{'fraction_non_alphanumeric': 0.033509533698319806, 'fraction_numerical': 0.01222390032093638, 'mean_word_length': 4.608523028057173, 'pattern_counts': {'":': 0, '<': 1, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 2, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Audio De-identification - a New Entity Recognition Task

Named Entity Recognition (NER) has been mostly studied in the context of written text. Specifically, NER is an important step in de-identification (de-ID) of medical records, many of which are recorded conversations between a patient and a doctor. In such recordings, audio spans with personal information should be redacted, similar to the redaction of sensitive character spans in de-ID for written text. The application of NER in the context of audio de-identification has yet to be fully investigated. To this end, we define the task of audio de-ID, in which audio spans with entity mentions should be detected. We then present our pipeline for this task, which involves Automatic Speech Recognition (ASR), NER on the transcript text, and text-to-audio alignment. Finally, we introduce a novel metric for audio de-ID and a new evaluation benchmark consisting of a large labeled segment of the Switchboard and Fisher audio datasets and detail our pipeline’s results on it.


Introduction
Personal data in general, and clinical records data in particular, is a major driving force in today's scientific research. Despite its abundance, the presence of Personal Health Identifiers (PHI) hinders data availability for researchers. Therefore, data de-identification (de-ID) is a critical component in any plan to make such data available. However, the amount of data involved makes it prohibitively expensive to employ domain experts to tag and redact PHI manually, providing a good opportunity for automatic de-identification tools. Indeed, high performance tools for the de-identification of medical text notes have been developed (Dernoncourt et al., 2017a;Liu et al., 2017).
Due to the rise of tele-medicine (Weinstein et al., 2014), clinical records consist of many other types of data, such as audio conversations (Chiu et al., 2017), scanned documents, video, and im- Figure 1: High level audio de-ID pipeline ages. In this work, we direct our attention towards the task of de-identifying clinical audio data. This task is expected to become increasingly more important, as Machine Learning applications in telemedicine are growing in popularity. Given an input audio stream, the objective is to produce a modified audio stream, where all PHI is redacted, while the rest of the stream is kept unchanged. To the best of our knowledge, de-identifying audio is a new task, requiring a new benchmark.
We define and publish 1 a benchmark consisting of the following: 1. A large labeled subset of the Switchboard (Godfrey et al., 1992) and Fisher (David et al., 2004) conversational English audio datasets, denoted as SWFI. 2. A new evaluation metric, measuring how well the PHI words in the input audio were identified and redacted, and how well the rest of the audio was preserved.
To better understand the challenges of the audio de-id task, we evaluate it both end-to-end and by breaking it down and solving it using individual components. Our pipeline (Fig. 1) first produces transcripts from the audio using ASR, proceeds by running text-based NER tagging, and then redacts PHI tokens, using the aligned token boundaries determined by ASR. Our tagger relies on the state-of-the-art techniques for solving the audio NER problem of recognizing entities in audio transcripts (Lample et al., 2016;Ma and Hovy, 2016). We leverage the available Automatic Speech Recognition (ASR) technology, and use its component of alignment back to audio.
Finally, we evaluate our pipeline and de-scribe its performance, both end-to-end and percomponent. Although results on audio are worse than NER performance on text, the pipeline achieves better results than expected despite the compounding pipeline errors. Last, we analyze our performance and provide insights for next steps.
2 Related Work

NER for Speech
Prior work addressed entity recognition for audio recordings via the audio NER task: the detection of entities in the text transcript of the audio input. The majority of these works used a pipeline approach, in which ASR is first applied to the audio and then NER is applied on the noisy textual output of the ASR. These works include discriminative models (Sudoh et al., 2006), incorporating OOV word indicators (Parada et al., 2011), hierarchical structure (Raymond, 2013), and conditional random fields (Hatmi et al., 2013). Many audio NER works learn from and measure performance on French datasets, such as ES-TER (Galliano et al., 2009) and ETAPE (Galibert et al., 2014). This may indirectly affect the overall quality of these systems because the ASR component, which is crucial in the pipeline approach but is typically used "off-the-shelf", has lower performance in languages other than English.
An alternative end-to-end approach was proposed by Ghannay et al. (2018), in which the model accepts audio as input and outputs a tagged word sequence which consists of normal words and the NER labels in HTML-like tag encoding. Their model did not attain reasonable performance, perhaps due to the small training set.
We emphasize that both pipeline and end-to-end approaches output tagged word sequences, and do not propagate the recognized entity labels back for redaction on the audio itself, which is the end goal of our proposed audio de-ID task.

