From Speech Tokens to Stolen Voices: Attacker-Chosen-Text Speaker Impersonation via Representation Inversion

Ye Lu; Shen Wang; Runze Liu; Zhitao Ou; Haonan Huang; Yihan Yan; Fanghui Sun; Zhaoyang Zhang

cs.SDOct 26, 2026

From Speech Tokens to Stolen Voices: Attacker-Chosen-Text Speaker Impersonation via Representation Inversion

Authors: Ye Lu, Shen Wang, Runze Liu, Zhitao Ou, Haonan Huang, Yihan Yan, Fanghui Sun, Zhaoyang Zhang

Organizations: School of Cyberspace Science, Harbin Institute of Technology

Abstract

Speech interaction systems have gradually evolved from traditional cascaded systems that use text as intermediate information to end-to-end speech language models that directly process speech representations. In some applications, the speech frontend runs on the user's device and sends speech representations to a remote server for inference, while the original audio remains local. However, these representations may still contain speaker identity information. If an attacker obtains them, it may use this information to imitate the user's voice, threatening their voice privacy. To investigate this risk, we propose \stia, a Speech Token Inversion Attack that generates speech with attacker-specified text in a victim's voice using a single short leaked representation, without access to the original audio or its transcript. Specifically, \stia converts discrete, continuous, or mixed speech representations into conditioning sequences and trains a conditional flow-matching speech generation model using pairs of different utterances from the same speaker in public speech datasets. The model combines speaker characteristics contained in the leaked representation with the specified text to generate speech in the victim's voice. Experiments show that, with a Moshi representation leak corresponding to 3 seconds of speech, \stia achieves an average CAM++ speaker cosine similarity of 0.78 and a target-text word error rate of 3.80%. These results show that speech frontend representations reveal reusable speaker identity information and highlight the need to consider privacy risks when designing speech frontend representation methods.

Figures & tables

Fig. 1: Split-deployment setting and STIA attack overview. The attacker combines leaked frontend representations with chosen text to generate speech; the boxes on the right state the attack objectives.

Fig. 2: Overview of STIA . (a) Cross-utterance training with flow-matching, codec, and stopping losses. (b) Generation from leaked representations and chosen text via Euler sampling and codec decoding.

Target model	Frontend model	Frontend processing pipeline	Frontend output format	Output dimension
Moshi	Mimi neural audio codec	24-kHz mono waveform $\rightarrow$ causal SEANet encoder (strides $4,5,6,8,2$ ) $\rightarrow$ 8-layer, 8-head Transformer $\rightarrow$ 8-stage split RVQ	Frame-synchronous discrete RVQ code-index streams at 12.50 Hz	8 scalar IDs/frame; 2,048 entries per stage
Kimi-Audio	GLM-4-Voice semantic tokenizer and adapted Whisper encoder	16-kHz mono waveform $\rightarrow$ 128-bin log-Mel features $\rightarrow$ parallel semantic and acoustic branches: 32-layer tokenizer with single-codebook VQ; four 1,280-D Whisper frames with a 2-layer adaptor	Aligned semantic ID and continuous acoustic feature at 12.50 Hz	1 scalar ID $+$ 3,584-D vector/frame
Qwen3-Omni	Audio Transformer (AuT) encoder	16-kHz mono waveform $\rightarrow$ 128-bin log-Mel features (25-ms window, 10-ms hop) $\rightarrow$ three stride-2 Conv2D blocks $\rightarrow$ 32-layer, 650M-parameter AuT (width 1,280)	Frame-synchronous continuous AuT hidden sequence at 12.50 Hz	2,048-D vector/frame

TABLE I: Audio frontend architectures, processing pipelines, output formats, and representation dimensions of Moshi, Kimi-Audio, and Qwen3-Omni at the input-side interfaces evaluated in the split-deployment attack setting.

