Pith. sign in

REVIEW 3 major objections 6 minor 53 references

De-AntiFake: Rethinking the Protective Perturbations Against Voice Cloning Attacks

T0 review · 3 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper argues that perturbation-based defenses against voice cloning fail when the attacker first purifies the protected audio, and demonstrates a two-stage purification method that raises speaker-verification acceptance of cloned…

desk verdict First systematic evidence that perturbation-based voice cloning defenses collapse under purification; the proposed two-stage method is plausible and consistently supported, but the key transfer assumption and missing artifacts keep it at conditional rather than accept. read the letter →

arxiv 2507.02606 v1 pith:ET2J2QRW submitted 2025-07-03 cs.SD cs.AIcs.CRcs.LGeess.AS

Wei Fan , Kejiang Chen , Chang Liu , Weiming Zhang , Nenghai Yu This is my paper
classification cs.SDcs.AIcs.CRcs.LGeess.AS
keywords voicecloningprotectiveperturbationsadversarialpurificationspeakerverificationdiffusionmodelphoneme-guidedrefinementprivacyaudioexamples
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Protective perturbations — small, imperceptible amounts of noise added to a person's speech so that voice-cloning models cannot reproduce their voice — are the paper's target. The authors try to establish that these defenses fail under a realistic threat model in which the attacker first purifies the audio and only then runs the cloning model. They build a two-stage purification method, PhonePuRe, that first strips the protective noise with a diffusion model and then uses phoneme-guided diffusion refinement to push the audio back toward the clean-speech distribution. On average across six cloning models and three protection methods, the speaker-verification acceptance of cloned speech rises from about 10% for protected audio to about 71% with x-vector verification and about 82% with d-vector verification. The conclusion the paper argues for is that perturbation-only defenses give users a false sense of security unless purification is part of the threat model.

What carries the argument

The load-bearing mechanism is the two-stage PhonePuRe pipeline. The Purification stage is an unconditional DiffWave diffusion model applied directly to waveforms: it adds noise over $T_{\text{pur}}$ forward steps and then denoises back, which removes most of the protective perturbation but leaves the audio in a 'purified' distribution. The Refinement stage is a score-based diffusion model (NCSN++) operating in the complex STFT domain, trained to map purified clean spectrograms back to their clean versions; at inference it takes the purified protected spectrogram, concatenates a phoneme representation (average magnitude spectrograms per phoneme, aligned from the transcript), and reverse-samples to land closer to the clean distribution. The argument depends on the observation that the purification stage makes purified clean and purified protected samples distributionally similar, so the refinement mapping learned from clean pairs applies to protected inputs. Phoneme guidance carries the content information that protective perturbations leave intact, steadying the refinement.

What would settle it

Take audio protected with a method or perturbation budget outside the tested range (for example a budget below 0.0025, or a file that passed through a telephone or MP3 codec), purify it, apply the refinement, and measure whether speaker-verification acceptance stays near the claimed levels; separately measure the embedding distance between purified clean and purified protected samples. If the distance is large or the acceptance drops toward the protected-only rate, the distributional-transfer assumption that carries the method fails.

Watch

Extended reading notes

Core claim

The central claim is that protective perturbations against voice cloning are not robust to adversarial purification: an attacker who purifies protected audio before cloning can recover most of the target speaker's identity. The paper demonstrates this with PhonePuRe, which combines an unconditional diffusion purification stage with a phoneme-guided score-based diffusion refinement stage that operates on complex spectrograms. The key move is training the refinement only on pairs of original clean audio and its purified version; the authors observe that after the purification stage, clean and protected samples look similar in the voice-cloning model's embedding space, so the clean-to-clean mapping transfers to protected inputs. Across AttackVC, AntiFake, and VoiceGuard, and across three TTS and three voice-conversion models, the average speaker-verification accuracy of cloned speech rises from 9.9% (x-vector) and 10.4% (d-vector) on protected audio to 71.1% and 81.8% after purification. Cloned speech from purified samples is also rated closer to the original speaker by human listeners.

Load-bearing premise

The method rests on the assumption that after the first purification pass, protected audio and clean audio look alike to the voice-cloning model, so a refinement model trained on purified clean audio will also pull purified protected audio back toward clean; if that resemblance breaks for another protection method, perturbation budget, or transmission channel, the second stage stops working.