De-identification in the Health Domain
Previous efforts of de-ID in health care focused on redaction of textual medical records. The main approach involves applying NER techniques to the text, including rule-based (Ruch et al., 2000;Neamatullah et al., 2008) and machine learning (Guo et al., 2006;Yang and Garibaldi, 2015) methods.
Adoption of neural network models boosted the performance of NER on text without requiring hand-crafted rules and complex feature engineer-ing (Collobert et al., 2011;Huang et al., 2015;Lample et al., 2016;Ma and Hovy, 2016;Dernoncourt et al., 2017a). Dernoncourt et al. (2017b) applied the model proposed in Lample et al. (2016) to medical de-ID, achieving state-of-the-art performance on the I2B2-2014 (Stubbs and Uzuner, 2015) de-ID challenge dataset. We have chosen this architecture for the NER component of our pipeline method (Section 5).

The Audio De-identification Task
The goal of the Audio de-ID task is to convert an input audio stream into a modified audio stream where the PHI words are redacted. In essence, the goal of the task is to limit the ability of a listener to identify the entities of the conversation while leaving as much information as possible in order to keep the audio understandable.
Formally, the input audio stream is a function A(t) of time, that can be transcribed into a sequence of words W = {w j }, where w j is mapped to the time interval in the audio T j = [t start j , t end j ). We consider each word to be either PHI or non-PHI, and let I denote the set of PHI words {j : w j is PHI}.
The output of an audio de-ID algorithm is a zero-one redaction function R(t), indicating which parts of the audio stream are to be redacted, where a value of zero indicates PHI information at time t. The redacted audio stream can be obtained by zeroing out the redacted part of the stream, To evaluate the performance of a de-ID algorithm, we term w j as fully-covered if R(t) is zero for all t ∈ T j , and define a corresponding indicator function covered(w i ). This in turn defines the following standard NER metrics for the audio de-ID task: Finding the exact time interval corresponding to a word is not a trivial task, while redacting most of the interval T j results in a similar de-ID With this indicator function we further extend the aforementioned NER metrics to T P ρ , F P ρ , and F N ρ , and correspondingly define Recall ρ and P recision ρ . When ρ = 1 these metrics equal the strict metrics. When ρ < 1 the new metrics determine the quality of the system with respect to redacting at least ρ of each audio interval in PHIs.
We note that the proposed metrics only evaluate the redaction function R(t) on the word intervals.

Datasets
To create a benchmark for the audio de-ID task, we use three datasets from two distinct domains: conversational English and medical records. We summarize the main dataset statistics in Table 1. Importantly, we did not perform text normalization specific to each domain.
In the domain of medical datasets, we use  I2B2'14 (Stubbs and Uzuner, 2015), which consists of identified textual medical notes with PHI tagging, and the Audio Medical Conversations dataset from (Chiu et al., 2017), denoted AMC'17, which contains de-identified audio of doctor-patient conversations and their corresponding manual transcripts. Processing the AMC'17 conversations was facilitated by the fact that it is a de-identified dataset, which provides us with the locations of the PHI in the audio and the transcripts. Three PHI types: names, dates and ages were redacted, preserving type information, and synthetic data was generated using dictionaries and context-aware rules. First names were drawn from the US Social Security Administration babies names registry 2 and last names were drawn from the Frequently Occurring Surnames list from the 1990's US Census 3 . Human annotators used surrounding context to resolve the other PHI types and filled in fake appropriate identifiers. Notably, neither of the above-mentioned medical datasets could serve as a benchmark for the audio de-ID task, as I2B2'14 is text-based, and AMC'17 contains only redacted audio conversations and is not publicly available. Therefore, we focused on the conversational English domain, where we generated a combined dataset SWFI from the Switchboard (Godfrey et al., 1992) and Fisher (David et al., 2004) datasets. These datasets include hundreds of conversations in English about a variety of subjects, along with their transcripts. To enable proper training and evaluation for the audio de-ID task, we annotated all 250 Switchboard conversations, and 326 from Fisher. Annotation included named PHI labels, and the time intervals T j = [t (start) j , t (end) j ) matching each named PHI back into the audio. This dataset is publicly available 1 to allow for standardized evaluation of novel approaches to this task.
The annotation process began by tokenization of the transcripts provided in both datasets using white-space separators, removing special transcript characters and keeping word capitalization in its original form. Following that, PHI word annotation was performed manually. The results can be seen in Table 2.
As performing temporal labeling manually is an arduous process, we opt for a semi-automatic ASR-based procedure. To this end, we determine word start and end times by aligning the manual transcripts to audio intervals. We assess the quality of this semi-automatic labeling scheme using human evaluation. For a random sample of 6 SWFI conversations (3 Switchboard and 3 Fisher), we slice the audio according to the aligned interval times per transcript word, and measure both the quality of the transcription, and that of the alignment. Table 3 shows the distribution of alignment errors of the tokens from the sample conversations. These are denoted as good alignment, short (i.e. ASR interval is shorter than actual word) and extended (i.e. interval is longer than expected) where all alignment errors are in the scale of 30-60ms (1-2 audio frames).

