Evaluating Voice Conversion based Privacy Protection against Informed Attackers

Brij Mohan Lal Srivastava, Nathalie Vauquier, Md Sahidullah, Aurélien Bellet, Marc Tommasi and Emmanuel Vincent

Context

• Distinguishable and Repeatable biometric references can be extracted from speech
• Speech processing raises privacy threats
• Anonymization ensures that original speaker cannot be linked to the published anonymized dataset
• The anonymized data must be fit for use in downstream tasks

Contributions

• Compare 3 anonymization methods based on voice conversion
• Definition of target voice selection strategies
• Characterization of attacker’s knowledge about the anonymization scheme
• Evaluation of privacy and utility

Threat model

Voice conversion based anonymization

Voice conversion

• Logical speaker anonymization framework
  • Convert source speaker’s voice to a target speaker
  • Conversion may not be perfect, residual source speaker info might be present
  • Choice of target speaker is critical for strength of anonymization
• Allows data publication
• First proposed in 2009 [2], many techniques proposed thereafter

VC methods: criteria

1. Non-parallel
2. Many-to-many
3. Source/language independent

Three VC methods

1. VoiceMask: simple frequency warping based on composition of two functions $B$ and $Q$: $ f’ = B(Q(f, \alpha), \beta) $
2. Vocal Tract Length Normalization: learn transformation parameters between source and target class spectra
3. Disentangled Speech Representation: separate encoders for content (instance normalization) and speaker (average pooling) information

Anonymization Model

Anonymization framework

Target selection strategies

Design of Attackers

Ignorant attacker

Semi-Informed attacker

Informed attacker

Experiments

Training data

Evaluation data

Evaluation protocol

• Attackers are simulated using speaker verification, which produce PLDA scores
• Measure of privacy: Equal Error Rate (EER) computed using PLDA scores
• Measure of utility: Word Error Rate (WER)

Results

Results on privacy (EER)

PLDA score distribution

• More overlap between the score distributions ensures more privacy
• Overlap decreases as we move from Ignorant to Informed attacker

Results on utility (WER)

Conclusion

• Investigated VC algorithms for speaker anonymization
• Target selection and attacker’s knowledge are critical for strength of anonymization
• Simple methods can provide reasonable protection