Editorial extensions

If this is right

  • An attacker who can apply PhonePuRe before cloning can largely undo all three tested protection methods, so the protection success rates reported in the literature are upper bounds that shrink once purification is in the loop.
  • Even white-box adaptive protections — where the protector knows the purification model and uses BPDA or adjoint gradients with expectation over transformation up to size 15 — fail to push the d-vector acceptance below roughly 0.8, so making perturbations purification-proof is much harder than making them cloning-proof.
  • Existing purification baselines leave systematic distortions in voice-cloning embedding spaces; the refinement stage, not extra diffusion steps, is what restores the speaker identity, so coarse purification alone is insufficient for voice-cloning tasks.
  • The best setting of the pipeline depends on the perturbation budget: smaller budgets favor fewer purification steps, and the full two-stage model beats the purification stage alone across every budget and step count tested.
  • If these results hold, future voice-cloning defenses should be evaluated with a purification-capable attacker, otherwise the measured protection rate will overstate real-world safety.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • I infer that the distributional-transfer trick can serve as a predictor: measure the distance between purified clean and purified protected samples for any new protection method, and that gap should forecast whether a refinement stage trained on clean pairs will succeed.
  • I infer that the approach is a general recipe for attacking defenses that rely on small speaker-level perturbations: purify coarsely, then refine with any content signal the perturbation does not destroy, not necessarily phonemes.
  • A natural test the paper leaves open is transmission realism: codecs, telephony, or background noise after purification would add distortions outside the training distribution and may close part of the gap between laboratory success and field success.
  • I infer that the defender's plausible counter-move is to combine perturbation with detection or watermarking, because any defense that a learned purification model can preprocess away offers only conditional protection.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper evaluates whether protective perturbations against voice cloning survive an attacker who applies adversarial purification before cloning. It tests three protections (AttackVC, AntiFake, VoiceGuard) across six voice-cloning (VC) models and several purification baselines, reporting that existing purification substantially raises speaker-verification accuracy of cloned speech. The authors then propose PhonePuRe, a two-stage pipeline: an unconditional DiffWave purification stage followed by a phoneme-guided score-based diffusion refinement stage trained on pairs of clean and purified-clean audio. On a LibriSpeech test-clean set with 25 speakers, PhonePuRe raises average SVA from about 10% under protection to 71.1% (x-vector) and 81.8% (d-vector), outperforming the best baseline (AudioPure) and showing robustness to two white-box adaptive protection strategies.

Significance. If the reported numbers hold, the paper provides a useful negative result: perturbation-only VC defenses are brittle under a realistic purification-equipped attacker, and PhonePuRe is a strong attack-side baseline for future defense work. The evaluation is broad for this line of work—six VC models, three protection methods, multiple purification baselines, objective and subjective metrics, and component ablations—and the paper is candid about some limitations of its own method, including fixed timesteps and the absence of VC-model information in the purification pipeline. The main weakness is evidentiary: the load-bearing transfer assumption behind the Refinement stage is supported only by qualitative embedding-space plots, and the submission does not include code, data, checkpoints, or audio for independent verification, instead pointing to a project page. These issues make the current version a conditional contribution rather than a fully verified one.

major comments (3)
  1. [§4.1, App. A.5, Figure 4] The central quantitative claim depends on the Refinement-stage transfer assumption, and that assumption is validated only qualitatively. The Refinement model is trained on pairs (clean audio, purified clean audio) constructed with T_pur=5 and DEMAND noise augmentation (App. A.5), but at inference it is applied to purified protected audio obtained with T_pur=3. The only evidence that the two input distributions match is Figure 4, which shows closeness in ECAPA/AVC/Coqui embedding spaces; the score model, however, operates on complex STFT spectrograms, and closeness in a task-specific embedding space does not imply closeness in the score model's input space. No quantitative distributional distance, no per-method breakdown, and no per-budget check is reported. If the conditional mapping p(m|m_pur) learned from purified clean data does not transfer to purified protected data, the Refinement stage could move protected samples away from the clean manifold, and the claimed gains over AudioPure in Table 1 would not generalize. Please add quantitative spectral-domain distributional comparisons (e.g., MMD or FID over the relevant STFT representations), validate the Refinement stage separately on purified protected inputs for each protection method and a range of budgets and channels, and either align T_pur between training and inference or justify the mismatch.
  2. [§5.1, §5.2, Table 1] The headline comparison is presented without uncertainty or per-cell sample sizes. The evaluation uses 25 speakers × 5 utterances × 6 VC models, then filters to 739 cloned samples, and each Table 1 cell aggregates over one protection method and one VC model; several cells are therefore based on only about 125 samples or fewer, yet no confidence intervals, significance tests, or standard errors are reported. Some of the claimed advantages over the strongest baseline are small (e.g., AttackVC xSVA 0.750 vs 0.734 for AudioPure in Table 1), so without error bars the reader cannot tell whether the differences are meaningful. Please report per-cell N, confidence intervals, and paired tests (e.g., McNemar) for the key comparisons, especially between PhonePuRe and AudioPure.
  3. [§5.4, App. C, Figure 8] The adaptive-protection robustness claim is narrower than the text suggests. The evaluation covers only the DiffVC model and the AttackVC protection, and the BPDA variant approximates the full purification as identity (following Nie et al. 2022), while the adjoint variant integrates only the Purification stage. The paper itself notes in App. C that stronger adaptive attacks from the vision literature (Kang et al. 2024; Lee & Kim 2023b) were not adapted to speech. The conclusion that designing adaptive protection for this purification method remains challenging should be restricted to the tested strategies, and the section should state clearly that more sophisticated white-box attacks are untested. As written, the contribution bullet and the conclusion overstate the robustness evidence.
minor comments (6)
  1. [App. A.4] The heading contains a typo: “Implement Detials” should be “Implementation Details.”
  2. [Table 4] The caption says that boldface marks the method with the highest average SVA, but no boldface is visible in the rendered table; please indicate the selected configuration explicitly.
  3. [Figures 2 and 4] The caption text in these figures appears duplicated and garbled in the provided manuscript; please fix the rendering so the figure captions are readable.
  4. [App. B.5] The sentence “our method’s computational cost of our method” contains a duplicated phrase; please rewrite it.
  5. [Table 1 caption] The caption contains the typo “senario”; it should be “scenario.”
  6. [Throughout] Notation is inconsistent for the metric names: the text uses “SV A,” “xSV A,” “dSV A,” and “xSVA/dSVA” interchangeably. Please define and use one consistent notation.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the reported SVA gains are produced by independent SV systems on purified audio, and the Refinement model is trained on (clean, purified-clean) pairs without optimizing or being defined in terms of the evaluation metric.