Target model	Attack	CAM $\uparrow$	ECAPA $\uparrow$	WER (%) $\downarrow$	UTMOS $\uparrow$
Moshi	SpInv+TTS	$0.22\pm 0.11$	$0.26\pm 0.10$	$13.37\pm 44.99$	$2.91\pm 0.65$
Moshi	STIA (ours)	${\mathbf{0.78}\pm 0.03}_{(\uparrow\,0.56)}$	${\mathbf{0.79}\pm 0.05}_{(\uparrow\,0.53)}$	${\mathbf{3.80}\pm 12.60}_{(\downarrow\,\underline{9.57})}$	${\mathbf{2.92}\pm 0.17}_{(\uparrow\,0.01)}$
Kimi-Audio	SpInv+TTS	$0.13\pm 0.12$	$0.20\pm 0.12$	$12.40\pm 32.40$	$2.87\pm 0.52$
Kimi-Audio	STIA (ours)	${\mathbf{0.82}\pm 0.03}_{(\uparrow\,\underline{0.69})}$	${\mathbf{0.85}\pm 0.05}_{(\uparrow\,\underline{0.65})}$	${\mathbf{3.84}\pm 11.25}_{(\downarrow\,8.55)}$	${\mathbf{2.97}\pm 0.22}_{(\uparrow\,\underline{0.10})}$
Qwen3-Omni	SpInv+TTS	$0.35\pm 0.09$	$0.33\pm 0.10$	$10.56\pm 26.27$	$2.91\pm 0.37$
Qwen3-Omni	STIA (ours)	${\mathbf{0.75}\pm 0.04}_{(\uparrow\,0.40)}$	${\mathbf{0.78}\pm 0.06}_{(\uparrow\,0.45)}$	${\mathbf{4.61}\pm 13.70}_{(\downarrow\,5.95)}$	${\mathbf{2.91}\pm 0.21}_{(\uparrow\,<0.01)}$

TABLE II: Comparison of STIA and SpInv+TTS on unseen Emilia speakers across three speech frontends, using identical 3-second representation leaks and attacker-chosen English prompts.

Language	CAM $\uparrow$	ECAPA $\uparrow$	WER/CER(%) $\downarrow$	UTMOS $\uparrow$
English	0.78	0.79	3.80	2.92
Chinese	${\mathbf{0.82}}_{(\uparrow\,0.04)}$	${\mathbf{0.84}}_{(\uparrow\,0.05)}$	${4.05}_{(\uparrow\,0.25)}$	${2.62}_{(\downarrow\,0.30)}$

TABLE III: Separate English and Chinese evaluations of STIA with language-specific training on Moshi.

Clips(M)	Dura.(h)	CAM $\uparrow$	ECAPA $\uparrow$	WER (%) $\downarrow$	UTMOS $\uparrow$
0.80	2.9k	0.70	0.76	8.98	2.93
1.60	5.9k	${0.76}_{(\uparrow\,0.06)}$	${0.78}_{(\uparrow\,0.03)}$	${5.19}_{(\downarrow\,3.78)}$	${2.92}_{(\downarrow\,<0.01)}$
2.40	8.9k	${\mathbf{0.78}}_{(\uparrow\,0.08)}$	${\mathbf{0.79}}_{(\uparrow\,0.03)}$	${\mathbf{3.80}}_{(\downarrow\,5.17)}$	${2.92}_{(\downarrow\,<0.01)}$

TABLE IV: Effect of auxiliary Emilia-English data budgets on STIA speech generation using the Moshi frontend.

Leakage	CAM $\uparrow$	ECAPA $\uparrow$	WER (%) $\downarrow$	UTMOS $\uparrow$
2.00 s	0.76	0.79	6.24	2.91
3.00 s	${0.78}_{(\uparrow\,0.03)}$	${0.79}_{(\uparrow\,<0.01)}$	${\mathbf{3.80}}_{(\downarrow\,2.44)}$	${\mathbf{2.92}}_{(\uparrow\,0.01)}$
5.00 s	${0.79}_{(\uparrow\,0.03)}$	${0.81}_{(\uparrow\,0.03)}$	${3.85}_{(\downarrow\,2.38)}$	${2.90}_{(\downarrow\,<0.01)}$
8.00 s	${\mathbf{0.80}}_{(\uparrow\,0.04)}$	${\mathbf{0.82}}_{(\uparrow\,0.03)}$	${3.95}_{(\downarrow\,2.29)}$	${2.90}_{(\downarrow\,<0.01)}$

TABLE V: Effect of leaked representation duration on STIA speech generation using the Moshi frontend.