Pipeline Models
We next describe the models we trained and evaluated to gain insights on the types of challenges this task presents. We chose to use the pipeline approach as an audio de-ID benchmark due to the ubiquity and maturity of the ASR technology, and abundance of training data for text NER. Our pipeline models contain three main components: 1. An ASR system, which transcribes the audio into text.
2. A NER tagger, which tags the transcript with the required labels.
3. An alignment component, which maps each word in the transcript back to its time interval in the audio.
For the ASR component, we use Google Cloud's Speech API 4 with the com-4 cloud.google.com/speech-to-text mand and search model, which gave us the best transcription accuracy on the data. For each conversation, which usually contains two different speakers, we send the entire audio to the service to obtain the transcript. The API also returns alternative hypotheses for the corresponding text and their confidence. We incorporate these alternative hypotheses by taking the top-k ASR hypotheses and feeding them into the next two stages. We then take the logical OR of the detections on all of the hypotheses. Unless stated otherwise, k = 1.
For the NER tagger component, our models use the architecture described in Lample et al. (2016), depicted in Fig. 2. This is a neural network model using pre-trained GloVe word embeddings 5 (Pennington et al., 2014) and a character-based bidirectional RNN to generate token embeddings, followed by a bidirectional RNN, tag projection, and CRF layers. We define three models, where each model has a NER tagger trained on a different dataset. The models are: M AMC -Trained using the training data from the AMC'17 dataset.
M SWFI -Trained using the training data from the SWFI dataset.
M I2B2 -Trained using the training data from the I2B2'14 dataset.
The M AMC and M SWFI models were trained using the conversation transcripts. We use data augmentation in order to increase robustness to ASR errors, in particular to word deletion, insertion, substitution, and inconsistent capitalization. Data augmentation is carried out in several stages. First we create an ASR transcript from the audio, align it back to the reference transcript by minimizing the word-level edit distance, and transfer the labels to the new transcript. For each of the two transcripts, we then generate three additional transcripts by changing word capitalization to camel, lower and upper case. Finally, each of the augmented transcripts is broken down into segments of 20 speaker turns with a step of 10 turns, to resemble the utterance structure of the ASR output. We include the three variants of the M SWFI model: M SWFIReg uses no augmentations, M SWFI MixCase uses mix-case augmentations only, and M SWFI MixCase+Asr uses all mix-case and ASR augmentations. The M I2B2 model is tuned to achieve state-ofthe-art results on textual medical notes, such as in Dernoncourt et al. (2017a); Liu et al. (2017). It should be stressed that the model was used as is, without an attempt to adapt it to the domain of ASR output. M AMC and all M SWFI models are both trained on conversational data, and should be better adapted to the task. M AMC is trained on data originating from the medical domain, as opposed to M SWFI models which train on data from the English conversation target domain. This is offset by the fact that M AMC is trained on a significantly larger training set.
Finally, for the alignment component we add a padding hyperparameter allowing a variable number of mismatched frames at either side of the identified intervals. This slack in interval size is used to compensate for alignment errors.

