Pith. sign in

REVIEW 3 major objections 5 minor 36 references

The Risks and Detection of Overestimated Privacy Protection in Voice Anonymisation

T0 review · 3 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Privacy protection in voice anonymisation can be overestimated by 74% when the speaker-verification attacker is trained on data from a different anonymisation system, and a validation-gap check can detect such overestimates.

desk verdict The hidden-mismatch finding is real and changes how we read published privacy numbers; the detection method is a sensible first cut, but its validation is still in-sample. read the letter →

arxiv 2507.22534 v1 pith:HSRSVQI7 submitted 2025-07-30 eess.AS

Michele Panariello , Sarina Meyer , Pierre Champion , Xiaoxiao Miao , Massimiliano Todisco , Ngoc Thang Vu , Nicholas Evans This is my paper
classification eess.AS
keywords voiceanonymisationspeakerverificationprivacyprotectionevaluationequalerrorratesemi-informedattackvalidationgapoverestimationdetectionChallenge
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that standard privacy estimates for voice anonymisation are untrustworthy when the automatic speaker verification (ASV) system used to attack the anonymised speech is trained on data produced by a different anonymisation system than the one under test. Even a small mismatch, such as swapping one module inside the anonymiser, can inflate the equal error rate (EER) by up to ten percentage points, and the worst case identified in the literature drops from 40.80% to 10.38% EER once the attacker is retrained properly, a 74% relative overestimate. The paper introduces a detection method based on comparing the attacker's error rate on validation data (drawn from its own training set) with its error rate on the evaluation test set, and shows that every mismatched scenario in the paper falls clearly outside the pattern set by matched evaluations. If the claim holds, published comparisons of anonymisation systems that rely on the semi-informed attack may be ranking systems by how badly the attacker overfits, rather than by true privacy protection.

What carries the argument

The load-bearing mechanism is the validation-versus-test EER gap. For each anonymisation system, the attacker's ASV model is trained on anonymised data $T_S$, and a 10% portion of $T_S$ is set aside as validation data; the same model is then scored on the evaluation set $E_S$ to produce $EER_{\text{val}}$ and $EER_{\text{test}}$. The paper observes that the gap between these two error rates is consistently larger for mismatched evaluations than for matched ones, and fits a linear regression to the five matched baseline points to serve as a reference: points falling well below the regression line are flagged as potentially mismatched. The paper also identifies the underlying cause of the most insidious hidden mismatch: deterministic target-speaker selection (such as the OHNN mapping in system C1) makes utterance-level anonymisation behave like speaker-level anonymisation, so the ASV learns a spurious mapping from target voice back to source speaker rather than robust speaker-discriminative cues; retraining with random target selection restores utterance-level variation and produces a much stronger attack.

What would settle it

The clearest falsifying experiment is to find any mismatched evaluation—for instance a partial mismatch where only the vocoder is swapped—whose validation-to-test error-rate point falls on or above the regression line drawn from matched systems; the paper's claim is that no such point exists among the scenarios it examined.

Watch

Extended reading notes

Core claim

The central claim is that privacy protection in voice anonymisation is frequently overestimated because the de-facto standard semi-informed attack model can be implemented in ways that train the attacking ASV model on data whose anonymisation distribution differs from the evaluation data, and this mismatch is often invisible in the reported EER. The paper demonstrates the effect artificially with full and partial mismatches (e.g., training on B4-anonymised data and testing on B3-anonymised data raises B3's EER from 27.05% to 44.40%), and it shows a hidden mismatch in a published system, C1, where retraining the ASV with randomly selected target speakers instead of the system's own deterministic OHNN selection lowers the EER from 40.80% to 10.38%, a 74% relative decrease. The paper proposes a detector: compute the attacker's EER on a held-out validation split of its own anonymised training data and compare it with the EER on the test data; mismatched evaluations produce a much larger validation-to-test gap than matched ones, and a regression line fitted to five matched baseline systems separates all mismatched cases from the trusted ones. The paper concludes that this validation-gap analysis should be adopted by the community and by future VoicePrivacy Challenge editions to protect the trustworthiness of performance estimates.