Size	Params	CAM $\uparrow$	ECAPA $\uparrow$	WER (%) $\downarrow$	UTMOS $\uparrow$
XL	0.60B	0.78	0.79	3.80	2.92
L	0.50B	${0.75}_{(\downarrow\,0.03)}$	${0.77}_{(\downarrow\,0.02)}$	${4.71}_{(\uparrow\,0.91)}$	${2.82}_{(\downarrow\,0.10)}$
M	0.35B	${0.70}_{(\downarrow\,0.08)}$	${0.72}_{(\downarrow\,0.07)}$	${7.72}_{(\uparrow\,3.92)}$	${2.59}_{(\downarrow\,0.33)}$

TABLE VI: Effect of STIA model size on speech generation from 3-second Moshi representation leaks.

Input	CAM $\uparrow$	ECAPA $\uparrow$	WER (%) $\downarrow$	UTMOS $\uparrow$
Original	0.78	0.79	3.80	2.92
Anonymized	${0.44}_{(\downarrow\,0.35)}$	${0.43}_{(\downarrow\,0.36)}$	${4.51}_{(\uparrow\,0.71)}$	${2.43}_{(\downarrow\,0.49)}$

TABLE VII: Effect of McAdams input anonymization on a fixed STIA attacker using the Moshi frontend.

Control	CAM $\uparrow$	ECAPA $\uparrow$	WER (%) $\downarrow$	UTMOS $\uparrow$
Standard	0.78	0.79	3.80	2.92
- No-leak	${0.25}_{(\downarrow\,0.54)}$	${0.25}_{(\downarrow\,0.54)}$	${12.94}_{(\uparrow\,9.14)}$	${2.47}_{(\downarrow\,0.44)}$
- No-text	${0.57}_{(\downarrow\,0.21)}$	${0.48}_{(\downarrow\,0.31)}$	—	${2.49}_{(\downarrow\,0.43)}$
- Neither	${0.22}_{(\downarrow\,0.57)}$	${0.26}_{(\downarrow\,0.53)}$	—	${2.49}_{(\downarrow\,0.43)}$
- Wrong text	${0.75}_{(\downarrow\,0.04)}$	${0.71}_{(\downarrow\,0.08)}$	${99.17}_{(\uparrow\,95.37)}$	${\mathbf{3.08}}_{(\uparrow\,0.16)}$

TABLE VIII: Leakage-conditioning and target-text controls for STIA speech generation using the Moshi frontend.

Setting	Value
Optimizer / precision	AdamW / BF16
Effective batch size	64
Training steps	150,000
Peak / final learning rate	$2.00\times 10^{-4}$ / $2.00\times 10^{-5}$
Warmup / schedule	1,000 steps / cosine decay
Main leak / model	3.00 s / XL (0.60B)

TABLE IX: Training and sampling configuration of STIA and main-model training cost on the Moshi frontend.

Voice Cloning

Voice cloning uses speech samples to reproduce a speaker’s vocal identity in generated speech across different content, languages, and styles.

See all 42 papers

Jul 18, 2026

Do Speech Tokens Leak Voiceprints? Speaker Inversion Attacks Against End-to-End Speech Language Models

End-to-end speech language models increasingly represent user speech with speech tokens rather than relying exclusively on cascaded ASR--LLM--TTS pipelines. Although these tokens support expressive and low-latency spoken interaction, they may also preserve sensitive speaker characteristics. We investigate whether exposed speech tokens leak voiceprints and formulate this risk as a speaker inversion attack. We introduce Audio BERT (AuB), a trainable model that constructs token embeddings from discrete codebooks and aggregates them into speaker-sensitive representations, and propose SpInv, a two-stage inversion method built on AuB to recover embeddings in the space of an attacker-specified speaker encoder. We evaluate Moshi, Higgs3, Kimi-Audio, and Qwen3-Omni using speaker-disjoint protocols on the VoxCeleb dataset. Extensive experiments show that, with only three seconds of frontend output, SpInv achieves cosine similarities above 0.70 in the attacker-specified speaker-encoder space.

