner, “Audio adversarial examples: Targeted attacks on speech-to-text,” in IEEE S&P Workshops, 2018

    2018

  18. [26]

    Imperceptible, robust, and targeted adversarial ex- amples for automatic speech recognition,

    Y . Qin et al., “Imperceptible, robust, and targeted adversarial ex- amples for automatic speech recognition,” in ICML, 2019

    2019

  19. [27]

    Ecapa-tdnn embeddings for speaker diarization,

    N. Dawalatabad and et. al., “Ecapa-tdnn embeddings for speaker diarization,” in Proceedings of Interspeech 2021. ISCA, 2021, pp. 3560–3564

    2021

  20. [28]

    Model inversion attacks: A survey of ap- proaches and defenses,

    A. Zhou and et. al., “Model inversion attacks: A survey of ap- proaches and defenses,” arXiv preprint arXiv:2411.10023, 2024

    2024

  21. [29]

    On the generation and removal of speaker adversarial examples,

    E. Chen and et. al., “On the generation and removal of speaker adversarial examples,” arXiv preprint arXiv:2412.09195, 2024

    2024 arXiv

  22. [30]

    A speech representation anonymiza- tion framework via selective noise perturbation,

    M. Tran and M. Soleymani, “A speech representation anonymiza- tion framework via selective noise perturbation,” inICASSP 2023 - 2023 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), 2023, pp. 1–5

    2023

  23. [31]

    wav2vec 2.0: a framework for self- supervised learning of speech representations,

    A. Baevski and et. al., “wav2vec 2.0: a framework for self- supervised learning of speech representations,” in Proceedings of the 34th International Conference on Neural Information Pro- cessing Systems, ser. NIPS ’20. Red Hook, NY , USA: Curran Associates Inc., 2020

    2020

  24. [32]

    Introducing parselmouth: A python interface to praat,

    Y . Jadoul, B. Thompson, and B. de Boer, “Introducing parselmouth: A python interface to praat,” Journal of Phonetics, vol. 71, pp. 1–15, 2018. [Online]. Available: https://www. sciencedirect.com/science/article/pii/S0095447017301389

    2018

  25. [33]

    ECAPA-TDNN: Emphasized channel attention, propagation and aggregation in TDNN based speaker verification,

    B. Desplanques and et. al., “ECAPA-TDNN: Emphasized channel attention, propagation and aggregation in TDNN based speaker verification,” in Proc. Interspeech, 2020, pp. 3830–3834

    2020

  26. [34]

    Domain adaptation using a gradient reversal layer with instance weighting,

    K. Osumi and et. al., “Domain adaptation using a gradient reversal layer with instance weighting,” in2019 16th International Confer- ence on Machine Vision Applications (MVA), 2019, pp. 1–5

    2019

  27. [35]

    Performance on the boston cookie theft picture description task in patients with early dementia of the alzheimer’s type: Missing information,

    E. Giles and K. Patterson, “Performance on the boston cookie theft picture description task in patients with early dementia of the alzheimer’s type: Missing information,” Aphasiology, vol. 10, pp. 395–408, 05 1996

    1996

  28. [36]

    Robust speech recognition via large-scale weak supervision,

    A. Radford and et. al, “Robust speech recognition via large-scale weak supervision,” in Proceedings of the 40th International Con- ference on Machine Learning, ser. Proceedings of Machine Learn- ing Research, A. Krause, E. Brunskill, K. Cho, B. Engelhardt, S. Sabato, and J. Sc...

    2023

  29. [37]

    An algorithm for intelligibility prediction of time–frequency weighted noisy speech,

    C. Taal and et. al., “An algorithm for intelligibility prediction of time–frequency weighted noisy speech,” Audio, Speech, and Language Processing, IEEE Transactions on, vol. 19, pp. 2125 – 2136, 10 2011

    2011

  30. [38]

    Perceptual evaluation of speech qual- ity (pesq)-a new method for speech quality assessment of tele- phone networks and codecs,

    A. W. Rix and et. al., “Perceptual evaluation of speech qual- ity (pesq)-a new method for speech quality assessment of tele- phone networks and codecs,” 2001 IEEE International Confer- ence on Acoustics, Speech, and Signal Processing. Proceedings (Cat. No.01CH37221), vol. 2, p...

    2001

Pith tools

Reviewed August 1, 2026 · model on record in the stance chip above.