Pith. sign in

REVIEW 2 major objections 5 minor 40 references

Speech tokens exposed by end-to-end speech models leak voiceprints: three seconds of frontend output lets SpInv recover a speaker embedding with cosine similarity above 0.70.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-01 19:41 UTC pith:TR3S357O

load-bearing objection Plausible and important claim about speech-token voiceprint leakage, but the verification protocol is under-specified—same-utterance trials could inflate the headline numbers. the 2 major comments →

arxiv 2607.16870 v1 pith:TR3S357O submitted 2026-07-18 cs.SD cs.AIcs.CR

Do Speech Tokens Leak Voiceprints? Speaker Inversion Attacks Against End-to-End Speech Language Models

Ye Lu , Yihan Yan , Zhaoyang Zhang , Zhitao Ou , Runze Liu , Li Liu , Shen Wang This is my paper
classification cs.SD cs.AIcs.CR
keywords speech tokensspeaker inversion attackvoiceprint leakagespeech language modelsAudio BERTspeaker embedding recoveryspeech privacydiscrete speech frontends
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper asks whether the discrete speech tokens that end-to-end speech language models use to carry audio still harbor enough speaker identity to be inverted back into a voiceprint. It claims yes: an attacker who observes three seconds of token output can train a recovery model, SpInv, to produce an embedding in the attacker's chosen speaker-recognition space that matches the victim's true embedding at cosine similarity above 0.70 for Moshi, Higgs3, Kimi-Audio, and Qwen3-Omni. This matters because such tokens are often the natural hand-off point in split inference, where user speech is tokenized locally and sent to a cloud model; if the claim holds, that hand-off is a practical voiceprint-leakage channel. The paper further argues that the leakage appears across discrete codebook, hybrid discrete-continuous, and fully continuous frontend interfaces, and that training with query access to the frozen frontend on public data is sufficient to build the attack.

Core claim

SpInv shows that the high-level speech representations emitted by end-to-end speech language models preserve speaker-discriminative information that can be inverted without the waveform. With only a three-second slice of exposed frontend output, the trained AuB model plus projection head recovers an embedding in an attacker-specified speaker-encoder space: cosine similarity exceeds 0.70 on unseen speakers for the three token-based frontends, speaker-verification accuracy reaches 0.97-0.98 on VoxCeleb2-test, and equal error rates drop as low as 0.017. A dedicated leakage diagnostic on the VoxCeleb1 verification split confirms that all four interfaces, including the purely continuous Qwen3-Omn

What carries the argument

AuB (Audio BERT) is the trainable component that carries the inversion. For each frame it maps every discrete codebook ID to a learned embedding, sums the embeddings across codebooks, fuses in any time-aligned continuous features through an MLP, and feeds the sequence through a BERT backbone; the CLS output is projected into the attacker-selected speaker-embedding space. SpInv trains AuB in two stages: a distillation stage aligns recovered embeddings to a frozen teacher speaker encoder while EMA self-distillation (DINO-style) and variance/covariance regularizers prevent collapse, followed by a discriminative fine-tuning stage with an ArcMargin speaker classifier. Only AuB and the projection

Load-bearing premise

The attack's success depends on the adversary being able to query the victim's exact frozen frontend on public audio during attack training, and on the deployed interface continuing to expose plain, unchanged token IDs with known codebook counts and vocabulary sizes when the attack runs.

What would settle it

Take one of the four frontends and re-run the same three-second protocol while encrypting or one-time-padding the token IDs between frontend and backbone (or after a single codebook-vocabulary update), then measure whether cosine similarity stays above 0.70; if it drops, the leakage is conditional on the plaintext stable-interface assumption rather than inherent to the acoustic content.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