full rationale

The central claim is empirical and self-contained. The Purification stage is a pretrained DiffWave model; the Refinement stage is trained with a score-matching objective (Eq. 7) on pairs of original clean spectrograms and spectrograms obtained by purifying clean audio. Evaluation SVA (Eq. 9) uses x-vector and d-vector speaker verification systems that are independent of the purification and refinement training. The key transfer assumption in Section 4.1—that purified clean and purified protected samples have similar distributions (Figure 4), so a mapping learned on purified clean inputs applies to purified protected inputs—is an inductive generalization claim, not a definitional or fitted equivalence. Training uses Tpur=5 with DEMAND noise augmentation while inference uses Tpur=3, and similarity is shown only in VC-model embedding space rather than in the complex-spectrogram input space of the Refinement model; these are genuine correctness risks about distribution shift, but they do not make the derivation circular. No load-bearing self-citation or imported uniqueness theorem is used; the diffusion backbones (DiffWave, NCSN++) and STFT setup are external. The acknowledged limitations in Appendix C (fixed timesteps, no VC-model information) further indicate that the method's success is treated as an empirical question rather than assumed by construction.

Assumptions & free parameters 5 free parameters · 5 assumptions · 2 invented entities

The ledger contains no free-floating constants that secretly encode the answer: the main tunables are diffusion steps and thresholds that are dataset-calibrated but applied equally to all methods. The core assumption is the transfer of a mapping learned on clean-purified pairs to protected-purified pairs; this is a behavioral hypothesis about distributions, not a fitted number. The paper is therefore not heavily parameterized, but its conclusions rest on several unverified distributional and tooling assumptions.

free parameters (5)
  • T_pur (Purification diffusion steps) = 3 for the main results; 5 for refinement training data; swept up to 9 in Figure 7
    Chosen by a small sweep of values (Figure 7) to maximize SV accuracy on the evaluation set; the paper states that performance rises then falls as T_pur increases, so the value is tuned, not derived.
  • T_ref and N (refinement diffusion time, number of reverse steps) = T_ref implicit in sigma_max=0.5, sigma_min=0.05, tau_eps=0.03, N=30 (N=15 near-optimal per Figure 11)
    N=30 is chosen 'to balance performance and computational efficiency', and N=15 is reported as near-optimal; the value is selected from the observed SV curve, i.e., fitted to the evaluation criterion.
  • SV threshold for d-vector system = 0.697
    The paper sets the d-vector threshold to 0.697 using the EER criterion on the evaluation dataset (App. A.6). The threshold is dataset-calibrated, though the EER criterion is standard; all compared methods use the same threshold, so this is a shared setting rather than a result-specific free parameter.
  • Protection perturbation budgets (epsilon) and VoiceGuard alpha = Individually adjusted per VC model so that SVA < 20%
    App. A.3: the authors 'adjust the perturbation budget epsilon to ensure an SVA under 20%' and similarly tune VoiceGuard's alpha. The budget is thus not constant across methods, but it is chosen to realize the threat-model premise that protection is effective without purification.
  • Phoneme dictionary averaging and STFT parameters = window 510, hop 128, sqrt-Hann; average magnitude spectrogram per phoneme
    These are architectural choices inherited from prior speech-enhancement work; the phoneme dictionary is a data-derived statistic (averaging over the training set), not a fitted scalar.
assumptions (5)
  • domain assumption A pretrained unconditional DiffWave model, fine-tuned on LibriSpeech training data, is a valid stand-in for real-world protective perturbation distributions.
    Invoked in Section 4.2 and App. A.5 for both the Purification stage and for generating the refinement training pairs. If real-world audio artifacts differ from DiffWave's reconstruction artifacts, the method's transfer could degrade.
  • domain assumption Phoneme information is preserved by protective perturbations and provides a useful anchor for refinement.
    Stated in Section 4.3: 'protective perturbations are typically imperceptible and not explicitly designed to interfere with the speech content, so they are likely to have a minimal impact on the phoneme information.' The paper does not independently test how much phoneme content survives in protected audio, it relies on this qualitative claim.
  • domain assumption Distributional similarity between 'purified clean' and 'purified protected' samples observed in Figure 4 extends to the 739-sample evaluation set and to other protection budgets.
    This is the load-bearing transfer assumption of Section 4.1: the refinement mapping is trained on pairs (clean, purified-clean) and applied to purified-protected samples. The paper's defense of this assumption is a visual comparison in Figure 4, not a quantitative test.
  • domain assumption The official implementations of the six VC models and the two SV systems used for evaluation behave as described in their papers and as configured with default parameters.
    The entire empirical comparison inherits whatever preprocessing, checkpoints, and stochastic sampling those repositories use. No code or model hashes are given.
  • domain assumption NISQA scores, averaged MOS, and the EER-based threshold for the d-vector SV system are a valid proxy for human-perceived speaker similarity.
    Used in Section 5.1 and Table 3. Human listening tests are also run (20 participants), so the paper partially validates this proxy, but the main SVA metric is still an automated one with thresholds that vary by system.
invented entities (2)
  • PhonePuRe (Purification-Refinement framework) independent evidence
    purpose: A two-stage adversarial purification pipeline that removes protective perturbations and then aligns the purified audio with the clean speech distribution using phoneme guidance.
    The entity is a pipeline, not a new physical or formal object. It has a falsifiable handle: the reported SV-A accuracy across six VC models and three protection methods, which any independent group can check against the stated equations. It is not introduced ad hoc to explain data; it is proposed as a method with measurable output.
  • Average phoneme spectrogram dictionary independent evidence
    purpose: A lookup table of averaged linear magnitude spectrograms per phoneme, used as conditioning information for the refinement diffusion model.
    This is a data structure computed from the training set; it is not a new physical entity. Its falsifiable handle is the improvement in SV-A when phoneme guidance is ablated (Table 2).

