{'fraction_non_alphanumeric': 0.03292161743295919, 'fraction_numerical': 0.013149861456816795, 'mean_word_length': 4.94804469273743, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Towards Privacy-Preserving Speech Representation for Client-Side Data Sharing

Privacy and security are major concerns when sharing and collecting speech data for cloud services such as automatic speech recognition (ASR) and speech emotion recognition (SER). Existing solutions for client-side privacy mainly focus on voice conversion or voice modiﬁcation to convert a raw utterance into another one with similar content but different, or no, identity-related information. However, an alterna-tive approach to share speech data under the form of privacy-preserving representations has been largely under-explored. To ﬁll this gap, we propose a speech anonymization framework that provides formal privacy guarantees via noise perturbation to a selected subset of the high-utility representations extracted using a pre-trained speech encoder. The subset is chosen with a Transformer-based privacy-risk saliency estimator. We validate our framework on four tasks, namely, Automatic Speaker Veriﬁcation (ASV), ASR, SER and Intent Classiﬁcation (IC) for privacy and utility assessment. Experimental results show that our approach is able to achieve a competitive, or even better, utility compared to the baselines that use voice conversion and voice modiﬁcation, providing the same level of privacy. More-over, the easily-controlled amount of perturbation allows our framework to have a ﬂexible range of privacy-utility trade-offs without re-training any components.


Introduction
Collecting and sharing speech data from local devices is essential for cloud-based machine learning models. From the service providers' perspective, gaining access to more data enables them to train more robust models and provide better services. From the users' perspective, sharing personal data allows experiencing more personalized services such as healthcare [1] or automatic speech recognition (ASR) [2]. However, privacy and security are major concerns when sharing or collecting personal speech data, as raw utterances often contain sensitive identifiable information such as voiceprint, racial background, gender, or even health condition. One promising line of solution focuses on client-side privacy [3], providing users full control to protect their privacy by sanitizing raw utterances locally before uploading the data for cloud-based processing without the need for a trusted server.
Several methods attempting to anonymize speakers while preserving the contents have been proposed, including voice modification [4,5], voice conversion [6], and adversarial learning [7]. The majority of these methods rely on sharing data in the form of audio, which is not required for machine learning. On the other hand, pre-trained self-supervised speech representation models such as wav2vec2 [8] and audio HuBERT [9] have become increasingly popular due to their robustness in a wide range of downstream tasks. In fact, many state-of-the-art systems [9,10] often start from the extracted features of pretrained models. However, because pre-trained speech models are generally trained on natural voices [11], sharing speech data in the form of synthesized or modified audio could potentially limit the capability of the pre-trained models for downstream tasks.
These facts naturally lead to two questions: Is it beneficial to locally process speech data before sharing in the form of privacy-preserving speech representations to leverage the robustness of pre-trained models? Users often have different levels of privacy versus utility expectations. However, pre-training speech representation models with different privacy settings are too costly. Is it possible to sanitize the extracted representations from pre-trained speech models directly, and avoid re-training any components for different levels of privacy? To address these questions, we propose a speech representations anonymization framework. At the core of our approach is a Privacy-risk Saliency Map Estimator that learns to predict the importance of individual representation positions for a speaker identification system. Based on the estimations, the top k% positions with the highest estimated privacy-risk would be perturbed by adding easily-controlled Laplacian noise, which provides formal privacy guarantees. Figure 1 shows an overview of our proposed framework. We validate our method on four tasks, namely, Automatic Speaker Verification (ASV) for privacy evaluation, Automatic Speaker Verification (ASR), Emotion Recognition (ER), and Intent Classification (IC) for utility performance. Our work provides preliminary evidence that using speech data in the form of extracted representations results in systems achieving competitive performance compared to the commonly-used voice conversion/modification approaches. Moreover, our approach enables a flexible privacy-utility trade-offs. The idea of saliency maps was originally proposed in computer vision to identify the most salient regions in images for visual concept detection and image understanding. Simonyan et al. [12] introduces Vanilla Gradient, which constructs the saliency map for a given image as the absolute value of the gradient of the input pixels with respect to the loss for the true class of the image. This can be computed via a backpropagation on the class score Sc output by an image classification model. Smilkov et al. [13] proposed SmoothGrad, which improves upon Vanilla Gradient, by first generating multiple noisy versions of the images by adding randomly sampled noises. SmoothGrad then computes the saliency map for each version of the image using Vanilla Gradient, and output the average of the computed saliency maps. SmoothGrad is able to generate sharper and more accurate saliency maps than Vanilla Gradient.
For a given 2D representation x ∈ R t×d of an utterance, we hypothesize that some positions in x contain more sensitive information than the others (i.e., an adversary can probe more identity-related information from these positions than the others). Hence, we adapt SmoothGrad to find these positions. Specifically, we first train a Speaker Identification (SID) model M on a dataset D = {(xi, yi)}, with xi being the extracted features from a pre-trained model (e.g., wav2vec2) and yi being the identity of xi. For each sample (xi, yi) in D, we compute the privacy-risk saliency map si with SmoothGrad, which is the average of | δLy i δx i + |, where Ly i is the loss of M on the true class yi of xi with different versions of noise . As a result, we construct a privacy-risk saliency map dataset D = {(xi, si)} containing the same number of samples as D with xi and si of the same sizes. This dataset is then used to train our Privacy-risk Saliency Estimator.