Share X Bluesky LinkedIn Reddit HN

If this is right

  • If the claim holds, split-inference deployments that transmit frontend token streams to a downstream model expose speaker identity to any party able to observe that stream.
  • Three seconds of exposed tokens is enough for near-practical speaker verification: recovered embeddings reach EER as low as 0.017 and accuracy above 0.96 on held-out speakers.
  • The leakage is not tied to one codec design; residual-codebook, eight-codebook, hybrid semantic-plus-continuous, and fully continuous frontends all show it.
  • Longer observations strengthen recovery up to saturation around eight to ten seconds, so even short intercepted utterances are a meaningful risk.
  • Changing the attacker's target speaker encoder does not neutralize the attack; SpInv adapts to ECAPA-TDNN, ERes2Net, and CAM++ spaces with similar recovery quality.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • A natural next step the paper leaves implicit: if recovered embeddings transfer even partially to enrollment in commercial voice-biometric systems, intercepted token bursts could support unauthorized speaker matching without any waveform reconstruction.
  • The dependency on plain, stable token interfaces suggests a cheap defensive test: encrypt, one-time-pad, or periodically remap token IDs between frontend and backbone, then see whether recovery collapses; if it does, the leakage is largely an interface-design problem.
  • Because any legitimate downstream model that consumes speech tokens internally could run the same inversion, privacy protection likely has to live inside the tokenizer itself, for instance through explicit speaker-suppression objectives rather than by hiding the token stream.
  • The method's compatibility with continuous frontend features implies the attack surface may extend beyond discrete speech tokens to any learned audio representation passed between modules, which is worth probing on other model families.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

2 major / 5 minor

Summary. The paper asks whether speech tokens exposed by end-to-end speech language models leak voiceprints. It proposes Audio BERT (AuB), a trainable model that maps discrete codebook IDs and/or continuous frontend features into token embeddings and aggregates them with a BERT backbone, and SpInv, a two-stage training procedure (DINO/VICReg-style distillation pretraining plus ArcMargin discriminative fine-tuning) to recover a speaker embedding in an attacker-specified speaker-encoder space from a short intercepted token slice. The method is evaluated on Moshi, Higgs3, Kimi-Audio, and Qwen3-Omni frontends under speaker-disjoint VoxCeleb protocols, reporting cosine similarity above 0.70 on the three token-based frontends, Acc above 0.93, and EER as low as about 0.017 with 3-second input. Ablations vary input duration and target speaker encoder.

Significance. If the reported results hold, the paper demonstrates a timely and practically relevant privacy channel: discrete speech tokens exposed at the frontend/downstream boundary of speech language models preserve enough speaker information for an adversary to recover useful embeddings in a chosen speaker space. The work is stronger than much prior audio-privacy work in evaluating on speaker-disjoint VoxCeleb splits, covering four different frontend interface types, and testing multiple target speaker encoders. The threat model is explicit, and the experiments use public datasets and pretrained models. The main weakness is that the verification-style metrics appear to compare embeddings extracted from the same utterance, so the central claim that the recovered embeddings act as cross-utterance voiceprints is not yet established. If this is corrected with cross-utterance trial evaluation, the contribution would be significant for the speech-privacy community.

major comments (2)
  1. The verification protocol is underspecified and appears to use same-utterance enrollment and probe. In Section III.D the student model receives local views derived from utterance i and the frozen teacher receives a teacher view of the same utterance i; the alignment loss and the reported CosSim compare the recovered embedding \hat z_i with z_i = F(x_i^t) for the same utterance. The paper never states that positive verification trials use different utterances of the same speaker. If Acc/EER are computed from same-utterance pairs, the numbers can reflect acoustic, channel, and content cues of one recording rather than speaker identity across sessions. A voiceprint-leakage claim requires cross-utterance matching: enrollment from one recording, probe from another. Please state the trial construction explicitly and report cross-utterance CosSim, Acc, EER, and score distributions, with at leas
  2. All headline numbers come from a single training run without error bars or seed variance. Given the random initialization, DINO prototype/EMA schedules, and multi-loss training, it is not possible to tell whether differences such as Moshi EER 0.0305 vs Higgs3 EER 0.0174 are meaningful or within run-to-run noise. Reporting at least three seeds with mean and std (or a similar stability measure) for the main tables would materially strengthen the empirical claim.
minor comments (5)
  1. For Acc, the threshold is said to be the optimal cosine-score decision boundary, which is optimistic if chosen on the test set. Please clarify whether EER/minDCF thresholds are selected on held-out development data or on the test set, and report calibration details.
  2. For purely continuous frontends such as Qwen3-Omni, there are no codebooks; the text should state explicitly that \mathbf{e}_n is omitted (or set to zero) and clarify how AuB handles a stream with only the MLP-projected continuous feature.
  3. The minDCF values at 1 s and 2 s (0.6670, 0.4050) are much larger than the 3 s value and look qualitatively inconsistent with the reported Acc values. Please check the definition/normalization and provide an explanation, since this may be a typo or an artifact of the evaluation threshold.
  4. Please state the number of evaluation utterances N in Tables II--III, how many random crops are used per utterance at evaluation time, and whether the target frontend outputs are used deterministically. This is needed for reproducibility and for interpreting CosSim as an average over utterances or crops.
  5. The paper does not mention release of code or trained checkpoints. Given the multi-stage training and many hyperparameters, a public release or a detailed reproducibility appendix would be valuable.

