Text to speech models get new way to prove ownership securely
TTS-Guard: Black-Box Ownership Verification of Text-to-Speech Models via Adaptive Adversarial Speaker-Pair Fingerprints
Sound
Summary
High-quality voice cloning technology makes it easy to copy text-to-speech (TTS) models without permission, creating problems for owners. The authors designed TTS-Guard, a method that can verify who owns a TTS model by creating special hidden voice patterns that survive common modifications. These patterns let owners prove their models are being used without consent, even if the copied voice is altered or degraded. The method works well across many existing TTS systems while keeping the voices natural and clear.
What this means in practice
- •For speech technology companies: Verify unauthorized use of proprietary TTS models by detecting unique voice fingerprints resilient to model modifications and audio attacks.$Commercial implications: Enables companies to protect and enforce ownership of commercial TTS products by proving model theft in a legally reliable way.
- •For audio security teams: Identify tampering or unauthorized cloning of voice synthesis systems by using adaptive adversarial fingerprints that resist common signal processing attacks.
Authors
Xubin Yue, Zhenhua Xu, Zhebo Wang, Mengting Li, Zijie Zhou, Wenpeng Xing, Dezhang Kong, Meng Han
Abstract
The rapid maturation of zero-shot Text-to-Speech (TTS) models has turned high-quality voice cloning into a widely available capability, raising acute concerns over unauthorised replication, fine-tuning and resale of proprietary speech models. Yet ownership verification for TTS remains largely open: speech is a continuous waveform whose perturbations are easily destroyed by routine signal processing, and the human auditory system imposes a much tighter perceptual budget than vision. We present \textbf{TTS-Guard}, a black-box ownership verification framework for TTS models built on \emph{adversarial speaker-pair fingerprints}. TTS-Guard(i) selects key speaker pairs in a \emph{dual} embedding space for architecture-agnostic stealth;(ii) optimises a perturbation through an \emph{adaptive curriculum} of shadow models covering fine-tuning, pruning, quantisation and distillation; and (iii) aggregates black-box queries into a calibrated \emph{Verification Confidence Score}. On five mainstream TTS systems, TTS-Guard reaches an average Fingerprint Success Rate of $96.4\%$ at a False Positive Rate of $5.8\%$, while preserving intelligibility and naturalness. The fingerprint remains effective against ten audio attacks, six model modifications, and two state-of-the-art adversarial purifiers.