how reviews work

0 comments
Cite this review

Pith. "Pith review of De-AntiFake: Rethinking the Protective Perturbations Against Voice Cloning Attacks." pith.science (2026). https://pith.science/paper/ET2J2QRW

@misc{pith2026250702606,
  author       = {Pith},
  title        = {Pith review of: De-AntiFake: Rethinking the Protective Perturbations Against Voice Cloning Attacks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ET2J2QRW}},
  note         = {Machine review of arXiv:2507.02606}
}
read the original abstract

The rapid advancement of speech generation models has heightened privacy and security concerns related to voice cloning (VC). Recent studies have investigated disrupting unauthorized voice cloning by introducing adversarial perturbations. However, determined attackers can mitigate these protective perturbations and successfully execute VC. In this study, we conduct the first systematic evaluation of these protective perturbations against VC under realistic threat models that include perturbation purification. Our findings reveal that while existing purification methods can neutralize a considerable portion of the protective perturbations, they still lead to distortions in the feature space of VC models, which degrades the performance of VC. From this perspective, we propose a novel two-stage purification method: (1) Purify the perturbed speech; (2) Refine it using phoneme guidance to align it with the clean speech distribution. Experimental results demonstrate that our method outperforms state-of-the-art purification methods in disrupting VC defenses. Our study reveals the limitations of adversarial perturbation-based VC defenses and underscores the urgent need for more robust solutions to mitigate the security and privacy risks posed by VC. The code and audio samples are available at https://de-antifake.github.io.

Figures

Figures reproduced from arXiv: 2507.02606 by the authors.

Figure 1
Figure 1. Illustrations of existing protection methods against voice cloning attacks in the presence of adversarial purification. The dashed lines represent the operations of the attacker. chatbots, and providing assistive devices for individuals with speech impairments (Koronka, 2024; OpenAI, 2024). However, these advancements also pose risks for illegal uses, such as deceiving individuals, bypassing speaker verification sys… view at source ↗
Figure 2
Figure 2. Comparison of sample distributions (Clean vs. Protected/Purified) in the VC model embedding space. Different colors represent different speakers. (a) Protected samples. (b-c), purified samples obtained by existing methods (Guo et al., 2024; Wu et al., 2023), which introduce distortions in the embedding space, including ❶ reduced interclass separability and ❷ deviation of purified samples from their clean counterpart… view at source ↗
Figure 3
Figure 3. Inference process of our Purification-Refinement framework (gray dotted box: waveforms and corresponding spectrograms). bations and generate a forged voice M(p(x ′ )), where p(·) denotes a potential purification function used to mitigate the perturbations in x ′ . The attacker aims to achieve: H(M(p(x ′ ))) ≈ H(x) or SV(M(p(x ′ ))) = SV(x), (2) where the specific choice of targeting humans or SV systems depends on t… view at source ↗
Figures from the paper (9 more)
Figure 5
Figure 5. Figure 5: Distribution of (a) Cosine similarity between clean and protected/purified samples in VC model embedding space; (b) Speaker verification scores for synthesized speech using clean, protected, and purified samples. Our Purification Method. We first examine whether our me…
Figure 6
Figure 6. Figure 6: Perceived speaker similarity between original clean speech and synthesized speech using clean, protected, and pu￾rified samples, as assessed by human listeners. Audio samples are available online: https://de-antifake.github.io/samples [PITH_FULL_IMAGE:figures/full_fig…
Figure 7
Figure 7. Figure 7: Impact of perturbation budget and diffusion steps of Pu￾rification stage on our method. In each grid, the lower-left corner represents the Purification stage only, while the upper-right corner shows the results for the full two-stage framework. 5.4. Adaptive Protection…
Figure 8
Figure 8. Figure 8: We observe that under both adaptive protection strategies, our method demonstrates greater robustness than existing methods. The small variation in dSVA across dif￾ferent EOT sizes indicates that EOT plays a limited role in generating effective adaptive perturbations. …
Figure 9
Figure 9. Figure 9: Effectiveness of VC models in bypassing the SV systems. A.2. Composition of the Evaluation Dataset The evaluation set consists of 25 speakers from the test￾clean subset of LibriSpeech (Panayotov et al., 2015), each contributing 5 sentences, ranging from short (2-4 seco…
Figure 11
Figure 11. Figure 11: Impact of different Refinement steps [PITH_FULL_IMAGE:figures/full_fig_p017_11.png]
Figure 10
Figure 10. Figure 10: shows the objective MOS of the synthesized speech from our method and existing adversarial purifica￾tion methods. The results show that our method achieves greater naturalness across different VC models, indicating that our method not only improves the ability of VC m…
Figure 12
Figure 12. Figure 12: Spectrogram comparison of speech samples as voice cloning inputs. Existing purification methods tend to produce samples with similar patterns or blurred details, whereas our method retains details similar to those of the clean samples. which utilizes a non-Latin scrip…
Figure 13
Figure 13. Figure 13: Visualization of voice cloning inputs and corresponding synthesized speech. The first row displays the speech samples as voice cloning input, while the second and third rows show the corresponding synthesized speech using different voice cloning models. Our method ret…