Privacy-risk Saliency Estimator
The purpose of the Privacy-risk Saliency Estimator (PSE) is to take in the extracted feature representations xi for an utterance u and output an estimate for the privacy-risk saliency map s i such that s i ≈ si. We use the Transformer encoder [14] as our architecture for the PSE. As a high-level overview, the transformer encoder is a stack of Transformer encoder layers, each of which consists of a self-attention module followed by a feedforward neural network. For a given xi ∈ R t×d , we expect the self-attention modules to capture information along the temporal dimension while the feed-forward neural networks capture important signals from the feature dimension, which enables the architecture to make precise position-level predictions. The model's parameters are optimized with the L1 Loss between the outputs of PSE and the ground-truth saliency maps extracted with a trained Speaker Identification model, explained in detail in Section 2.1.

Differential Privacy and the Laplace mechanism
Dwork et al. [15] introduce the concept of Differential Privacy, which is often regarded as the golden standard for privacy analysis. Formally, let A : X → O be a randomized algorithm mapping a dataset X to an output O. The algorithm A is said to be -differentially private if for all adjacent inputs x1, x2 ∈ X differing by at most one record, and every output o ∈ O, The parameter quantitatively captures the privacy budget of the algorithm A. Specifically, = 0 implies that A provides perfect privacy while → ∞ implies that A has no privacy guarantees. Any post-processing applied to the output of an -DP algorithm remains -DP, which guarantees the robustness of the privatised outputs of A to adversarial attacks. The Laplace mechanism is a commonly used DP algorithm for local data sanitization [15]. Formally, let f (x) = xs ∈ R n , and A be an algorithm that injects Laplacian noise to xs such that . ∆ is often called the global sensitivity of f , defined as for any adjacent inputs x1 and x2 differing by at most one record. A has been shown to be -DP.

Sanitization for extracted speech representations
We assume the extracted representations from wav2vec2 can be separated into either sensitive or insensitive positions. In this study, we define the group of sensitive positions as positions with the top k% highest privacy-risk values estimated by PSE.
To improve the utility of the output representations, we only apply the Laplace mechanism to the sensitive positions, i.e., the vector xs in Equation 2. We later investigate the effect of k on the privacy and utility of the sanitized outputs. It is important to note that the sensitivity ∆ needs to be determined for the application of the Laplace mechanism. However, it is difficult to find the true global sensitivity of xs given that little is known about the boundaries of the extracted representations from the speech encoder, i.e., wav2vec2 in this work. To address this issue, we follow Shokri et al. [16] to set a fixed input-independent bounds of [−1, 1] to the sensitive positions, resulting in ∆ = 2.

Experimental Setups
In this study, we focus on sanitizing the extracted representations from wav2vec2 [8]. However, the proposed framework should be applicable to other pre-trained speech encoders. Our implementations and training procedures follow the SUPERB benchmark [17] to enhance reproducibility. Unlike prior studies that focuses on ASR for utility evaluation, we intentionally pick three downstream tasks with emphasis on different aspects of speech, namely, ASR for content, ER for paralinguistics, and IC for semantics, for a more comprehensive evaluation. Our code is publicly available 1 .