Circularity Check

0 steps flagged

No circularity: token-to-embedding recovery is trained on frozen external encoders and tested on speaker-disjoint data; the same-utterance trial caveat affects interpretation, not the derivation.

full rationale

The derivation chain is not circular. SpInv trains G_theta to map exposed frontend outputs R(x) to target embeddings z=F(x), where F is a frozen external speaker encoder (ECAPA-TDNN, ERes2Net, CAM++), via L_align in Eq. (7) plus relational/self-distillation/regularization terms. Training uses VoxCeleb2-dev; Tables II and III evaluate on speaker-disjoint VoxCeleb2-test and VoxCeleb1, so the high CosSim/Acc/EER values are held-out generalization to unseen speakers, not a restatement of the training fit. There is no equation-level identity between the discrete/continuous token inputs and the target speaker embedding: the tokens are a lossy frontend transform, and the mapping is learned. No load-bearing self-citation, uniqueness theorem, or ansatz-via-citation is used; the self-cited [24] appears only as related-work context. One evaluation-design caveat, not circularity: Section IV-C defines z_i and the recovered embedding from the same utterance i, and the paper does not state whether verification positives use a different utterance of the same speaker, so the 'speaker-verification sense' may reflect same-utterance acoustic/content covariation. This is a missing cross-utterance validation, not an equivalence-by-construction.

Axiom & Free-Parameter Ledger

4 free parameters · 4 axioms · 0 invented entities

The paper introduces no new physical or mathematical entities. Its load-bearing assumptions are (1) the validity of the frozen speaker-encoder space as ground truth, (2) adversary capability to query/run the target frontend, and (3) the speaker-disjoint protocol. The free parameters are standard training hyperparameters; they are numerous but not individually load-bearing, and the paper reports some but not all sensitivity (duration ablated; loss weights not).

free parameters (4)
  • Loss weights (lambda_1..lambda_5, mu_1..mu_6) = lambda = (1.0, 0.5, 1.0, 25.0, 1.0); mu = (0.2, 0.8, 0.4, 0.4, 10.0, 0.5)
    Hand-chosen weights controlling the relative strength of alignment, relational, DINO, variance, covariance, and ArcMargin losses. The central result (CosSim versus target encoder) depends on these values, and no sensitivity analysis is reported.
  • ArcMargin margin schedule and logit scale = margin ramps 0 -> 0.2 between epochs 10 and 20 of Stage B; scale s not given numerically
    Discriminative fine-tuning hyperparameters that affect EER/Acc of recovered embeddings; no ablation is shown for them.
  • DINO EMA momentum schedule, center momentum, number of prototypes K = EMA 0.996 -> 0.9995 cosine; center momentum 0.9; K unspecified
    Self-distillation hyperparameters not ablated; their values change the learned representation but likely not the qualitative leakage conclusion.
  • Segment duration for attack = 3 seconds default; 1/2/5/8/10 s ablated
    The headline 'above 0.70' is tied to the 3-second choice; the paper honestly reports that 1 second gives 0.49 CosSim, showing the result is duration-dependent.
axioms (4)
  • domain assumption The speaker encoder F (ECAPA-TDNN, ERes2Net, CAM++) yields a stable, semantically meaningful speaker space such that cosine similarity in that space measures voiceprint identity.
    The entire evaluation treats F's embedding space as the ground truth for 'voiceprint.' This is standard speaker-verification practice and is stated in Section III-A(b), but the paper does not independently validate F's accuracy on its own eval split.
  • domain assumption The adversary can run the exact frozen target frontend (Moshi, Higgs3, Kimi-Audio, Qwen3-Omni) on a large public dataset during attack training.
    Section III-A(c) grants query access to the target frontend T. For locally deployed open models this is plausible, but for proprietary hosted frontends it may not hold; the whole attack depends on this capability.
  • domain assumption VoxCeleb1 and VoxCeleb2-dev are speaker-disjoint as claimed by the standard protocol, and the frontends' outputs on VoxCeleb are representative of real-world token streams.
    The speaker-disjoint claim is loaded from the dataset protocol (Section IV-A(b)). The paper follows the standard partition but does not verify identity non-overlap on its own.
  • standard math Standard background results used as building blocks: BERT (Devlin et al.), DINO self-distillation (Caron et al.), VICReg variance/covariance regularization (Bardes et al.), ArcFace/ArcMargin (Deng et al.).
    These are unproved background methods the pipeline composes; they are standard and cited.

