Modern speech systems are evolving into ecosystems of autonomous speech agents that interact, negotiate, and trade assets such as embeddings, spectrograms, or raw data. In such markets, sellers cannot reveal assets for evaluation due to privacy constraints, and buyers cannot price what they cannot test. Thus, we introduce WaveCommitments, an end-to-end design that couples multivariate polynomial commitments with confidential asset valuation via Data Shapley inside a trusted execution environment. It enables selective openings and tamper-evident provenance to prove that a delivered asset matches the valuation while hiding everything else. Our extensive experiments across three standard datasets and various tasks with state-of-the-art encoders, including Whisper, reveal that we speed up the strongest baselines by up to 18.1x while reducing their proof sizes by up to 43.2x. We also analyze how a speaker's value shifts across tasks and encoders, revealing agent-level market prices.
Figures & tables
Figure 1: WaveCommitment Architecture: Imagine a SAM where autonomous agents trade proprietary speech knowledge (red) , such as embeddings. Seller s cannot reveal raw utterance u , and buyer a cannot trust unseen embeddings Es or determine their value V for its model Ha . Hence, they both upload their assets to a secure enclave which computes the valuations for each pair confidentially, seals those and the referenced assets into a single digest C to publish in a public bulletin (green) . After a and s handshake based on V , a buys Es and uses C to validate it without exposing other assets.
Figure 2: How to selectively verify speech tensors? WaveTrees (c) organize assets in native time-frequency geometry and return a short proof for the region of interest, unlike Merkle (a) and Verkle (b) trees with larger overhead (outlined boxes). Ours can verify whether a speaker says a phrase in a time window while copyrighted music on background frequencies remains hidden.
Figure 3: Per-Speaker DS for SAM Pricing: For each speaker, we show DS distributions over utterance-level embeddings across three buyer heads (color) and three feature extractors (hatch), computed confidentially in the TEE. This reveals who to buy from and which embedding space best serves each task.
Metric
MT
UCT
WT (Ours)
TIMIT
Commit Size ( ↓ )
32B
32B
32B
Proof Size ( ↓ )
4280B
480B
128B
Commit Time ( ↓ )
12.2 ± 2.6ms
409 ± 8.7ms
32.6 ± 2.8ms
Verify Time ( ↓ )
≈ 1ms
25.2 ± 2.2ms
5.6 ± 1.1ms
IEMOCAP
Commit Size ( ↓ )
32B
32B
32B
Proof Size ( ↓ )
6480B
672B
157B
Table 1: Do SAMs validate the assets fast enough to trade at scale?
Most large language models (LLMs) run on external clouds: users send a prompt, pay for inference, and must trust that the remote GPU executes the LLM without any adversarial tampering. We critically ask how to achieve verifiable LLM inference, where a prover (the service) must convince a verifier (the client) that an inference was run correctly without rerunning the LLM. Existing cryptographic works are too slow at the LLM scale, while non-cryptographic ones require a strong verifier GPU. We propose TensorCommitments (TCs), a tensor-native proof-of-inference scheme. TC binds the LLM inference to a commitment, an irreversible tag that breaks under tampering, organized in our multivariate Terkle Trees. For LLaMA2, TC adds only 0.97% prover and 0.12% verifier time over inference while improving robustness to tailored attacks by up to 48% over the best prior work requiring a verifier GPU.
Oguzhan Baser, Elahe Sadeghi, Eric Wang +5
Electrical and Computer Engineering, The University of Texas at Austin · Theseus AI Labs · Electrical and Computer Engineering, McGill University +1
Provenance watermarking is increasingly treated as a safeguard for synthetic speech, whether built directly into speech-generation models such as Chatterbox, provided through dedicated techniques such as AudioSeal, or deployed by commercial platforms such as ElevenLabs. We identify a previously uncharacterized liability: when synthetic speech is watermarked and human speech is not, detectors trained alongside latch onto the watermark as a spurious "watermark => fake" shortcut. This single feature yields three coupled failures: generalization degradation (model performance deteriorates on unseen data), strip-to-evade (a watermarked fake escapes once unwatermarked), and mark-to-frame (watermarking a real voice flags it as fake). In a controlled white-box experiment, a watermark-trained detector shows all three (for example, mark-to-frame lifts Equal Error Rate from 16% to 75%). In a black-box test of a commercial API, we show that adding a watermark to real speech disguises it as fake. However, this shortcut is fixable: retraining with the watermark on both classes decorrelates it and restores clean behavior. We release experiment data as a paired clean-versus-watermarked corpus (WASP).
Deep neural network-based automatic speaker verification (ASV) systems achieve impressive performance but their embedding representations remain opaque, lacking a structured and perceptually verifiable explanation of the vocal characteristics they encode. Existing approaches either require annotation of speaker attributes or introduce alternative representations whose interpretability is unvalidated with listeners. We propose Listenable Interpretable Speaker Embeddings (LISE), a label-free framework that decomposes pretrained speaker embeddings into a small set of components. This decomposition yields a structured representation that supports the analysis of what information has been encoded by speaker embeddings. LISE preserves ASV performance with negligible EER degradation on x-vector and ECAPA-TDNN. Crucially, the interpretability of these components for human listeners is demonstrated through listening experiments, where participants distinguished speakers with 83.9% accuracy.
Xiaoliang Wu, Chongxin Gan, Ke Liu +2
University of Southampton, United Kingdom · The Hong Kong Polytechnic University, Hong Kong SAR, China · University of Edinburgh, United Kingdom