On the Generation and Removal of Speaker Adversarial Perturbation for Voice Privacy Protection
Abstract
Recent development in adversarial perturbation has shown the usefulness of the technique for voice privacy protection. This paper examines the situation where an entity generating the speaker adversarial perturbations is authorized (e.g., the speaker him/herself) to remove them and restore the original speech. Similar technique could also be used to restore criminals’ identities in security and forensic analysis. In this settings, the process of perturbation removal is well-informed of the perturbation generation. To this end, a joint training framework of the modules for both perturbation generation and removal is proposed. Our experiments on the LibriSpeech dataset demonstrated that the adversarial perturbations added to the original speech can be predicted from the adversarial speech sample. By removing these perturbations from the adversarial sample, the original speech can be restored.
Samples' Information
Here, we showcase the adversarial utterances generated using the SSED to attack the ECAPA-TDNN model and the restored utterances generated by our reverse perturbation generator from adversarial utterances. We randomly selected one sentence each from 3 males and 3 females of librispeech test-clean dataset and using these original samples to generate adversarial and restored samples . In this context, 'Original' is defined as the original speech, 'Adversarial' as the adversarial speech with perturbation added , 'Restored' as the restored speech which is the adversarial speech with reverse perturbation added, 'Perturbation' as the perturbation and 'Perturbation_augment' as the sound of perturbation augmenting its amplitude by 20 times.