pith-pipeline@v1.3.0-alltime-deepseek · 16 in / 8848 out tokens · 65648 ms · 2026-08-01T19:41:15.349591+00:00 · methodology

0 comments
Cite this review

Pith. "Pith review of Do Speech Tokens Leak Voiceprints? Speaker Inversion Attacks Against End-to-End Speech Language Models." pith.science (2026). https://pith.science/paper/TR3S357O

@misc{pith2026260716870,
  author       = {Pith},
  title        = {Pith review of: Do Speech Tokens Leak Voiceprints? Speaker Inversion Attacks Against End-to-End Speech Language Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/TR3S357O}},
  note         = {Machine review of arXiv:2607.16870}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

End-to-end speech language models increasingly represent user speech with speech tokens rather than relying exclusively on cascaded ASR--LLM--TTS pipelines. Although these tokens support expressive and low-latency spoken interaction, they may also preserve sensitive speaker characteristics. We investigate whether exposed speech tokens leak voiceprints and formulate this risk as a speaker inversion attack. We introduce Audio BERT (AuB), a trainable model that constructs token embeddings from discrete codebooks and aggregates them into speaker-sensitive representations, and propose SpInv, a two-stage inversion method built on AuB to recover embeddings in the space of an attacker-specified speaker encoder. We evaluate Moshi, Higgs3, Kimi-Audio, and Qwen3-Omni using speaker-disjoint protocols on the VoxCeleb dataset. Extensive experiments show that, with only three seconds of frontend output, SpInv achieves cosine similarities above 0.70 in the attacker-specified speaker-encoder space.

Figures

Figures reproduced from arXiv: 2607.16870 by Li Liu, Runze Liu, Shen Wang, Ye Lu, Yihan Yan, Zhaoyang Zhang, Zhitao Ou.

Figure 1
Figure 1. Figure 1: Attack scenario. User speech is converted into speech tokens before large-model inference. An eavesdropper or curious provider observing the exposed [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Overview of SpInv. The training phase learns a recovery model from frontend outputs via two-stage optimization; the attack phase recovers a speaker [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

40 extracted references · 7 linked inside Pith

  1. [1]

    The secret revealer: Generative model-inversion attacks against deep neural networks,

    Y . Zhang, R. Jia, H. Pei, W. Wang, B. Li, and D. Song, “The secret revealer: Generative model-inversion attacks against deep neural networks,” inProc. IEEE/CVF Conf. Comput. Vis. Pattern Recognit. (CVPR), 2020, pp. 253–261

    2020

  2. [2]

    SpeechGPT: Empowering large language models with intrinsic cross- modal conversational abilities,

    D. Zhang, S. Li, X. Zhang, J. Zhan, P. Wang, Y . Zhou, and X. Qiu, “SpeechGPT: Empowering large language models with intrinsic cross- modal conversational abilities,” inFindings Assoc. Comput. Linguist. (EMNLP), 2023, pp. 15 757–15 773

    2023

  3. [3]

    Spoken question answering and speech continuation using spectrogram-powered LLM,

    E. Nachmani, A. Levkovitch, R. Hirsch, J. Salazar, C. Asawaroengchai, S. Mariooryad, E. Rivlin, R. J. Skerry-Ryan, and M. Tadmor Ra- manovich, “Spoken question answering and speech continuation using spectrogram-powered LLM,” inProc. Int. Conf. Learn. Represent. (ICLR), 2024

    2024

  4. [4]

    PSLM: Parallel generation of text and speech with LLMs for low-latency spoken dialogue systems,

    K. Mitsui, K. Mitsuda, T. Wakatsuki, Y . Hono, and K. Sawada, “PSLM: Parallel generation of text and speech with LLMs for low-latency spoken dialogue systems,” inFindings Assoc. Comput. Linguist. (EMNLP), 2024, pp. 2692–2700

    2024

  5. [5]

