Abstract
We use the term re-identification to refer to the process of recovering the original speaker's identity from anonymized speech outputs. Speaker de-identification systems aim to reduce the risk of re-identification, but most evaluations focus only on individual-level measures and overlook broader risks from soft biometric leakage. We introduce the Soft Biometric Leakage Score (SBLS), a unified method that quantifies resistance to zero-shot inference attacks on non-unique traits such as channel type, age range, dialect, sex of the speaker, or speaking style. SBLS integrates three elements: direct attribute inference using pre-trained classifiers, linkage detection via mutual information analysis, and subgroup robustness across intersecting attributes. Applying SBLS with publicly available classifiers, we show that all five evaluated de-identification systems exhibit significant vulnerabilities. Our results indicate that adversaries using only pre-trained models - without access to original speech or system details - can still reliably recover soft biometric information from anonymized output, exposing fundamental weaknesses that standard distributional metrics fail to capture.
Abstract (translated)
我们使用“重新识别”一词来指代从匿名语音输出中恢复原始说话人身份的过程。说话人去标识化系统旨在降低重新识别的风险，但大多数评估仅关注个体层面的措施，并忽略了来自软生物特征泄漏的更广泛风险。为此，我们引入了软生物特征泄漏评分（SBLS），这是一种统一的方法，用于量化对零样本推理攻击的抗性，这种攻击针对的是非唯一特质，如通道类型、年龄范围、方言、说话人性别或讲话风格。 SBLS整合了三个要素：直接属性推断使用预训练分类器；通过互信息分析进行链接检测；以及跨交叉属性的子群稳健性。利用公开可用的分类器应用SBLS，我们展示了所有五个评估的去标识化系统都存在显著漏洞。我们的结果表明，即使对手仅使用预训练模型而无需访问原始语音或系统细节，仍然可以可靠地从匿名输出中恢复软生物特征信息，揭示了标准分布度量未能捕捉到的根本弱点。
URL
https://arxiv.org/abs/2509.14469