Tasks, Datasets & Models
VoxCeleb1 (SID & ASV). We use the VoxCeleb1 dataset [18] for training the SID and ASV models. It contains approximately 150, 000 utterances from 1, 211 speakers collected from around 21, 819 videos on YouTube. For a fair privacy evaluation, we first split the dataset into two partitions. The first subset contains approximately 50, 000 utterances from 400 speakers, and is used to train the SID model and construct the Privacyrisk Saliency Map dataset. The second subset contains around 100, 000 utterances from the remaining 811 speakers, which is used to train the ASV model for privacy evaluation. The output representations from wav2vec2 is fed to the SID model consisting of a mean-pooling layer followed by a fully-connected layer to make the speaker identity predictions. The SID model is trained using a cross-entropy loss. For ASV, we train the xvector model [19] with an AMSoftmax loss [20]. Following prior work [21,3,4], we report the equal error rate (EER) as our privacy metric (high EER implies good privacy-preserving representations). IEMOCAP (ER). We use the IEMOCAP dataset [22] for training the ER model. The original dataset contains approximately 12 hours of data from 10 actors performing improvised or scripted scenarios that are designed to invoke emotions. Following the SUPERB benchmark's setting, we only keep four emotion classes (neutral, happy, sad, angry) from the IEMO-CAP dataset to get an approximately balanced dataset. The ER model adds a mean-pooling layer followed by a fully-connected layer to the encoder for emotion recognition. We report the classification accuracy as the utility metric. Fluent Speech Commands (IC). We use the Fluent Speech Commands dataset [23] to train our IC model. The dataset contains around 30, 000 utterances from 97 speakers with 31 unique intents. Similar to ER, the IC model contains a meanpooling layer followed by a fully-connected layer. We report the classification accuracy as an utility metric. LibriSpeech (ASR). We use the commonly used LibriSpeech audiobook dataset [11] to train our ASR model. Specifically, we use LibriSpeech's train-clean-100/dev-clean/test-clean subsets to train, validate and test our model. The training set contains more than 100 hours of transcribed speech from 251 speakers while both the validation and test set contains more than 5 hours of transcribed speech from 40 speakers. Our ASR model is a 2-layer 1024-unit Bidirectional LSTM, trained with the CTC loss [24] on characters. We do not use any language model to improve the model's performance during inference. The Word Error Rate (WER) is used as the utility metric.

Privacy-risk Saliency Estimator implementations
Our PSE is a standard Transformer encoder, which consists of 6 layers with a dropout rate of 0.1. Each transformer encoder layer contains a self-attention module with 12 heads. The sizes of the feed-forward layers in each transformer encoder block are 3072. The model is optimized with the L1 loss using the Adam optimizer with a learning rate of 1e −4 and a batch size of 32 for 60 epochs. Before training, we split the Privacy-risk Saliency Map dataset into a training and validation sets of approximately 45, 000 and 5, 000 samples, respectively. We perform model selection based on the lowest loss on the validation set to avoid over-fitting.

Baseline models
Existing literature on local speech anonymization generally follows two lines: voice conversion to change the speaker embeddings while retaining the content (i.e., transforming the source voice to a target voice or target speaker) [25,3,26,27] or voice modification (i.e., apply different signal processing techniques directly to the source voice to get a perturbed output voice) [4,28,5]. In this study, we select two voice conversion methods, namely the Cycle-GAN [29] and the Assem-VC [30], as the baselines for the first line of anonymization approach. For the second line, we use the signal processing-based methods from Kai et al. [4] as our baseline.
Cycle-GAN. The method learns voice conversion via adversarial learning through a two-stage process. In the first stage, an autoencoder is trained to separate speaker-independent features and speaker embeddings with the help of a speaker classifier. In the second stage, the decoder takes as inputs the extracted speaker-independent latent representations from the encoder along with a target speaker embedding to generate a voice of the target speaker without changing the content of the utterance. The model is trained using the CSTR VCTK Corpus [31] with 20 target speakers. Assem-VC. The model consists of three main components: a linguistic encoder, an intonation encoder, and a decoder. It takes as inputs the raw utterances along with the corresponding transcripts (extracted with an ASR system). The Cotatron linguistic encoder [32] learns to estimate the alignments between the Mel Spectrograms and the transcripts. The linguistic features are then concatenated with the normalized fundamental frequency (F0), followed by a non-causal decoder and HiFi-GAN Vocoder [33] to generate the output voices. The model is trained using the CSTR VCTK [31] and LibriTTS Corpus [34] with 231 target speakers.