    Moshi: A speech-text foundation model for real-time dialogue,

    A. D ´efossez, L. Mazar ´e, M. Orsini, A. Royer, P. P ´erez, H. J ´egou, E. Grave, and N. Zeghidour, “Moshi: A speech-text foundation model for real-time dialogue,”arXiv preprint arXiv:2410.00037, 2024

    Pith/arXiv arXiv 2024

  6. [6]

    Higgs TTS 3: Conversational speech for voice AI from Boson AI,

    Boson AI, “Higgs TTS 3: Conversational speech for voice AI from Boson AI,” https://huggingface.co/bosonai/higgs-tts-3-4b, 2026

    2026

  7. [7]

    OmniV oice: Towards omnilingual zero-shot text-to-speech with diffusion language models,

    H. Zhu, L. Ye, W. Kang, Z. Yao, L. Guo, F. Kuang, Z. Han, W. Zhuang, L. Lin, and D. Povey, “OmniV oice: Towards omnilingual zero-shot text-to-speech with diffusion language models,”arXiv preprint arXiv:2604.00688, 2026

    Pith/arXiv arXiv 2026

  8. [8]

    Kimi-Audio technical report,

    Kimi Team, D. Ding, Z. Ju, Y . Leng, S. Liu, T. Liu, Z. Shang, K. Shen, W. Song, X. Tanet al., “Kimi-Audio technical report,”arXiv preprint arXiv:2504.18425, 2025

    Pith/arXiv arXiv 2025

  9. [9]

    Qwen3-Omni technical report,

    J. Xu, Z. Guo, H. Hu, Y . Chu, X. Wang, J. He, Y . Wang, X. Shi, T. He, X. Zhuet al., “Qwen3-Omni technical report,”arXiv preprint arXiv:2509.17765, 2025

    Pith/arXiv arXiv 2025

  10. [10]

    Speaker verification using adapted gaussian mixture models,

    D. A. Reynolds, T. F. Quatieri, and R. B. Dunn, “Speaker verification using adapted gaussian mixture models,”Digit. Signal Process., vol. 10, no. 1–3, pp. 19–41, 2000

    2000

  11. [11]

    Joint factor analysis versus eigenchannels in speaker recognition,

    P. Kenny, G. Boulianne, P. Ouellet, and P. Dumouchel, “Joint factor analysis versus eigenchannels in speaker recognition,”IEEE Trans. Audio Speech Lang. Process., vol. 15, no. 4, pp. 1435–1447, 2007

    2007

  12. [12]

    Front- end factor analysis for speaker verification,

    N. Dehak, P. J. Kenny, R. Dehak, P. Dumouchel, and P. Ouellet, “Front- end factor analysis for speaker verification,”IEEE Trans. Audio Speech Lang. Process., vol. 19, no. 4, pp. 788–798, 2011

    2011

  13. [13]

    Deep neural networks for small footprint text-dependent speaker verification,

    E. Variani, X. Lei, E. McDermott, I. Lopez Moreno, and J. Gonzalez- Dominguez, “Deep neural networks for small footprint text-dependent speaker verification,” inProc. IEEE Int. Conf. Acoust. Speech Signal Process. (ICASSP), 2014, pp. 4052–4056

    2014

  14. [14]

    End-to-end text-dependent speaker verification,

    G. Heigold, I. Lopez-Moreno, S. Bengio, and N. Shazeer, “End-to-end text-dependent speaker verification,” inProc. IEEE Int. Conf. Acoust. Speech Signal Process. (ICASSP), 2016, pp. 5115–5119

    2016

  15. [15]

    Generalized end- to-end loss for speaker verification,

    L. Wan, Q. Wang, A. Papir, and I. Lopez Moreno, “Generalized end- to-end loss for speaker verification,” inProc. IEEE Int. Conf. Acoust. Speech Signal Process. (ICASSP), 2018, pp. 4879–4883

    2018

  16. [16]

    X-vectors: Robust DNN embeddings for speaker recognition,

    D. Snyder, D. Garcia-Romero, G. Sell, D. Povey, and S. Khudanpur, “X-vectors: Robust DNN embeddings for speaker recognition,” inProc. IEEE Int. Conf. Acoust. Speech Signal Process. (ICASSP), 2018, pp. 5329–5333

    2018

  17. [17]

