Voice Privacy with Smart Digital Assistants in Educational Settings^††thanks: A version of this paper will appear in ITS 2021.

Different modalities of privacy protection including voice de-identification were discussed in [21]. As one of the earliest attempts over thirty years ago, a text-dependent voice-conversion method based on vector quantization and spectral mapping was developed in [3], which had the limitation of using a parallel corpora for training. Various methods such as [17] and [15] were then developed to remove this limitation and use non-parallel data for training, which is more practical for implementation. In addition to these methods that perform some kind of conversion from a source speaker to a target speaker, numerous methods (e.g. [4]), were developed to distort the voice by changing the pitch or some other basic characteristics of an input voice so that the resulted voice would sound synthetic and difficult to identify. A recent effort was carried out by Qian et al. [20], in which a frequency warping function to the frequency domain signal was applied to change the voiceprint, and thereby hiding the identity. While there were promising results in this work, their method depends on a careful selection of the parameter values thereby reducing its applicability to different datasets with different acoustic conditions.

Depending on the application, a reversible conversion may or may not be desirable. In [7], a conversion based on Gaussian mixture model (GMM) mapping was used to convert voices of several source speakers to that of one synthetic target speaker. Having the conversion keys, one can revert the transformations and go back to the original voices. As the same authors showed in [8], increasing the number of speakers can lead to better de-identification and naturalness. Nevertheless, converting voices to synthetic voices has the drawback that if the system is hacked, the attacker will realize a conversion must have been performed on the voices as they sound synthetic, so they will try to revert the conversions by either hacking the system to access the conversion keys or even reverse engineering to estimate those keys.

An approach that converts voices to synthetic ones and can still be very difficult or impossible to revert to the original voices was adopted in [9]. In this approach, the input speech is first recognized with a diphone-based recognition system and converted into phonetic transcription. Then, a new synthetic speech is produced by a speech synthesis subsystem using the phonetic transcription. Although this approach offers a high level of protection of speaker identity, it requires an accurate diphone-based recognition system, which has its own challenges due to the limitations of such systems in different noise conditions and dealing with different accents.

Another approach that can perform online voice de-identification and avoids some of the drawbacks of the above-mentioned methods was proposed in [19]. In this approach, a set of pre-calculated voice transformations based on GMM mapping is used to convert the voice of a new speaker to a synthetic voice. In order to select the best transformation, a speaker identification method is first applied to the incoming voice, then the appropriate transformation is selected. This approach which is inspired by approaches used for face de-identification (e.g. k-Same [16]), does not need a parallel corpus even for training of the initial set of transformations based on GMM mapping. However, in this approach, the target speaker was again a synthetic voice, which was trained using speech from four different male speakers. Therefore, if the system is hacked, the privacy can be compromised for the above-mentioned reasons.

To address several drawbacks of the previous related work, we propose a framework that uses non-parallel data for training, with human sounding voice targets, which makes it more difficult to speculate if the original voices were transformed in the first place. Also, the targets for consecutive utterances are randomly selected to increase the robustness of the proposed method against reversing attempts. Moreover, the method can be applied to new users not seen in the training phase and with minimal/no need for dataset-specific tuning.

In summary, we develop an efficient framework for voice privacy that is practical to implement in real-time by using a combination of speaker identification and speech conversion techniques, and developing a mapping approach for maximal speaker obfuscation with minimal impact on ASR accuracy. We demonstrate the efficacy of our framework with real-world voice utterances; our results show that we achieve obfuscation in a variety of source-target combinations while maintaining high ASR accuracy compared to the original speech.

The rest of the paper is organized as follows: Sec. 2 describes the methodology used for de-identification to ensure privacy. Sec. 3 describes our experiments including data collection and results. Sec. 4 concludes the paper with some future directions.

In order to assess the performance of the proposed framework, 880 utterances were recorded from one woman and four men (176 each), where three men were native English speakers with American accent. The recorded utterances were typical examples of commands given to voice assistant systems in an educational setting such as “go back to the beginning of a video”, “mute”, “speak louder”, “yes”, etc. The data were recorded at 16 kHz using a miniDSP UMIK-1 microphone inside a quiet room. The data were further preprocessed to obtain mono ‘.wav’ files at 16 bits.

For the training dataset, VCC2016 dataset [23] was used. In this dataset, there are utterances from five male and five female subjects ($n$=10) that were recorded in a high-quality setting. These data went through two independent steps of model generation:

• •

  For each speaker, an SID model was created. This results in 10 models.

• •

  For each pair of speakers as source and target, a conversion model was created. This results in 90 models.

Different combinations of source-target subsets were evaluated to identify the subset with the lowest Word Error Rate (WER). Table 1 reports the WER statistics for different subsets on the outputs obtained from a major technology vendor’s cloud ASR platform [5] when an appropriate list of commands, which goes beyond the commands used by the users in the dataset was provided as the input context to the ASR. The p75 results for the WER show success of the conversion in most cases. As seen, the lowest WER was obtained when both male and female speakers were used as candidates to map the source, and only male speakers were used as the random target. This phenomenon may be caused by the inherent characteristics of the CycleGAN-VC2 method such that male targets that generally have lower voice fundamental frequencies lead to higher-quality outputs. Another possibility is that since the ASR engines were probably trained with datasets that have more male voices, these engines are generally more successful when the input utterance is from a male speaker than a female speaker. Therefore, for the remainder of the results, we focus on the conversion system where the source is chosen to be the closest speaker from all 10 speakers in the training dataset, and the target is selected randomly from the 5 male speakers.

In order to evaluate the de-identification performance of the proposed method, different approaches may be adopted. In a real-world scenario, the cloud speech processing systems will not necessarily already have the labels for each speaker to train a model for the given speaker and use it later to identify that person. Hence, they need to address the speaker identification task with an unsupervised method whose performance is expected to improve as more data are received. Moreover, these engines typically receive the original voice from each speaker, not randomized converted voices which may sound significantly different from the original voice. Nevertheless, to simplify things in favor of a cloud SID system aiming at identifying speakers and potentially compromise their privacy, we assumed that the system already has some training data on original voices of each speaker with labels and generated SID models based on them (same SID approach as discussed in Sec. 2). Then, we compared the performance of SID with unconverted and converted test data. In order to do so, we randomly divided the data of 880 utterances to train and test sets with 70% and 30% portions, respectively. The SID on the original unconverted test data was 100% accurate with all utterances being perfectly classified. However, when the converted version of the same utterances were tested with the SID, the accuracy was only 20.45% with 210 out of 264 utterances mis-classified (essentially random selection of speaker). This shows the effectiveness of the proposed framework in disguising the identity of the speakers.

Finally, the inference computation time of the proposed framework was calculated for the input utterances to determine the feasibility of the method in real-time applications. Fig. 2 shows the computation time for speaker identification and voice conversion on a machine with an Nvidia GPU (1080 GTX), with less than 10% GPU utilization. As seen, speaker identification is performed very fast and remains under  0.2s even for an utterance of  7s. Voice conversion takes longer and a delay of  0.5s is observed for short utterances of  1s, which can be negligible in most applications. Nevertheless, as the duration of utterances increases, the delays become smaller and for any utterances of 2s and longer, the conversion can be run real time.