DAST: A Dual-Stream Voice Anonymization Attacker with Staged Training
Abstract
Voice anonymization masks vocal traits while preserving linguistic content, which may still leak speaker-specific patterns. To assess and strengthen privacy evaluation, we propose a dual-stream attacker that fuses spectral and self-supervised learning features via parallel encoders with a three-stage training strategy. Stage I establishes foundational speaker-discriminative representations. Stage II leverages the shared identity-transformation characteristics of voice conversion and anonymization, exposing the model to diverse converted speech to build cross-system robustness. Stage III provides lightweight adaptation to target anonymized data. Results on the VoicePrivacy Attacker Challenge (VPAC) dataset demonstrate that Stage II is the primary driver of generalization, enabling strong attacking performance on unseen anonymization datasets. With Stage III, fine-tuning on only 10\% of the target anonymization dataset surpasses current state-of-the-art attackers in terms of EER.
The following analysis is generated by AI and may contain errors. It is separate from the authors’ abstract and is not peer review.
Research summary
The main contribution of this paper is the introduction of DAST, a dual-stream voice anonymization attacker that utilizes a novel three-stage training strategy to enhance the robustness of voice anonymization systems against re-identification attacks. This work represents a meaningful advancement in the field of voice privacy, combining innovative methodology with rigorous experimental validation to address a critical issue in audio machine learning.
Methodology
The proposed DAST architecture employs a dual-stream model that effectively combines spectral and self-supervised learning features through a three-stage training strategy. This approach is innovative as it not only leverages the strengths of both feature types but also introduces a structured training curriculum that progressively builds the model's capabilities. The staged training allows for robust generalization across different anonymization systems, which is a significant improvement over existing methods that typically focus on single-system training. The methodology is well-justified with theoretical backing and empirical validation through ablation studies.
Results & evaluation
The experiments are rigorously designed, utilizing the VoicePrivacy Attacker Challenge (VPAC) dataset to evaluate the model's performance. The results demonstrate that the DAST model outperforms existing state-of-the-art attackers, particularly in terms of equal error rates (EER). The systematic evaluation of each training stage provides clear insights into the contributions of the dual-stream architecture and the effectiveness of the three-stage training approach. The use of diverse datasets for training and testing further strengthens the validity of the results.
Reproducibility
The paper includes detailed descriptions of the experimental setup, including the datasets used, training configurations, and evaluation metrics. However, it lacks a direct link to code or models, which could hinder reproducibility. The authors mention plans to release pre-trained models upon acceptance, which is a positive step towards facilitating reproducibility.
Limitations
One limitation is the reliance on the specific datasets used for training and evaluation, which may not fully capture the diversity of real-world anonymization scenarios. Additionally, while the model shows strong performance on the VPAC dataset, its effectiveness on other anonymization systems or in practical applications remains to be fully assessed. The paper does not address potential ethical concerns related to the misuse of voice anonymization attacks.
Broader impact
The research has significant implications for privacy protection in voice communication, particularly as voice technologies become more prevalent. By improving the robustness of voice anonymization systems against re-identification attacks, the work contributes to enhancing user privacy and security. The findings could influence future designs of anonymization systems and inform policy discussions around voice data privacy. The main contribution of this paper is the introduction of DAST, a dual-stream voice anonymization attacker that utilizes a novel three-stage training strategy to enhance the robustness of voice anonymization systems against re-identification attacks. This work represents a meaningful advancement in the field of voice privacy, combining innovative methodology with rigorous experimental validation to address a critical issue in audio machine learning.
Author of this paper? Send a correction.