    V oxCeleb2: Deep speaker recognition,

    J. S. Chung, A. Nagrani, and A. Zisserman, “V oxCeleb2: Deep speaker recognition,” inProc. Annu. Conf. Int. Speech Commun. Assoc. (Inter- speech), 2018, pp. 1086–1090

    2018

  18. [18]

    Pushing the limits of self-supervised speaker verification using regularized distillation framework,

    Y . Chen, S. Zheng, H. Wang, L. Cheng, and Q. Chen, “Pushing the limits of self-supervised speaker verification using regularized distillation framework,” inProc. IEEE Int. Conf. Acoust. Speech Signal Process. (ICASSP), 2023, pp. 1–5

    2023

  19. [19]

    Self-distillation prototypes network: Learning robust speaker representations without supervision,

    Y . Chen, S. Zheng, H. Wang, L. Cheng, Q. Chen, C. Deng, S. Zhang, and W. Wang, “Self-distillation prototypes network: Learning robust speaker representations without supervision,” inProc. IEEE Int. Conf. Acoust. Speech Signal Process. (ICASSP), 2025, pp. 1–5

    2025

  20. [20]

    ECAPA-TDNN: Emphasized channel attention, propagation and aggregation in TDNN based speaker verification,

    B. Desplanques, J. Thienpondt, and K. Demuynck, “ECAPA-TDNN: Emphasized channel attention, propagation and aggregation in TDNN based speaker verification,” inProc. Annu. Conf. Int. Speech Commun. Assoc. (Interspeech), 2020, pp. 3830–3834

    2020

  21. [21]

    CAM++: A fast and efficient network for speaker verification using context- aware masking,

    H. Wang, S. Zheng, Y . Chen, L. Cheng, and Q. Chen, “CAM++: A fast and efficient network for speaker verification using context- aware masking,” inProc. Annu. Conf. Int. Speech Commun. Assoc. (Interspeech), 2023, pp. 5301–5305

    2023

  22. [22]

    An enhanced Res2Net with local and global feature fusion for speaker verifi- cation,

    Y . Chen, S. Zheng, H. Wang, L. Cheng, Q. Chen, and J. Qi, “An enhanced Res2Net with local and global feature fusion for speaker verifi- cation,” inProc. Annu. Conf. Int. Speech Commun. Assoc. (Interspeech), 2023, pp. 2228–2232

    2023

  23. [23]

    Model inversion attacks that exploit confidence information and basic countermeasures,

    M. Fredrikson, S. Jha, and T. Ristenpart, “Model inversion attacks that exploit confidence information and basic countermeasures,” inProc. ACM SIGSAC Conf. Comput. Commun. Secur. (CCS), 2015, pp. 1322– 1333

    2015

  24. [24]

    FGMIA: Feature- guided model inversion attacks against face recognition models,

    Y . Lu, S. Wang, G. Zhu, Z. Zhang, and J. Huang, “FGMIA: Feature- guided model inversion attacks against face recognition models,”IEEE Trans. Inf. Forensics Secur., vol. 20, pp. 8465–8480, 2025

    2025

  25. [25]

    Model inversion attacks through target-specific conditional diffusion models,

    O. Li, Y . Hao, Z. Wang, B. Zhu, S. Wang, Z. Zhang, and F. Feng, “Model inversion attacks through target-specific conditional diffusion models,” arXiv preprint arXiv:2407.11424, 2024

    Pith/arXiv arXiv 2024

  26. [26]

    Text embeddings reveal (almost) as much as text,

    J. X. Morris, V . Kuleshov, V . Shmatikov, and A. M. Rush, “Text embeddings reveal (almost) as much as text,” inProc. Conf. Empir. Methods Nat. Lang. Process. (EMNLP), 2023, pp. 12 448–12 460

    2023

  27. [27]

    Text embedding inversion security for multilingual language models,

    Y . Chen, H. Lent, and J. Bjerva, “Text embedding inversion security for multilingual language models,” inProc. Annu. Meet. Assoc. Comput. Linguist. (ACL), 2024, pp. 7808–7827

    2024

  28. [28]

    Introducing model inversion attacks on automatic speaker recognition,

    K. Pizzi, F. Boenisch, U. Sahin, and K. B ¨ottinger, “Introducing model inversion attacks on automatic speaker recognition,” inProc. Symp. Secur. Priv. Speech Commun. (SPSC), 2022, pp. 11–16

    2022

  29. [29]