Ye Lu, Yihan Yan, Zhaoyang Zhang +4

School of Cyberspace Science, Harbin Institute of Technology, Harbin 150001, China

Adversarial Attacks Privacy Leakage in Language Models Audio Tokenization Speech Language Models

Ask PDF

Mar 8, 2026

Speech Generation Speaker Poisoning: Capability Erasure in Zero-Shot Text-to-Speech

Recent zero-shot Text-to-Speech (TTS) systems can clone previously unseen voices from only a few seconds of audio. We formulate Speech Generation Speaker Poisoning (SGSP), a task that seeks to prevent a model from synthesizing targeted speaker identities while maintaining performance on all other speakers. Unlike conventional machine unlearning, removing training examples is insufficient because modern zero-shot TTS systems can reconstruct identities through learned speaker representations and strong generalization capabilities. We evaluate both inference-time filtering and parameter-modification approaches across settings involving 1, 15, and 100 forget speakers, focusing primarily on speakers seen during training, which we show are harder to suppress than unseen speakers. To characterize the trade-off between utility and privacy, we introduce an evaluation framework based on AUC analysis and a proposed metric, Forget Set Similarity (FSSIM). Our results demonstrate effective speaker suppression for up to 15 forget speakers while revealing that worst-case identity leakage (Max-FSSIM) remains unresolved at multi-speaker scale - establishing this as an open challenge for future work. Together, our work establishes targeted speaker poisoning as a task for zero-shot TTS and, using StyleTTS2 as an initial testbed, provides methods and evaluation protocols for future research, with code and model weights.

Thanathai Lertpetchpun, Thanapat Trachu, Sai Praneeth Karimireddy +1

Signal Analysis and Interpretation Laboratory, University of Southern California · Thomas Lord Department of Computer Science, University of Southern California

TTS Synthesis Zero-Shot TTS Text-to-Speech Voice Cloning

Ask PDF

Mar 9, 2026

Privacy-Preserving End-to-End Full-Duplex Speech Dialogue Models

End-to-end full-duplex speech models feed user audio through an always-on LLM backbone, yet the speaker privacy implications of their hidden representations remain unexamined. Following the VoicePrivacy 2024 protocol with a lazy-informed attacker, we show that the hidden states of SALM-Duplex and Moshi leak substantial speaker identity across all transformer layers. Layer-wise and turn-wise analyses reveal that leakage persists across all layers, with SALM-Duplex showing stronger leakage in early layers while Moshi leaks uniformly, and that Linkability rises sharply within the first few turns. We propose two streaming anonymization setups using Stream-Voice-Anon: a waveform-level front-end (Anon-W2W) and a feature-domain replacement (Anon-W2F). Anon-W2F raises EER by over 3.5x relative to the discrete encoder baseline (11.2% to 41.0%), approaching the 50% random-chance ceiling, while Anon-W2W retains 78-93% of baseline sBERT across setups with sub-second response latency (FRL under 0.8 s).

Nikita Kuzmin, Tao Zhong, Jiajun Deng +6

Nanyang Technological University, Singapore · A*STAR, Singapore · Huawei Leibniz Research Center +2

Privacy-Preserving Speech Processing Speaker Anonymization Speech Language Models Full-Duplex Spoken Dialogue Systems

Ask PDF

Abstract

Voice Cloning

Explore similar work

Do Speech Tokens Leak Voiceprints? Speaker Inversion Attacks Against End-to-End Speech Language Models

Speech Generation Speaker Poisoning: Capability Erasure in Zero-Shot Text-to-Speech

Privacy-Preserving End-to-End Full-Duplex Speech Dialogue Models