Load-bearing premise

The detector assumes that 'matched' evaluations—where the same anonymiser produces both the attacker's training data and the test data—are always trustworthy, and that a line fitted to just five matched systems predicts the gap for any new system.

Editorial extensions

If this is right

  • Published EERs obtained with the semi-informed attack may overstate privacy protection whenever the attacker's training data was anonymised with a different system or configuration than the evaluation data.
  • Anonymisers with deterministic or insufficiently random target-speaker selection should be re-evaluated with a random-selection attack before their privacy claims are trusted.
  • Adopting the validation-gap check in future evaluation plans would allow the community to flag untrustworthy results without changing the existing evaluation recipe.
  • The detection method identified every full, partial, and hidden mismatch scenario presented in the paper, including the C1 case whose reported near-perfect privacy drops to 10.38% EER after correction.
  • An unusually large validation-to-test gap in any reported evaluation is a warning that the attacker is overfitted and the EER should not be read as a measure of anonymisation strength.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The validation-gap principle should transfer to other biometric privacy evaluations (e.g., face or gait anonymisation), where an attacker model trained on transformed data may similarly overfit to training-domain mappings.
  • The regression baseline is built from only five matched systems, so its extrapolation to unseen systems is the most fragile link; a larger set of matched baselines or a non-parametric reference band would make the flagging criterion more defensible.
  • A broader implication of the hidden-mismatch mechanism is a design rule: any anonymiser whose target-speaker selection is deterministic or limited in randomness is a candidate for overestimated privacy even if its reported EER is high.
  • A natural stress test is to apply the detector to a corpus of matched evaluations with known-correct ground truth; if the validation-to-test gaps of those systems vary widely, a single regression line may be too rigid a threshold.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper studies the risk that privacy protection estimates for voice anonymisation are inflated when the automatic speaker verification (ASV) attack model is trained on data anonymised with a different system, a different module, or a different target-speaker selection strategy than the evaluation data. It demonstrates this risk in three controlled settings: full mismatch among the B3/B4/B5 systems, partial mismatch where only one module differs, and hidden mismatch caused by speaker-level rather than utterance-level anonymisation of the ASV training data. The most striking result is that the C1 system's reported EER drops from 40.80% to 10.38% under a corrected attack, a 74% relative decrease. The paper then proposes a detection method that compares EER on a validation subset of the ASV training data with EER on the evaluation data, using a regression line over five matched scenarios as a reference, and claims that this method can identify all overestimation scenarios presented. The detection tool is released as a fork of the 2024 VoicePrivacy Challenge evaluation toolkit.

Significance. The controlled mismatch experiments are a valuable contribution. They show concretely that privacy-protection estimates are not comparable unless the ASV attack model is matched to the anonymisation system and to the target-selection strategy, and the B3-SL control supports the explanation of why speaker-level anonymisation of training data yields a weak attack. The open-source release is a practical benefit for the community. The main caveat is that the proposed detection method is only demonstrated in-sample: the regression reference is fit to five matched scenarios and applied to the same constructed mismatch scenarios, and the paper's own Section 3.3 shows that matched scenarios can themselves be overestimated, which undermines the assumption that the matched regression line is a reliable baseline. The detection claim in the abstract is therefore stronger than the evidence provided.