R+MS. This approach is a combination of Resampling and Modulation Spectrum
Smoothing [35]. The input raw utterance is first stretched and resampled to a different sampling frequency from the original speech without changing the duration. The utterance is then transformed with the modulation spectrum smoothing method that removes the temporal fluctuation of the complex spectrogram obtained from STFT. R+MS is the authors' recommended method from their voice modification module with the best privacy-utility trade-offs. R+MS+M+CH+CL. This approach is an extension of R+MS by applying three other voice modification methods to the modified utterance, namely the McAdams Transformation [36], Clipping, and Chorus. The McAdams Transformation method aims at changing the resonant frequencies of the utterance. The Clipping method limits the extremum (maximum and minimum) values in a speech waveform while Chorus slightly modifies the pitch of the utterance. R+MS+M+CH+CL is the most complex method proposed by Kai et al. [4], which gives the best level of privacy protection for the modified utterances.

Privacy-Utility evaluation setups
We report the Equal Error Rate (EER) from ASV as our privacy metric. As our utility metrics, we report the Word Error Rate from ASR, emotion classification accuracy from ER, and intent classification accuracy from IC. For each task, we train a single model on the extracted features of wav2vec2 on the original utterances from the corresponding dataset, and use the trained model for assessing the privacy-utility performances of both our framework and the baselines. We report the performance of these models in the original row in Table 1.
For the Voice Conversion baselines, we use the trained voice conversion models provided by the official implementations. We use two methods to choose the target speaker for a given utterance. Following Justin et al. [26], our first method converts all speakers' voices to that of a specific speaker. For the second method, we convert each voice to a random target speaker from the pool of speakers in the trained voice conversion models. This target-speaker selection method has been theoretically shown to provide the highest level of privacy protection [25]. For the Voice modification baseline models, we use the pre-optimized hyper-parameters on the LibriSpeech dataset from the official implementation.    Table 1 shows the privacy-utility evaluation for the baseline models. Figure 2 and 3 show the evaluation results for the utility and privacy metrics, respectively. To highlight our PSE's ability to correctly identify positions with sensitive information, we add another baseline that randomly chooses k% of the positions in the extracted wav2vec2 representations for perturbation with similar settings to our approach. We can observe that the proposed approach enables a very flexible range of privacy-utility trade-offs, with EER ranging from 0.13 to 0.50 while the utility metrics ranging from random guessing performance to approximately the original performance. On the higher EER range, the approach shows competitive, if not better, performance compared to the baselines. For example, compared to Assem-VC (random) with 0.487 EER, perturbing 20% of the extracted representations with = 0.5 yields a similar EER of 0.49 yet better utility metrics with an ER Accuracy of 43.3%, IC Accuracy of 45.3%, and ASR WER of 49.9. The propose framework also consistently outperforms the baseline models on the Emotion Recognition benchmark. In comparison with the best performing baseline on ER (R-MS) with 0.216 EER and 48.5% accuracy, our approach can achieve an accuracy of 52.2% with 0.287 EER when 20% of the extracted representation is perturbed with = 4.0. On the higher EER range, Assem-VC(one) achieves ER Accuracy of 38.3% with EER of 0.459 while our method is able to get ER Accuracy of 44.2% with EER of 0.478 (20% perturbed with = 1.0).

Results
From Figure 3, we can see that our method achieves superior (higher) EER curves compared to the random perturbation baselines in all and perturbation ratio variations. It is also important to note the gap between our method and the random perturbation baselines gets smaller as the proportion of perturbed positions k gets larger, with the most significant gap observed at k = 20%. These observations suggest that the PSE is able to select high privacy-risk positions in the wav2vec2 extracted representations for perturbations. However, from Figure 2, we can see that the dashed curves generally have better utility performances compared to the solid curves, excluding Speech Recognition with a reversed effect. This implies that the selected positions from PSE might potentially be high-utility positions for downstream tasks.

Conclusion
In this study, we propose a framework to perturb the extracted representations from pre-trained speech models, with the goal of generating privacy-preserving representation for data sharing. The framework consists of three stages: generating a privacy-risk saliency map dataset for representations extracted from a selected pre-trained model, training a Privacyrisk Saliency Estimator (PSE), and perturbing the extracted representations based on the selected positions from PSE. We validate our framework on a wide range of downstream tasks and find that sharing speech data in the form of extracted representations is competitive to the existing approaches that share speech via voice conversion or voice modification. We hope the results motivate further exploration in the direction of privacypreserving pre-trained representation learning.