Do Speech Tokens Leak Voiceprints? Speaker Inversion Attacks Against End-to-End Speech Language Models
Abstract
End-to-end speech language models increasingly represent user speech with speech tokens rather than relying exclusively on cascaded ASR--LLM--TTS pipelines. Although these tokens support expressive and low-latency spoken interaction, they may also preserve sensitive speaker characteristics. We investigate whether exposed speech tokens leak voiceprints and formulate this risk as a speaker inversion attack. We introduce Audio BERT (AuB), a trainable model that constructs token embeddings from discrete codebooks and aggregates them into speaker-sensitive representations, and propose SpInv, a two-stage inversion method built on AuB to recover embeddings in the space of an attacker-specified speaker encoder. We evaluate Moshi, Higgs3, Kimi-Audio, and Qwen3-Omni using speaker-disjoint protocols on the VoxCeleb dataset. Extensive experiments show that, with only three seconds of frontend output, SpInv achieves cosine similarities above 0.70 in the attacker-specified speaker-encoder space.
The following analysis is generated by AI and may contain errors. It is separate from the authors’ abstract and is not peer review.
Research summary
The paper presents a significant and timely contribution to the intersection of speech processing and machine learning security. By formulating and executing a speaker inversion attack against modern end-to-end speech language models, it exposes a critical privacy vulnerability in emerging AI architectures. The proposed SpInv method is technically robust, leveraging advanced distillation and contrastive learning techniques to recover speaker embeddings from discrete tokens with high fidelity. The comprehensive evaluation across multiple state-of-the-art models and rigorous experimental protocols strengthens the validity of the findings. This work is essential reading for researchers and practitioners in speech AI, highlighting the urgent need for privacy-preserving design patterns in next-generation speech interfaces.
Methodology
The paper proposes a novel threat model called "Speaker Inversion Attack" (SIA) against end-to-end speech language models (SLMs). The core methodological contribution is SpInv, a two-stage attack framework. Stage A uses a distillation pretraining approach with an auxiliary model called Audio BERT (AuB) to map discrete speech tokens (or continuous features) to a target speaker embedding space defined by a frozen encoder (e.g., ECAPA-TDNN). This involves alignment loss, relational loss, and self-distillation (DINO-style) to prevent collapse and preserve geometry. Stage B fine-tunes the model with discriminative supervision (ArcFace) to enhance speaker discrimination. The approach is technically sound, leveraging established contrastive and distillation techniques (DINO, VICReg) in a new context. The mapping from discrete tokens to continuous embeddings via a learned lookup table is a clever adaptation to handle the black-box nature of the tokenizers.
Results & evaluation
The evaluation is comprehensive and rigorous. The authors test against four state-of-the-art SLM frontends (Moshi, Higgs3, Kimi-Audio, Qwen3-Omni), covering different tokenization strategies (residual codebooks, hybrid, continuous). They use speaker-disjoint protocols on VoxCeleb1 and VoxCeleb2, which is crucial for validating generalization. The results are strong: cosine similarities >0.70 are achieved with only 3 seconds of audio. The ablation studies on input duration and target speaker encoder spaces add depth. The fact that they test on "Qwen3-Omni" (which appears to be a very recent or potentially misnamed model in the context of current public releases, possibly referring to Qwen-Audio or a specific internal variant, but treated as a valid target here) suggests the work is timely. The metrics (CosSim, EER, Acc) are appropriate for the task.
Reproducibility
The paper provides detailed descriptions of the AuB architecture, loss functions, and training hyperparameters (learning rates, batch sizes, loss weights). The datasets (VoxCeleb1/2) and target encoders (ECAPA-TDNN, etc.) are publicly available. The threat model assumes query access to the frontend, which is a standard and realistic assumption for API-based services. The code is not explicitly linked, but the methodological description is sufficient for reproduction by a competent researcher.
Limitations
The authors acknowledge two main limitations: focusing on embedding recovery rather than waveform reconstruction, and using only VoxCeleb datasets. The reliance on VoxCeleb, while standard, may not fully capture the diversity of "in-the-wild" speech (accents, noise, channel variations) that might be present in real-world SLM deployments. Additionally, the attack requires a training phase where the adversary collects data from the target frontend; while feasible, this is a resource-intensive prerequisite. The paper does not explore defense mechanisms, only the attack.
Broader impact
This work has significant implications for the privacy of users interacting with AI voice assistants and SLMs. It demonstrates that even when raw audio is not transmitted, the intermediate representations (tokens) can leak sensitive biometric information (voiceprints). This necessitates the development of privacy-preserving tokenization techniques or anonymization methods for speech tokens. It serves as a wake-up call for the SLM community to consider privacy in the design of frontend tokenizers. The paper presents a significant and timely contribution to the intersection of speech processing and machine learning security. By formulating and executing a speaker inversion attack against modern end-to-end speech language models, it exposes a critical privacy vulnerability in emerging AI architectures. The proposed SpInv method is technically robust, leveraging advanced distillation and contrastive learning techniques to recover speaker embeddings from discrete tokens with high fidelity. The comprehensive evaluation across multiple state-of-the-art models and rigorous experimental protocols strengthens the validity of the findings. This work is essential reading for researchers and practitioners in speech AI, highlighting the urgent need for privacy-preserving design patterns in next-generation speech interfaces.
Author of this paper? Send a correction.