major comments (3)
  1. [§3.4, Figure 2] The detection method is validated only on the same scenarios used to construct it. The regression line in Figure 2 is fit to the five matched points (B3,B3), (B4,B4), (B5,B5), (B5*,B5*), and (B2,B2), and is then assessed on the full, partial, and hidden mismatch scenarios that motivated the method. No held-out systems, no cross-validation, and no confidence intervals or goodness-of-fit statistics are reported. Consequently, the abstract's claim that the method 'can identify all overestimation scenarios presented in the paper' is an in-sample statement, not a validated detection procedure. Please add leave-one-system-out evaluation or a held-out set of systems, and report uncertainty around the regression line and the resulting flags.
  2. [§3.3 and §3.4] The assumption that matched scenarios form a reliable baseline is contradicted by the paper's own results. In Section 3.3, (C1,C1) and (B3-SL,B3-SL) are matched evaluations in the sense that the same anonymisation system generates both the ASV training data and the evaluation data, yet they produce heavily overestimated EERs (40.80% and 44.78%). In Figure 2, these two points are plotted as purple circles and excluded from the green regression set only because the authors independently discovered the hidden mismatch through the random-target retraining experiment. A user of the proposed detector who does not know a priori that a matched system is unreliable cannot tell whether the point belongs to the reliable matched population or to the overestimated hidden-mismatch population. The regression line itself cannot make this distinction, because it was constructed under the assumption that all matched scenarios are well-evaluated reference cases. This is a load-bearing issue for the central claim that the detector can identify hidden mismatches.
  3. [Tables 1–3] All EER values are reported as point estimates without confidence intervals or significance tests. The claim that performance is overestimated, including the headline 74% relative decrease for C1 (Table 3: 40.80% to 10.38%), rests on these single numbers. While the C1 difference is large, the smaller differences in the partial mismatch scenario (Table 2, e.g., B3 versus B3*) could be within sampling variability. Since the detection method in Figure 2 depends on the relative position of points with respect to a regression line, reporting bootstrap confidence intervals or multiple training runs would materially strengthen the paper.
minor comments (5)
  1. [§3.1, second paragraph] The sentence stating that 'the EER increases to 44% EER (near random guess) when the ASV system is trained using data generated using B4 or B5' is inconsistent with Table 1. The 44% values occur when the ASV trained on B3 is evaluated on EB4 or EB5; please correct the sentence or revise the description.
  2. [Abstract, §3.4, and Conclusions] Section 3.4 says 'nearly all other points' fall below the regression line, while the Abstract and Conclusions assert that the method identifies 'all' overestimation scenarios. Please reconcile these claims, either by reporting the exact number of flagged points or by softening the abstract.
  3. [Figure 2] The point labels are dense and several annotations overlap, making it difficult to read which (system1, system2) pair each marker corresponds to. Consider using a table of coordinates or a zoomed-in inset for the matched points.
  4. [§3.4] The text refers to 'the gap between EERval and EERtest' but does not consistently define whether the gap is absolute or relative; the two illustrative examples use relative drops (60% and 76%), while the regression in Figure 2 is in absolute EER units. Please define the quantity used for detection.
  5. [§3.3] The sentence 'It follows then that OHNN(x1) ≈ OHNN(x2), hence speaker-level, rather than utterance-level anonymisation' has a missing verb and is grammatically incomplete; please revise for clarity.

Circularity Check

0 steps flagged · score 1.0 of 10

No circular derivation: the overestimation phenomenon is experimentally independent of the proposed detector, and the detector's fit is not forced by construction.

full rationale

The paper's central overestimation result is established through controlled experiments (full, partial, and hidden mismatch) that do not depend on the proposed detector. The 74% relative overestimation for C1 is a direct comparison of two independently trained ASV attack models, not a fitted quantity. The detection method uses a linear regression fit only to matched baseline systems and then applies the resulting line to separately constructed mismatch scenarios; mismatched points are not used in the fit, so the reported separation is not statistically forced. The hidden-mismatch explanation cites the authors' earlier work [26,27], but the paper also provides an explicit embedding argument and an independent B3-SL experiment, making that self-citation supportive rather than load-bearing. The main caveat is that the matched baseline is assumed to be well-evaluated even though Section 3.3 shows that same-system evaluations can themselves be overestimated; this weakens generalisation and makes the 'identify all scenarios' claim an in-sample demonstration, but it is a validity limitation, not a circular reduction.