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

53 extracted references · 37 canonical work pages

  1. [1]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION format.date year duplicate empty "emp...

  2. [2]

    I used AI voice cloning to steal £250

    Andrews, L. I used AI voice cloning to steal £250 . it took 15 minutes, 2024. URL https://www.thetimes.com/business-money/money/article/i-used-ai-voice-cloning-to-steal-250-it-took-15-minutes-6vj586753

    work page 2024

  3. [3]

    Better speech synthesis through scaling

    Betker, J. Better speech synthesis through scaling. arXiv preprint arXiv:2305.07243, 2023

    arXiv 2023

  4. [4]

    Who Are You ( I Really Wanna Know )? Detecting Audio DeepFakes Through Vocal Tract Reconstruction

    Blue, L., Warren, K., Abdullah, H., Gibson, C., Vargas, L., O'Dell, J., Butler, K., and Traynor, P. Who Are You ( I Really Wanna Know )? Detecting Audio DeepFakes Through Vocal Tract Reconstruction . In 31st USENIX Security Symposium (USENIX Security 22), pp.\ 2691--2708, 2022

    work page 2022

  5. [5]

    D., Junior, A

    Casanova, E., Weber, J., Shulby, C. D., Junior, A. C., G \"o lge, E., and Ponti, M. A. Yourtts: Towards zero-shot multi-speaker tts and zero-shot voice conversion for everyone. In International Conference on Machine Learning, pp.\ 2709--2720. PMLR, 2022

    work page 2022

  6. [6]

    Towards Understanding and Mitigating Audio Adversarial Examples for Speaker Recognition

    Chen, G., Zhao, Z., Song, F., Chen, S., Fan, L., Wang, F., and Wang, J. Towards Understanding and Mitigating Audio Adversarial Examples for Speaker Recognition . IEEE Transactions on Dependable and Secure Computing, 20 0 (5): 0 3970--3987, September 2023. ISSN 1941-0018. doi:10.1109/TDSC.2022.3220673. URL https://ieeexplore.ieee.org/document/9942342/?arnu...

    work page arXiv 2023

  7. [7]

    WavMark : Watermarking for Audio Generation , January 2024

    Chen, G., Wu, Y., Liu, S., Liu, T., Du, X., and Wei, F. WavMark : Watermarking for Audio Generation , January 2024. URL http://arxiv.org/abs/2308.12770

    arXiv 2024

  8. [8]

    How I broke into a bank account with an AI -generated voice, 2023

    Cox, J. How I broke into a bank account with an AI -generated voice, 2023. URL https://www.vice.com/en/article/how-i-broke-into-a-bank-account-with-an-ai-generated-voice/

    work page 2023

Show all 53 references
  1. [9]

    CATCH YOU AND I CAN : Revealing Source Voiceprint Against Voice Conversion

    Deng, J., Chen, Y., Zhong, Y., Miao, Q., Gong, X., and Xu, W. CATCH YOU AND I CAN : Revealing Source Voiceprint Against Voice Conversion . USENIX, 2023

    2023

  2. [10]

    ECAPA-TDNN: emphasized channel attention, propagation and aggregation in TDNN based speaker verification

    Desplanques, B., Thienpondt, J., and Demuynck, K. ECAPA-TDNN: emphasized channel attention, propagation and aggregation in TDNN based speaker verification. In Meng, H., Xu, B., and Zheng, T. F. (eds.), 21st Annual Conference of the International Speech Communication Associatio...

