The paper introduces a two‑stage speech anonymization framework that preserves both linguistic content and acoustic identity. It replaces personally identifiable information using a generative editing model and applies a flow‑matching anonymization technique (F3‑VA) to create diverse, distinct anonymized speakers. The authors evaluate privacy with speaker verification metrics and utility by training ASR, TTS, and SER models from scratch, showing stronger privacy protection with minimal utility loss compared to existing baselines.
By Yunchong Xiao, Yuxiang Zhao, Ziyang Ma, Shuai Wang, Kai Yu, Jiachun Liao, Xie Chen
The paper demonstrates that the multilingual voice cloning model XTTSv2 can be repurposed for speaker anonymization without retraining. By conditioning on a pseudo-speaker and using an iterative refinement strategy, the authors balance privacy and intelligibility, achieving near‑optimal privacy (EER ≈ 0.49) and competitive speech quality across seven European languages. The method outperforms dedicated anonymization baselines and requires no language‑specific training.
By Romolo Muletta, Felix Matthias Saaro, Mark Cieliebak, Jan Deriu
arXiv:2607. 03985v1 Announce Type: cross Abstract: Advanced neural technologies in speech synthesis and voice conversion (VC) have introduced severe risks to personal privacy, necessitating robust Speaker Anonymization Systems (SAS).
By Meiying Melissa Chen, Anastasia Kuznetsova, Zhenyu Wang, Zhiyao Duan
The paper introduces VoxPrivacy, a benchmark for assessing interactional privacy in Speech Language Models (SLMs). It evaluates models on a 32‑hour bilingual dataset across three difficulty tiers, revealing that most open‑source SLMs perform near random on conditional privacy decisions and even strong closed‑source systems struggle with proactive privacy inference. The authors also validate these findings on a real‑speech subset and show that fine‑tuning on a 4,000‑hour training set can improve privacy‑preserving capabilities while maintaining robustness.
By Yuxiang Wang, Hongyu Liu, Dekun Chen, Xueyao Zhang, Zhizheng Wu
arXiv:2607. 09767v1 Announce Type: cross Abstract: The paper presents a voice anonymization model focusing on preserving content rather than producing realistic speech.
By Adrien Schneider (M-PSI), Kacper Zabkowski (M-PSI), Anderson Augusma (M-PSI), Fr\'ed\'erique Letu\'e (SAM, SVH), Maria Camila Pinzon (M-PSI), Dominique Vaufreydaz (M-PSI)
The paper investigates how acoustic and content-oriented speaker verification attacks perform against multilingual voice anonymization. It evaluates both attacker types on anonymized speech, builds a multilingual voice-converted dataset to enhance cross‑lingual generalization, and finds that attack success depends on how much linguistic utility is preserved. Acoustic‑oriented attacks generally outperform content‑oriented ones, but the performance gap narrows when linguistic information is well maintained, and the new dataset improves results while reducing cross‑lingual disparities.
By Ridwan Arefeen, Ze Li, Rong Tong, Ming Li, Xiaoxiao Miao
arXiv:2606. 29897v1 Announce Type: cross Abstract: Voice anonymization aims to protect speaker identity while preserving linguistic content and speech usability.
By Pranav Tushar, Xiao Xiao Miao, Rong Tong
PHONOS is a real‑time streaming module for speaker anonymization that neutralizes accent cues by converting non‑native segmental realizations toward a target accent domain. It uses pre‑generated golden utterances that preserve timbre and rhythm, aligning them with silence‑aware DTW and applying zero‑shot voice conversion to supervise a causal accent translator. The system achieves an 81% reduction in non‑native accent confidence, improves accentedness ratings, reduces speaker linkability in embedding space, and operates with ≤241 ms end‑to‑end latency on a single GPU.
By Waris Quamer, Mu-Ruei Tseng, Ghady Nasrallah, Ricardo Gutierrez-Osuna
The paper investigates how privacy-preserving sanitization of user context in large language model (LLM) interactions affects downstream performance. It identifies three mechanisms—Context‑Dependent Utility, Strategic Adaptation, and Combinatorial Interplay—that explain when and how to sanitize data. Based on these insights, the authors propose an intent‑driven local protection framework using a lightweight model (Veilmind‑4B) to dynamically extract, sanitize, and restore context, achieving lower privacy leakage while maintaining higher utility than existing baselines.
By Zhenhua Liu, Zhanxu Xie, Junjie Yu, Tong Zhu, Lijun Li, Wenliang Chen
The paper introduces a black-box membership inference attack framework tailored for fine-tuned text-to-speech models, addressing challenges in query generation and representation engineering. It evaluates five query types, finding recitation queries most effective, and uses multi-level speech embeddings with temporal alignment for fine-grained comparison. Experiments on CosyVoice2, F5-TTS, and XTTS-v2 trained on VCTK and British Dialect datasets show high privacy leakage, with speaker-level AUC above 0.80 and record-level AUC between 0.80 and 0.90.
By Kunlin Cai, Kaiyuan Zhang, Zihang Xiang, Jinghuai Zhang, Abeer Alwan, Fnu Suya, Yuan Tian
The paper examines whether word error rate adequately measures privacy in speech by applying entity‑aware metrics from NLP to evaluate two obfuscation techniques. It focuses on protecting named entities and explores how fine‑tuning on entity‑rich data affects attack success across different entity categories. The authors also offer guidance on choosing metrics depending on whether the obfuscation preserves temporal alignment.
By Anjana Rajasekhar, Jule Pohlhausen, Nayana Jacob Alappattu, Anna Leschanowsky
DP-MIND is a memory‑guided framework that enables differentially private inference for large language models on million‑token contexts. It locally perturbs user queries and processes them in chunks, using a compact memory that retains task‑relevant information across the sequence. The memory construction is optimized via reinforcement learning on perturbed inputs, and a local denoising module recovers corrupted answer spans, resulting in improved scalability and utility over existing DP and long‑context inference baselines.
By Zhihao Liu, Yitian Cheng, Shuang Liu, Rui Wen, Yuke Hu, Zhan Qin