Assumptions & free parameters 1 free parameters · 5 assumptions · 0 invented entities

The central claim relies on standard semi-informed attack assumptions plus a few domain-specific assumptions. The detection method introduces one fitted regression threshold and assumes matched scenarios are reliable. No new physical or mathematical entities are introduced.

free parameters (1)
  • Regression slope and intercept for detection threshold = Not reported numerically; shown as the green dashed line in Figure 2.
    A linear regression of EER_valid on EER_test is fit to the five matched scenarios to define the reference line for detecting mismatches. The fitted line parameters determine which systems are flagged.
assumptions (5)
  • domain assumption The attacker knows the anonymisation system S and trains ASV_S on data anonymised by S.
    Definition taken from VPC evaluation plan [3], used throughout the paper as the reference evaluation policy.
  • ad hoc to paper Matched evaluations, where the same system generates both training and test data, are reliable baselines.
    The regression line in Fig. 2 uses matched scenarios as ground truth for well-evaluated cases; if these are themselves overestimated, the detection line is biased.
  • domain assumption If the target speaker selection strategy is not sufficiently random, utterance-level anonymisation behaves similarly to speaker-level anonymisation.
    Used to explain C1's hidden mismatch; cited to authors' prior work [26,27] and supported by the B3-SL experiment.
  • domain assumption Speaker-level anonymisation of training data yields a weaker attack than utterance-level anonymisation.
    Cited to [28]; load-bearing for the hidden mismatch explanation and the corrected attack design.
  • domain assumption A larger gap between EER_valid and EER_test indicates overfitting or mismatch.
    Core hypothesis behind the detection method; supported only by the in-sample plot in Fig. 2.

how reviews work

0 comments
Cite this review

Pith. "Pith review of The Risks and Detection of Overestimated Privacy Protection in Voice Anonymisation." pith.science (2026). https://pith.science/paper/HSRSVQI7

@misc{pith2026250722534,
  author       = {Pith},
  title        = {Pith review of: The Risks and Detection of Overestimated Privacy Protection in Voice Anonymisation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/HSRSVQI7}},
  note         = {Machine review of arXiv:2507.22534}
}
read the original abstract

Voice anonymisation aims to conceal the voice identity of speakers in speech recordings. Privacy protection is usually estimated from the difficulty of using a speaker verification system to re-identify the speaker post-anonymisation. Performance assessments are therefore dependent on the verification model as well as the anonymisation system. There is hence potential for privacy protection to be overestimated when the verification system is poorly trained, perhaps with mismatched data. In this paper, we demonstrate the insidious risk of overestimating anonymisation performance and show examples of exaggerated performance reported in the literature. For the worst case we identified, performance is overestimated by 74% relative. We then introduce a means to detect when performance assessment might be untrustworthy and show that it can identify all overestimation scenarios presented in the paper. Our solution is openly available as a fork of the 2024 VoicePrivacy Challenge evaluation toolkit.

Figures

Figures reproduced from arXiv: 2507.22534 by the authors.

Figure 1
Figure 1. Illustration of the mismatched evaluation procedure (best viewed in colour). s1 and s2 are voice anonymisation sys￾tems from P. Matched: s1 = s2. Full mismatch (Section 3.1): s1 ̸= s2, different colours. Partial mismatch (Section 3.2): s1 ̸= s2, same colour, different shapes. Hidden mismatch (Sec￾tion 3.3): s1 ̸= s2, same colour, different borders. Mel spectrogram which is converted to a waveform using a HiFi-GAN vo… view at source ↗
Figure 2
Figure 2. Values of EERval plotted against EERtest for all considered systems, denoted as (ES, TS) pairs. The green dashed line is the regression line of the “Matched” systems. Systems falling below this line have a potentially mismatched evaluation. and 3.2) or the use of ineffective training strategies (Sec￾tion 3.3). This causes ASVS to underperform on ES. In the following we propose one solution to detect overfitting usin… view at source ↗

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

36 extracted references · 32 canonical work pages

  1. [1]

    State-of-the-art solutions operate upon multiple features extracted from the input speech signal

    Introduction V oice anonymisation is the task of processing a speech record- ing to conceal the voice identity of the speaker while retaining utility — with utility being defined according to some down- stream task [1]. State-of-the-art solutions operate upon multiple features extracted from the input speech signal. Typically, they encode at least the des...

    work page

  2. [2]

    The Risks and Detection of Overestimated Privacy Protection in Voice Anonymisation

    Anonymisation methods We report an evaluation of anonymisation performance for a set of scenarios involving some form of mismatch between the anonymisation system under test and that used to generate ASV training data. In this section we describe the set of systems used in our experiments. They include 3 VPC 2024 baseline sys- tems [3]. For reasons which ...