    2020 doi

  3. [11]

    Active Defense Against Voice Conversion Through Generative Adversarial Network

    Dong, S., Chen, B., Ma, K., and Zhao, G. Active Defense Against Voice Conversion Through Generative Adversarial Network . IEEE Signal Processing Letters, 31: 0 706--710, 2024. ISSN 1070-9908, 1558-2361. doi:10.1109/LSP.2024.3365034. URL https://ieeexplore.ieee.org/document/10432955/

    2024

  4. [12]

    FTC submits comment to FCC on work to protect consumers from potential harmful effects of AI , 2024

    FTC. FTC submits comment to FCC on work to protect consumers from potential harmful effects of AI , 2024. URL https://www.ftc.gov/news-events/news/press-releases/2024/07/ftc-submits-comment-fcc-work-protect-consumers-potential-harmful-effects-ai

    2024

  5. [13]

    WavePurifier : purifying audio adversarial examples via hierarchical diffusion models

    Guo, H., Wang, G., Chen, B., Wang, Y., Zhang, X., Chen, X., Yan, Q., and Xiao, L. WavePurifier : purifying audio adversarial examples via hierarchical diffusion models. In Proceedings of the 30th Annual International Conference on Mobile Computing and Networking, pp.\ 1268--1282, 2024

    2024

  6. [14]

    Y., Lee, H.-y., and Lee, L.-s

    Huang, C.-y., Lin, Y. Y., Lee, H.-y., and Lee, L.-s. Defending Your Voice : Adversarial Attack on Voice Conversion . In 2021 IEEE Spoken Language Technology Workshop ( SLT ) , pp.\ 552--559, Shenzhen, China, January 2021. IEEE. ISBN 978-1-7281-7066-4. doi:10.1109/SLT48900.2021...

    2021

  7. [15]

    WaveGuard : Understanding and Mitigating Audio Adversarial Examples

    Hussain, S., Neekhara, P., Dubnov, S., McAuley, J., and Koushanfar, F. WaveGuard : Understanding and Mitigating Audio Adversarial Examples . USENIX, 2021

    2021

  8. [16]

    Speech- Forensics : Towards Comprehensive Synthetic Speech Dataset Establishment and Analysis

    Ji, Z., Lin, C., Wang, H., and Shen, C. Speech- Forensics : Towards Comprehensive Synthetic Speech Dataset Establishment and Analysis . In Proceedings of the Thirty - Third International Joint Conference on Artificial Intelligence , pp.\ 413--421, Jeju, South Korea, August 202...

    2024 doi

  9. [17]

    Transfer learning from speaker verification to multispeaker text-to-speech synthesis

    Jia, Y., Zhang, Y., Weiss, R., Wang, Q., Shen, J., Ren, F., Nguyen, P., Pang, R., Lopez Moreno, I., Wu, Y., et al. Transfer learning from speaker verification to multispeaker text-to-speech synthesis. Advances in neural information processing systems, 31, 2018

    2018

  10. [18]

    Diffattack: Evasion attacks against diffusion-based adversarial purification

    Kang, M., Song, D., and Li, B. Diffattack: Evasion attacks against diffusion-based adversarial purification. Advances in Neural Information Processing Systems, 36, 2024

    2024

  11. [19]

    DiffWave : A Versatile Diffusion Model for Audio Synthesis

    Kong, Z., Ping, W., Huang, J., Zhao, K., and Catanzaro, B. DiffWave : A Versatile Diffusion Model for Audio Synthesis . In International Conference on Learning Representations, March 2021. URL https://openreview.net/forum?id=a-xFK8Ymz5J

    2021

  12. [20]

    How AI is giving motor neurone disease sufferers their old voices back, 2024

    Koronka, P. How AI is giving motor neurone disease sufferers their old voices back, 2024. URL https://www.thetimes.com/uk/healthcare/article/elevenlabs-voice-clone-ai-als-t3ntnpcl7

    2024

  13. [21]

    and Kim, D

    Lee, M. and Kim, D. Robust evaluation of diffusion-based adversarial purification. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp.\ 134--144, 2023 a

    2023

  14. [22]

    and Kim, D

    Lee, M. and Kim, D. Robust Evaluation of Diffusion - Based Adversarial Purification . In 2023 IEEE / CVF International Conference on Computer Vision ( ICCV ) , pp.\ 134--144, Paris, France, October 2023 b . IEEE. ISBN 979-8-3503-0718-4. doi:10.1109/ICCV51070.2023.00019. URL ht...

    2023

  15. [23]

    Freevc: Towards high-quality text-free one-shot voice conversion

    Li, J., Tu, W., and Xiao, L. Freevc: Towards high-quality text-free one-shot voice conversion. In ICASSP 2023-2023 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp.\ 1--5. IEEE, 2023 a

    2023

  16. [24]

    Voice Guard : Protecting Voice Privacy with Strong and Imperceptible Adversarial Perturbation in the Time Domain

    Li, J., Ye, D., Tang, L., Chen, C., and Hu, S. Voice Guard : Protecting Voice Privacy with Strong and Imperceptible Adversarial Perturbation in the Time Domain . In Proceedings of the Thirty - Second International Joint Conference on Artificial Intelligence , pp.\ 4812--4820, ...