    Inference attacks for x-vector speaker anonymization,

    L. A. Bauer, W. Bao, M. Jadhav, and V . Bindschaedler, “Inference attacks for x-vector speaker anonymization,” inProc. IEEE Secur. Priv. Workshops (SPW), 2025, pp. 152–159

    2025

  30. [30]

    V oxGuard: Evaluating user and attribute privacy in speech via membership inference attacks,

    E. Tsaprazlis, T. Lertpetchpun, T. Feng, S. P. Karimireddy, and S. Narayanan, “V oxGuard: Evaluating user and attribute privacy in speech via membership inference attacks,” inProc. IEEE Int. Conf. Acoust. Speech Signal Process. (ICASSP), 2026, pp. 19 042–19 046

    2026

  31. [31]

    Scores know Bob’s voice: Speaker impersonation attack,

    C. Hwang, S. Kim, Y . K. Tan, T. Liu, S. Paik, D. Kim, M. Soumik, K. M. M. Aung, and J. H. Seo, “Scores know Bob’s voice: Speaker impersonation attack,”arXiv preprint arXiv:2603.02781, 2026

    arXiv 2026

  32. [32]

    HearSay benchmark: Do audio LLMs leak what they hear?

    J. Wang, K. Luo, L. Lin, W. Wang, Y . Chen, M. Aloqaily, X. Tang, Z. Zhou, K. Wang, L. Sun, and Q. Wen, “HearSay benchmark: Do audio LLMs leak what they hear?” inFindings Assoc. Comput. Linguist. (ACL), 2026, pp. 19 312–19 331

    2026

  33. [33]

    An image is worth 16x16 words: Transformers for image recognition at scale,

    A. Dosovitskiy, L. Beyer, A. Kolesnikov, D. Weissenborn, X. Zhai, T. Unterthiner, M. Dehghani, M. Minderer, G. Heigold, S. Gelly, J. Uszkoreit, and N. Houlsby, “An image is worth 16x16 words: Transformers for image recognition at scale,” inProc. Int. Conf. Learn. Represent. (ICLR), 2021

    2021

  34. [34]

    BERT: Pre-training of deep bidirectional transformers for language understanding,

    J. Devlin, M.-W. Chang, K. Lee, and K. Toutanova, “BERT: Pre-training of deep bidirectional transformers for language understanding,” inProc. North Am. Chapter Assoc. Comput. Linguist.: Hum. Lang. Technol. (NAACL-HLT), 2019, pp. 4171–4186

    2019

  35. [35]

    Layer normalization,

    J. L. Ba, J. R. Kiros, and G. E. Hinton, “Layer normalization,”arXiv preprint arXiv:1607.06450, 2016

    Pith/arXiv arXiv 2016

  36. [36]

    Gaussian error linear units (GELUs),

    D. Hendrycks and K. Gimpel, “Gaussian error linear units (GELUs),” arXiv preprint arXiv:1606.08415, 2016

    Pith/arXiv arXiv 2016

  37. [37]

    VICReg: Variance-invariance- covariance regularization for self-supervised learning,

    A. Bardes, J. Ponce, and Y . LeCun, “VICReg: Variance-invariance- covariance regularization for self-supervised learning,” inProc. Int. Conf. Learn. Represent. (ICLR), 2022

    2022

  38. [38]

    Emerging properties in self-supervised vision transformers,

    M. Caron, H. Touvron, I. Misra, H. J ´egou, J. Mairal, P. Bojanowski, and A. Joulin, “Emerging properties in self-supervised vision transformers,” inProc. IEEE/CVF Int. Conf. Comput. Vis. (ICCV), 2021, pp. 9650– 9660

    2021

  39. [39]

    ArcFace: Additive angular margin loss for deep face recognition,

    J. Deng, J. Guo, N. Xue, and S. Zafeiriou, “ArcFace: Additive angular margin loss for deep face recognition,” inProc. IEEE/CVF Conf. Comput. Vis. Pattern Recognit. (CVPR), 2019, pp. 4690–4699

    2019

  40. [40]

    V oxCeleb: A large- scale speaker identification dataset,

    A. Nagrani, J. S. Chung, and A. Zisserman, “V oxCeleb: A large- scale speaker identification dataset,” inProc. Annu. Conf. Int. Speech Commun. Assoc. (Interspeech), 2017, pp. 2616–2620

    2017