Speech tokens enable realistic voice imitation with chosen text
From Speech Tokens to Stolen Voices: Attacker-Chosen-Text Speaker Impersonation via Representation Inversion
SoundArtificial IntelligenceCryptography and SecurityComputer Vision and Pattern RecognitionMultimedia
Summary
Speech systems often send hidden speech information instead of raw audio to protect privacy. The authors show that these hidden speech codes still carry enough voice details for attackers to mimic someone's voice speaking any chosen sentence. They built a tool that, given just a short leaked speech code, can generate new speech in the victim’s voice without needing the original recording or transcript. This reveals potential privacy risks in how speech data is shared and stored.
What this means in practice
- •For voice security teams: Detect vulnerability points where leaked speech features allow unauthorized voice cloning for fraud prevention.
- •For speech software developers: Design speech frontends to minimize leakage of speaker identity from transmitted speech tokens to protect user privacy.
Authors
Ye Lu, Shen Wang, Runze Liu, Zhitao Ou, Haonan Huang, Yihan Yan, Fanghui Sun, Zhaoyang Zhang
Abstract
Speech interaction systems have gradually evolved from traditional cascaded systems that use text as intermediate information to end-to-end speech language models that directly process speech representations. In some applications, the speech frontend runs on the user's device and sends speech representations to a remote server for inference, while the original audio remains local. However, these representations may still contain speaker identity information. If an attacker obtains them, it may use this information to imitate the user's voice, threatening their voice privacy. To investigate this risk, we propose \stia, a Speech Token Inversion Attack that generates speech with attacker-specified text in a victim's voice using a single short leaked representation, without access to the original audio or its transcript. Specifically, \stia converts discrete, continuous, or mixed speech representations into conditioning sequences and trains a conditional flow-matching speech generation model using pairs of different utterances from the same speaker in public speech datasets. The model combines speaker characteristics contained in the leaked representation with the specified text to generate speech in the victim's voice. Experiments show that, with a Moshi representation leak corresponding to 3 seconds of speech, \stia achieves an average CAM++ speaker cosine similarity of 0.78 and a target-text word error rate of 3.80\%. These results show that speech frontend representations reveal reusable speaker identity information and highlight the need to consider privacy risks when designing speech frontend representation methods.