    2023 doi

  17. [25]

    SafeEar : Content Privacy - Preserving Audio Deepfake Detection

    Li, X., Li, K., Zheng, Y., Yan, C., Ji, X., and Xu, W. SafeEar : Content Privacy - Preserving Audio Deepfake Detection . CCS, 2024

    2024

  18. [26]

    Detecting Voice Cloning Attacks via Timbre Watermarking

    Liu, C., Zhang, J., Zhang, T., Yang, X., Zhang, W., and Yu, N. Detecting Voice Cloning Attacks via Timbre Watermarking . In Network and Distributed System Security Symposium, 2024 a . doi:10.14722/ndss.2024.24200

    2024

  19. [27]

    Zero-shot voice conversion with diffusion transformers

    Liu, S. Zero-shot voice conversion with diffusion transformers. arXiv preprint arXiv:2411.09943, 2024

    2024 arXiv

  20. [28]

    GROOT : Generating Robust Watermark for Diffusion - Model - Based Audio Synthesis

    Liu, W., Li, Y., Lin, D., Tian, H., and Li, H. GROOT : Generating Robust Watermark for Diffusion - Model - Based Audio Synthesis . In Proceedings of the 32nd ACM International Conference on Multimedia, pp.\ 3294--3302, 2024 b

    2024

  21. [29]

    Protecting Your Voice from Speech Synthesis Attacks

    Liu, Z., Zhang, Y., and Miao, C. Protecting Your Voice from Speech Synthesis Attacks . In Annual Computer Security Applications Conference , pp.\ 394--408, Austin TX USA, December 2023. ACM. ISBN 979-8-4007-0886-2. doi:10.1145/3627106.3627183. URL https://dl.acm.org/doi/10.114...

    2023

  22. [30]

    Montreal forced aligner: Trainable text-speech alignment using kaldi

    McAuliffe, M., Socolof, M., Mihuc, S., Wagner, M., and Sonderegger, M. Montreal forced aligner: Trainable text-speech alignment using kaldi. In Interspeech 2017, pp.\ 498--502, 2017. doi:10.21437/Interspeech.2017-1386

    2017 doi

  23. [31]

    NISQA: A deep cnn-self-attention model for multidimensional speech quality prediction with crowdsourced datasets

    Mittag, G., Naderi, B., Chehadi, A., and M \" o ller, S. NISQA: A deep cnn-self-attention model for multidimensional speech quality prediction with crowdsourced datasets. In Hermansky, H., Cernock \' y , H., Burget, L., Lamel, L., Scharenborg, O., and Motl \' cek, P. (eds.), 2...

    2021 doi

  24. [32]

    Nick Evershed, J. T. AI can fool voice recognition used to verify identity by centrelink and australian tax office, 2023. URL https://www.theguardian.com/technology/2023/mar/16/voice-system-used-to-verify-identity-by-centrelink-can-be-fooled-by-ai

    2023

  25. [33]

    Diffusion models for adversarial purification

    Nie, W., Guo, B., Huang, Y., Xiao, C., Vahdat, A., and Anandkumar, A. Diffusion models for adversarial purification. In International Conference on Machine Learning, pp.\ 16805--16827. PMLR, 2022

    2022

  26. [34]

    Navigating the challenges and opportunities of synthetic voices, 2024

    OpenAI. Navigating the challenges and opportunities of synthetic voices, 2024. URL https://openai.com/index/navigating-the-challenges-and-opportunities-of-synthetic-voices/

    2024

  27. [35]

    Librispeech: an asr corpus based on public domain audio books

    Panayotov, V., Chen, G., Povey, D., and Khudanpur, S. Librispeech: an asr corpus based on public domain audio books. In 2015 IEEE international conference on acoustics, speech and signal processing (ICASSP), pp.\ 5206--5210. IEEE, 2015

    2015

  28. [36]

    Grad- TTS : A Diffusion Probabilistic Model for Text -to- Speech

    Popov, V., Vovk, I., Gogoryan, V., Sadekova, T., and Kudinov, M. Grad- TTS : A Diffusion Probabilistic Model for Text -to- Speech . In International Conference on Machine Learning, pp.\ 8599--8608. PMLR, 2021

    2021

  29. [37]

    S., and Wei, J

    Popov, V., Vovk, I., Gogoryan, V., Sadekova, T., Kudinov, M. S., and Wei, J. Diffusion-based voice conversion with fast maximum likelihood sampling scheme. In International Conference on Learning Representations, 2022

    2022

  30. [38]

    Elevenlabs, 2025

    Prime Voice AI . Elevenlabs, 2025. URL https://elevenlabs.io/

    2025

  31. [39]

    Openvoice: Versatile instant voice cloning

    Qin, Z., Zhao, W., Yu, X., and Sun, X. Openvoice: Versatile instant voice cloning. arXiv preprint arXiv:2312.01479, 2023

    2023 arXiv

  32. [40]

    Who is Speaking Actually ? Robust and Versatile Speaker Traceability for Voice Conversion

