Privacy-Utility Balanced Voice De-Identification Using Adversarial Examples

TL;DR

This paper introduces a novel voice de-identification system using adversarial examples that balance privacy and utility, preserving voice quality while preventing automatic speaker identification, with diverse target embedding capabilities.

Contribution

The study proposes a convolutional adversarial example approach modulating room impulse responses and a conditional variational auto-encoder for adaptive, diverse voice de-identification.

Findings

Achieves 98% successful de-identification on mainstream ASIs.

Maintains high voice perceptual quality with a mean opinion score of 4.48.

Demonstrates effective privacy-utility trade-off in voice data publishing.

Abstract

Faced with the threat of identity leakage during voice data publishing, users are engaged in a privacy-utility dilemma when enjoying convenient voice services. Existing studies employ direct modification or text-based re-synthesis to de-identify users' voices, but resulting in inconsistent audibility in the presence of human participants. In this paper, we propose a voice de-identification system, which uses adversarial examples to balance the privacy and utility of voice services. Instead of typical additive examples inducing perceivable distortions, we design a novel convolutional adversarial example that modulates perturbations into real-world room impulse responses. Benefit from this, our system could preserve user identity from exposure by Automatic Speaker Identification (ASI) while remaining the voice perceptual quality for non-intrusive de-identification. Moreover, our system learns a compact speaker distribution through a conditional variational auto-encoder to sample diverse target embeddings on demand. Combining diverse target generation and input-specific perturbation construction, our system enables any-to-any identify transformation for adaptive de-identification. Experimental results show that our system could achieve 98% and 79% successful de-identification on mainstream ASIs and commercial systems with an objective Mel cepstral distortion of 4.31dB and a subjective mean opinion score of 4.48.