    work page Pith review arXiv 2024

  3. [3]

    We then show similar findings when the two anonymisation systems differ only in terms of a single module

    Experiments We first show that differences between the anonymisation sys- tems used to generate anonymised evaluation data ES and that used by the adversary for ASV training TS can lead to privacy protection overestimation. We then show similar findings when the two anonymisation systems differ only in terms of a single module. Next, we show that estimate...

    work page

  4. [4]

    Conclusions In this paper we demonstrate the risk of overestimating anonymisation performance. Using several state-of-the-art anonymisation approaches, we show that the risk stems from mismatches between the data used to train the speaker verifica- tion system employed for evaluation and the anonymised data under test. We demonstrate the risk with artific...

    work page

  5. [5]

    Acknowledgements This work is funded by the Deutsche Forschungsgemein- schaft (DFG, German Research Foundation) – Project: Mul- tilingual Controllable V oice Privacy (V oiPy) - Project number 533241795

    work page

  6. [6]

    Introducing the V oicePrivacy Initiative,

    N. Tomashenko, B. M. L. Srivastava, X. Wang, E. Vincent, A. Nautsch, J. Yamagishi, N. Evans, J. Patino, J.-F. Bonastre, P.-G. No´e, and M. Todisco, “Introducing the V oicePrivacy Initiative,” in Interspeech 2020, 2020, pp. 1693–1697

    work page 2020

  7. [7]

    The V oicePrivacy 2022 Challenge: Progress and Perspec- tives in V oice Anonymisation,

    M. Panariello, N. Tomashenko, X. Wang, X. Miao, P. Champion, H. Nourtel, M. Todisco, N. Evans, E. Vincent, and J. Yamag- ishi, “The V oicePrivacy 2022 Challenge: Progress and Perspec- tives in V oice Anonymisation,” IEEE/ACM Transactions on Au- dio, Speech, and Language Processing , vol. 32, pp. 3477–3491, 2024

    work page 2022

  8. [8]

    The V oicePrivacy 2024 Challenge Evaluation Plan,

    N. Tomashenko, X. Miao, P. Champion, S. Meyer, X. Wang, E. Vincent, M. Panariello, N. Evans, J. Yamagishi, and M. Todisco, “The V oicePrivacy 2024 Challenge Evaluation Plan,”

    work page 2024

Show all 36 references
  1. [9]

    Wasserstein GAN with quadratic transport cost,

    H. Liu, X. Gu, and D. Samaras, “Wasserstein GAN with quadratic transport cost,” in IEEE/CVF International Conference on Com- puter Vision (ICCV), 2019, pp. 4832–4841

    2019

  2. [10]

    The First V oicePrivacy Attacker Challenge Evaluation Plan,

    N. Tomashenko, X. Miao, E. Vincent, and J. Yamagishi, “The First V oicePrivacy Attacker Challenge Evaluation Plan,” 2024. [Online]. Available: https://arxiv.org/abs/2410.07428

    2024 arXiv

  3. [11]

    Anonymizing speech: Evaluating and designing speaker anonymization techniques,

    P. Champion, “Anonymizing speech: Evaluating and designing speaker anonymization techniques,” Ph.D. dissertation, Universit´e de Lorraine, 2023

    2023

  4. [12]

    Speaker Anonymization Using Orthogonal Householder Neural Network,

    X. Miao, X. Wang, E. Cooper, J. Yamagishi, and N. Tomashenko, “Speaker Anonymization Using Orthogonal Householder Neural Network,” IEEE/ACM Transactions on Audio, Speech, and Lan- guage Processing, vol. 31, pp. 3681–3695, 2023

    2023

  5. [13]

    Prosody Is Not Identity: A Speaker Anonymization Approach Using Prosody Cloning,

    S. Meyer, F. Lux, J. Koch, P. Denisov, P. Tilli, and N. T. Vu, “Prosody Is Not Identity: A Speaker Anonymization Approach Using Prosody Cloning,” in ICASSP 2023 - 2023 IEEE Interna- tional Conference on Acoustics, Speech and Signal Processing (ICASSP), 2023, pp. 1–5