    Ren, Y., Zhu, H., Zhai, L., Sun, Z., Shen, R., and Wang, L. Who is Speaking Actually ? Robust and Versatile Speaker Traceability for Voice Conversion . In Proceedings of the 31st ACM International Conference on Multimedia, pp.\ 8674--8685, 2023

    2023

  33. [41]

    Proactive Detection of Voice Cloning with Localized Watermarking

    San Roman, R., Fernandez, P., Elsahar, H., D \'e fossez, A., Furon, T., and Tran, T. Proactive Detection of Voice Cloning with Localized Watermarking . In ICML 2024-41st International Conference on Machine Learning, volume 235, pp.\ 1--17, 2024

    2024

  34. [42]

    and Solin, A

    S \"a rkk \"a , S. and Solin, A. Applied stochastic differential equations, volume 10. Cambridge University Press, 2019

    2019

  35. [43]

    P., Kumar, A., Ermon, S., and Poole, B

    Song, Y., Sohl-Dickstein, J., Kingma, D. P., Kumar, A., Ermon, S., and Poole, B. Score-based generative modeling through stochastic differential equations. In International Conference on Learning Representations, 2021

    2021

  36. [44]

    DualPure : An Efficient Adversarial Purification Method for Speech Command Recognition

    Tan, H., Liu, X., Zhang, H., Zhang, J., Qian, Y., and Gu, Z. DualPure : An Efficient Adversarial Purification Method for Speech Command Recognition . In Interspeech 2024, pp.\ 1280--1284. ISCA, September 2024. doi:10.21437/Interspeech.2024-855. URL https://www.isca-archive.org...

    2024 doi

  37. [45]

    The diverse environments multi-channel acoustic noise database (demand): A database of multichannel environmental noise recordings

    Thiemann, J., Ito, N., and Vincent, E. The diverse environments multi-channel acoustic noise database (demand): A database of multichannel environmental noise recordings. In Proceedings of Meetings on Acoustics, volume 19. AIP Publishing, 2013

    2013

  38. [46]

    Diffusion- Based Mel - Spectrogram Enhancement for Personalized Speech Synthesis with Found Data

    Tian, Y., Liu, W., and Lee, T. Diffusion- Based Mel - Spectrogram Enhancement for Personalized Speech Synthesis with Found Data . In 2023 IEEE Automatic Speech Recognition and Understanding Workshop ( ASRU ) , pp.\ 1--7, December 2023. doi:10.1109/ASRU57964.2023.10389748. URL ...

    2023

  39. [47]

    Wan, L., Wang, Q., Papir, A., and Moreno, I. L. Generalized end-to-end loss for speaker verification. In 2018 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp.\ 4879--4883. IEEE, 2018

    2018

  40. [48]

    VSMask : Defending Against Voice Synthesis Attack via Real - Time Predictive Perturbation

    Wang, Y., Guo, H., Wang, G., Chen, B., and Yan, Q. VSMask : Defending Against Voice Synthesis Attack via Real - Time Predictive Perturbation . In Proceedings of the 16th ACM Conference on Security and Privacy in Wireless and Mobile Networks , pp.\ 239--250, Guildford United Ki...

    2023

  41. [49]

    Speech enhancement with score-based generative models in the complex STFT domain

    Welker, S., Richter, J., and Gerkmann, T. Speech enhancement with score-based generative models in the complex STFT domain. In Ko, H. and Hansen, J. H. L. (eds.), 23rd Annual Conference of the International Speech Communication Association, Interspeech 2022, Incheon, Korea, Se...

    2022 doi

  42. [50]

    Hello , It 's Me

    Wenger, E., Bronckers, M., Cianfarani, C., Cryan, J., Sha, A., Zheng, H., and Zhao, B. Y. " Hello , It 's Me ": Deep Learning -based Speech Synthesis Attacks in the Real World . In Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security , pp.\ 235...

    2021

  43. [51]

    Defending against adversarial audio via diffusion model

    Wu, S., Wang, J., Ping, W., Nie, W., and Xiao, C. Defending against adversarial audio via diffusion model. In The Eleventh International Conference on Learning Representations, 2023. URL https://openreview.net/forum?id=5-Df3tljit7

    2023

  44. [52]

    G., Wu, Y.-T., Su, B.-H., and Lee, C.-C

    Yang, C.-Y., Upadhyay, S. G., Wu, Y.-T., Su, B.-H., and Lee, C.-C. RW - VoiceShield : Raw Waveform -based Adversarial Attack on One -shot Voice Conversion . In Interspeech 2024, pp.\ 2730--2734. ISCA, September 2024. doi:10.21437/Interspeech.2024-458. URL https://www.isca-arch...

    2024 doi

  45. [53]

    AntiFake : Using Adversarial Audio to Prevent Unauthorized Speech Synthesis

    Yu, Z., Zhai, S., and Zhang, N. AntiFake : Using Adversarial Audio to Prevent Unauthorized Speech Synthesis . In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security , pp.\ 460--474, Copenhagen Denmark, November 2023. ACM. ISBN 979-8-4007-0050-...

    2023

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.