The paper examines whether word error rate adequately measures privacy in speech by applying entity‑aware metrics from NLP to evaluate two obfuscation techniques. It focuses on protecting named entities and explores how fine‑tuning on entity‑rich data affects attack success across different entity categories. The authors also offer guidance on choosing metrics depending on whether the obfuscation preserves temporal alignment.
By Anjana Rajasekhar, Jule Pohlhausen, Nayana Jacob Alappattu, Anna Leschanowsky
The paper introduces VoxPrivacy, a benchmark for assessing interactional privacy in Speech Language Models (SLMs). It evaluates models on a 32‑hour bilingual dataset across three difficulty tiers, revealing that most open‑source SLMs perform near random on conditional privacy decisions and even strong closed‑source systems struggle with proactive privacy inference. The authors also validate these findings on a real‑speech subset and show that fine‑tuning on a 4,000‑hour training set can improve privacy‑preserving capabilities while maintaining robustness.
By Yuxiang Wang, Hongyu Liu, Dekun Chen, Xueyao Zhang, Zhizheng Wu
The paper introduces a black-box membership inference attack framework tailored for fine-tuned text-to-speech models, addressing challenges in query generation and representation engineering. It evaluates five query types, finding recitation queries most effective, and uses multi-level speech embeddings with temporal alignment for fine-grained comparison. Experiments on CosyVoice2, F5-TTS, and XTTS-v2 trained on VCTK and British Dialect datasets show high privacy leakage, with speaker-level AUC above 0.80 and record-level AUC between 0.80 and 0.90.
By Kunlin Cai, Kaiyuan Zhang, Zihang Xiang, Jinghuai Zhang, Abeer Alwan, Fnu Suya, Yuan Tian
PrivDrift is a benchmark that tests whether user‑disclosed secrets can still be recovered by large language models after the conversation shifts to unrelated topics. It includes 1,000 controlled multi‑turn dialogues with seeded secrets, topic‑drift turns, and standardized extraction probes. Experiments on three LLMs with extended context windows show that dialogue‑level leakage remains substantial—between 38.7% and 54.6%—and is influenced by model, secret type, and persuasion intensity, while additional topic drift does not reliably reduce leakage.
By Luciano Maldonado
The paper examines how supervised fine-tuning (SFT) of large language models can leak personally identifiable information (PII) when the fine-tuning data contains user-provided sensitive details. It introduces COVA, a coverage-aware decoding algorithm that improves targeted PII reconstruction from SFT models, especially when an adversary has limited contextual knowledge about a target. Experiments on medical and legal Q&A datasets show that even small proprietary SFT datasets can lead to significant privacy leakage via PII reconstruction.
By Sae Furukawa, Alina Oprea
arXiv:2608. 19857v1 Announce Type: new Abstract: For AI agents to be useful beyond simple chat, they must hold sensitive user context such as calendars, credentials, health records, and financial data.
By Jaiden Fairoze, Neal Mangaokar, Kamalika Chaudhuri, Sanjam Garg, Saeed Mahloujifar
GhostPrefix is a new synchronization‑free universal adversarial prefix attack that learns a short audio segment to prepend to any live speech, enabling real‑time manipulation of automatic speech recognition (ASR) outputs without needing future utterance knowledge or temporal alignment. The method combines token‑level and representation‑level objectives to maintain stable effects across varying speech contexts and supports prompted, targeted, and untargeted attack modes. Evaluations on 13 open‑source ASR models show high success rates (up to 97.6% in digital settings) and significant impact on downstream AI‑assisted pipelines such as voice assistants and note‑taking tools.
By Shengding Liu, Ashwin Innuganti, Qiben Yan
The paper investigates how acoustic and content-oriented speaker verification attacks perform against multilingual voice anonymization. It evaluates both attacker types on anonymized speech, builds a multilingual voice-converted dataset to enhance cross‑lingual generalization, and finds that attack success depends on how much linguistic utility is preserved. Acoustic‑oriented attacks generally outperform content‑oriented ones, but the performance gap narrows when linguistic information is well maintained, and the new dataset improves results while reducing cross‑lingual disparities.
By Ridwan Arefeen, Ze Li, Rong Tong, Ming Li, Xiaoxiao Miao
InferPriv is a new benchmark that evaluates inferential privacy leakage in large language model (LLM) assistants. It measures whether an honest-but-curious recipient can deduce a user’s sensitive attributes from an LLM’s reply during routine tasks, a type of leakage not captured by existing direct‑leakage benchmarks. Testing five frontier models, the study finds that inferential leakage rates (16.2–25.2%) far exceed direct leakage, even when direct leakage is near zero under privacy‑aware prompts.
By Pengrun Huang, Yiwei Fu, Luoxi Meng, Kamalika Chaudhuri
The paper introduces a two‑stage speech anonymization framework that preserves both linguistic content and acoustic identity. It replaces personally identifiable information using a generative editing model and applies a flow‑matching anonymization technique (F3‑VA) to create diverse, distinct anonymized speakers. The authors evaluate privacy with speaker verification metrics and utility by training ASR, TTS, and SER models from scratch, showing stronger privacy protection with minimal utility loss compared to existing baselines.
By Yunchong Xiao, Yuxiang Zhao, Ziyang Ma, Shuai Wang, Kai Yu, Jiachun Liao, Xie Chen
arXiv:2610. 34688v1 Announce Type: cross Abstract: Speech interaction systems have gradually evolved from traditional cascaded systems that use text as intermediate information to end-to-end speech language models that directly process speech representations.
By Ye Lu, Shen Wang, Runze Liu, Zhitao Ou, Haonan Huang, Yihan Yan, Fanghui Sun, Zhaoyang Zhang
The paper introduces a style-aware paraphrasing method for text anonymization that leverages pretrained large language models to build compact stylistic profiles from minimal samples and rewrite text to suppress identifiable style markers while preserving meaning. It demonstrates that this approach reduces authorship attribution F1 scores by 60‑70% on blog and review datasets, outperforming both differential privacy‑based and non‑DP baselines, and maintains content quality and readability.
By Ahmed Sohair Khan, Estrid He, Monica Wachowicz, Elham Naghizade