    2023

  6. [14]

    Branchformer: Parallel MLP-attention architectures to capture local and global context for speech recognition and understanding,

    Y . Peng, S. Dalmia, I. Lane, and S. Watanabe, “Branchformer: Parallel MLP-attention architectures to capture local and global context for speech recognition and understanding,” in Inter- national Conference on Machine Learning (ICML) , 2022, pp. 17 627–17 643

    2022

  7. [15]

    ECAPA- TDNN: Emphasized Channel Attention, Propagation and Ag- gregation in TDNN Based Speaker Verification,

    B. Desplanques, J. Thienpondt, and K. Demuynck, “ECAPA- TDNN: Emphasized Channel Attention, Propagation and Ag- gregation in TDNN Based Speaker Verification,” in Interspeech 2020, 2020, pp. 3830–3834

    2020

  8. [16]

    HiFi-GAN: Generative Adversar- ial Networks for Efficient and High Fidelity Speech Synthesis,

    J. Kong, J. Kim, and J. Bae, “HiFi-GAN: Generative Adversar- ial Networks for Efficient and High Fidelity Speech Synthesis,” in Advances in Neural Information Processing Systems , vol. 33. Curran Associates, Inc., 2020, pp. 17 022–17 033

    2020

  9. [17]

    Speaker Anonymization Using Neural Audio Codec Language Models,

    M. Panariello, F. Nespoli, M. Todisco, and N. Evans, “Speaker Anonymization Using Neural Audio Codec Language Models,” in ICASSP 2024 - 2024 IEEE International Conference on Acous- tics, Speech and Signal Processing (ICASSP) , 2024, pp. 4725– 4729

    2024

  10. [18]

    High Fidelity Neural Audio Compression,

    A. D ´efossez, J. Copet, G. Synnaeve, and Y . Adi, “High Fidelity Neural Audio Compression,” Transactions on Machine Learning Research, 2023, featured Certification, Reproducibility Certifica- tion

    2023

  11. [19]

    wav2vec 2.0: a framework for self-supervised learning of speech representa- tions,

    A. Baevski, H. Zhou, A. Mohamed, and M. Auli, “wav2vec 2.0: a framework for self-supervised learning of speech representa- tions,” in Proceedings of the 34th International Conference on Neural Information Processing Systems , ser. NIPS ’20. Red Hook, NY , USA: Curran Associate...

    2020

  12. [20]

    A comparison of discrete and soft speech units for improved voice conversion,

    B. van Niekerk, M.-A. Carbonneau, J. Za ¨ıdi, M. Baas, H. Seut ´e, and H. Kamper, “A comparison of discrete and soft speech units for improved voice conversion,” in Proc. ICASSP. IEEE, 2022, pp. 6562–6566

    2022

  13. [21]

    Preserving spoken con- tent in voice anonymisation with character-level vocoder condi- tioning,

    M. Panariello, M. Todisco, and N. Evans, “Preserving spoken con- tent in voice anonymisation with character-level vocoder condi- tioning,” in 4th Symposium on Security and Privacy in Speech Communication, 2024, pp. 12–16

    2024

  14. [22]

    V oicePAT: An Efficient Open- Source Evaluation Toolkit for V oice Privacy Research,

    S. Meyer, X. Miao, and N. T. Vu, “V oicePAT: An Efficient Open- Source Evaluation Toolkit for V oice Privacy Research,” IEEE Open Journal of Signal Processing, vol. 5, pp. 257–265, 2024

    2024

  15. [23]

    Lib- rispeech: An ASR corpus based on public domain audio books,

    V . Panayotov, G. Chen, D. Povey, and S. Khudanpur, “Lib- rispeech: An ASR corpus based on public domain audio books,” in 2015 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), 2015, pp. 5206–5210

    2015

  16. [24]

    Evaluating V oice Conversion- Based Privacy Protection against Informed Attackers,

    B. M. Lal Srivastava, N. Vauquier, M. Sahidullah, A. Bellet, M. Tommasi, and E. Vincent, “Evaluating V oice Conversion- Based Privacy Protection against Informed Attackers,” inICASSP 2020 - 2020 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP),...