Experimental Settings
To test the performance of our models on the audio de-ID task, we conducted a number of experiments, described next. Section 7 then details our results. We report Recall, P recision, and F 1 scores for all experiments, which are significantly more informative than accuracy due to a low PHI/non-PHI ratio. We report results on the SWFI test set using the tags which are shown in bold in Table 2. We evaluate our performance against the coverage threshold ρ ∈ [0, 1] which is defined in Section 3. Specifically, we focus on type-less metrics, as we care more about the tokens' redaction than their type classification.
Our first experiment evaluates the performance of M AMC , M SWFI , and M I2B2 on the SWFI test set. First, to decouple their tagging performance from the other pipeline errors, we measure their tagging performance on the manually annotated transcripts (referred to as NER score). NER errors may arise due to train-test disparity, where the train and test data are from different domains or different mediums (e.g. text vs. audio), which results in different discriminative models. Additionally, we measure their overall end-to-end score. We analyze the complex behavior of the models' precision by inspecting the coverage distribution of PHI and non-PHI tokens.
Our second experiment evaluates the effect of two significant hyperparameters on pipeline performance using the SWFI test set:   Table 5: Error analysis of a sample of M SWFI F N errors, including errors from all components across the pipeline and even occasional manual transcription errors which contribute to both F P and F N errors.
• The number of alternative hypotheses passed on from the ASR to the NER tagger.
• The amount of padding added around each detection by the alignment component.

Results
In Table 3 we report the Word Error Rate (WER) of our ASR component on the SWFI dataset, which was computed by comparing the manual and ASR transcripts of the entire audio. For WER of PHI words, we removed all the non-PHI words from manual ASR transcripts before computing the WER. WER of non-PHI words was computed similarly. We see that both WERs are substantial, and can be thought of as an upper-bound on our pipeline's end-to-end performance. Next, Table 4 shows the NER and their endto-end performance of each model for its F 1 optimal choice of coverage threshold ρ. We can also see that the M SWFI surpasses the others in performance due to its training set being indomain and in the same medium. Additionally, the M SWFI MixCase+Asr variant does not display any advantage over its other variants when running on manual transcripts, but gets significantly better performance on the end-to-end scenario. The difference between NER and end-to-end scores is apparent, and may be attributed to additional pipeline components of ASR and alignment. Interestingly, in the case of M SWFIReg , compounding the WER and alignment error rate from Table 3  and the NER from Table 4 leads to an expected Recall of approximately 0.44, yet the end-to-end  Recall at ρ = 0.5 is 0.53. This implies a nontrivial co-dependence between errors in the different components of the pipeline. Figure 3 presents the end-to-end evaluation of the different models with respect to the coverage threshold ρ. As expected, Recall is monotonically non-increasing with respect to the threshold. Meanwhile, P recision (and consequently F 1) are not monotonic and have more complex behavior. This behavior is due to difference in the distribution of the coverage between PHI and non-PHI, which we see in Figure 4 (left). An interesting insight is that most PHI words have more than half their length redacted by the pipeline while non-PHI words' coverage is bi-modal, one mode close to 0, and the other close to 1. A plausable explanation for this behavior is that the F P s are derived from alignment errors in low coverage, while the high coverage F P s occur due to classification errors, either due to ASR transcription mistakes or due to model NER errors.
Finally, we show the end-to-end evaluation of the pipeline using M SWFI MixCase+Asr with different choices of the pipeline parameters. In Figure 4 (center) the performance of the pipeline slightly increases when using additional alter-native hypotheses, while a different experiment shows that when using alternative hypotheses with M SWFI MixCase performance decreases. This decrease is consistent with the hypotheses' decreasing confidence scores, which can be alleviated with ASR training data but is not addressed by the naive OR approach described in Section 5. This leads us to seek new ways to utilize the additional ASR artifacts, such as the hypotheses confidence scores and speech lattice. In Section 8 we discuss possible directions to improve the pipeline's robustness to ASR errors. Last, Figure 4 (right) shows that the choice of padding size does not improve performance, but rather alters the value of the optimal coverage threshold.

Conclusions
We introduced the audio de-ID task, an important prerequisite for protecting privacy when processing sensitive audio datasets in the medical domain as well as other domains. To this end, we created and made available a new test set benchmark derived from annotating the Switchboard and Fisher audio datasets. We also presented new metrics for the task, Recall ρ and P recision ρ , as extensions of standard Recall and P recision where words are considered de-identified when at least a portion ρ of their audio signal is redacted. Finally, we detailed our algorithm for this task, a pipeline approach consisting of three components: ASR, NER on transcripts and a novel alignment from tagged transcripts to audio for the actual redaction.
We showed that ASR performance is the main impedance towards achieving results comparable to text de-ID. In future work, we plan to address this through several directions, including end-toend de-ID (Ghannay et al., 2018), lattice-based techniques (Ladhak et al., 2016), and diarization and segmentation of the audio as part of the transcription process (Cerva et al., 2013).