    2020

  17. [25]

    BigVGAN: A Universal Neural V ocoder with Large-Scale Train- ing,

    S. gil Lee, W. Ping, B. Ginsburg, B. Catanzaro, and S. Yoon, “BigVGAN: A Universal Neural V ocoder with Large-Scale Train- ing,” in The Eleventh International Conference on Learning Rep- resentations, 2023

    2023

  18. [26]

    V ocos: Closing the gap between time-domain and Fourier-based neural vocoders for high-quality audio synthesis,

    H. Siuzdak, “V ocos: Closing the gap between time-domain and Fourier-based neural vocoders for high-quality audio synthesis,” in The Twelfth International Conference on Learning Representa- tions, 2024

    2024

  19. [27]

    V ocoder drift compensation by x-vector alignment in speaker anonymisation,

    ——, “V ocoder drift compensation by x-vector alignment in speaker anonymisation,” in 3rd Symposium on Security and Pri- vacy in Speech Communication, 2023, pp. 16–20

    2023

  20. [28]

    Semi-Orthogonal Low-Rank Matrix Factor- ization for Deep Neural Networks,

    D. Povey, G. Cheng, Y . Wang, K. Li, H. Xu, M. Yarmohammadi, and S. Khudanpur, “Semi-Orthogonal Low-Rank Matrix Factor- ization for Deep Neural Networks,” in Interspeech 2018, 2018, pp. 3743–3747

    2018

  21. [29]

    Modeling Pseudo- Speaker Uncertainty in V oice Anonymization,

    L. Chen, K. A. Lee, W. Guo, and Z.-H. Ling, “Modeling Pseudo- Speaker Uncertainty in V oice Anonymization,” in ICASSP 2024 - 2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), 2024, pp. 11 601–11 605

    2024

  22. [30]

    HLTCOE JHU Submission to the V oice Privacy Challenge 2024,

    H. L. Xinyuan, Z. Cai, A. Garg, K. Duh, L. P. Garc ´ıa-Perera, S. Khudanpur, N. Andrews, and M. Wiesner, “HLTCOE JHU Submission to the V oice Privacy Challenge 2024,” in 4th Sym- posium on Security and Privacy in Speech Communication, 2024, pp. 61–66

    2024

  23. [31]

    LibriTTS: A Corpus Derived from LibriSpeech for Text-to-Speech,

    H. Zen, V . Dang, R. Clark, Y . Zhang, R. J. Weiss, Y . Jia, Z. Chen, and Y . Wu, “LibriTTS: A Corpus Derived from LibriSpeech for Text-to-Speech,” inInterspeech 2019, 2019, pp. 1526–1530

    2019

  24. [32]

    V ocoder drift in x- vector–based speaker anonymization,

    M. Panariello, M. Todisco, and N. Evans, “V ocoder drift in x- vector–based speaker anonymization,” inInterspeech 2023, 2023, pp. 2863–2867

    2023

  25. [34]

    Differ- entially Private Speaker Anonymization,

    A. S. Shamsabadi, B. M. L. Srivastava, A. Bellet, N. Vauquier, E. Vincent, M. Maouche, M. Tommasi, and N. Papernot, “Differ- entially Private Speaker Anonymization,”Proceedings on Privacy Enhancing Technologies, 2023

    2023

  26. [35]

    James, D

    G. James, D. Witten, T. Hastie, and R. Tibshirani, An Introduc- tion to Statistical Learning: with Applications in R . Springer Publishing Company, Incorporated, 2014

    2014

  27. [36]

    Speaker Anonymisation Using the McAdams Coefficient,

    J. Patino, N. Tomashenko, M. Todisco, A. Nautsch, and N. Evans, “Speaker Anonymisation Using the McAdams Coefficient,” inIn- terspeech 2021, 2021, pp. 1099–1103

    2021

  28. [2024]

    Available: https://arxiv.org/abs/2404.02677

    [Online]. Available: https://arxiv.org/abs/2404.02677

    arXiv

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.