Venue: NeurIPS 2022 Conference

Reviews:

final_score: rating: 7: Accept: Technically solid paper, with high impact on at least one sub-area, or moderate-to-high impact on more than one areas, with good-to-excellent evaluation, resources, reproducibility, and no unaddressed ethical considerations.
review_content: summary: This paper proposes a real-time audio conversation to de-identify speakers from a privacy perspective. One of the unique aspects of this model is to consider frequency domain filtering instead of noise addition, which seems to avoid the distortion of speech signals in terms of their speech quality measures (subjective and objective) while maintaining the speaker de-identification functions. This paper significantly contributes to the community by considering that the voice privacy issue has become a severe concern and audio applications require streaming/real-time operations.
strengths_and_weaknesses: Strengths
- Real-time speaker de-identification is a critical topic for voice privacy, and the motivation part of the paper clearly describes this importance.
- The paper carefully describes the reproducibility of the proposed method.
- Time-varying filter-based de-identification is novel compared with existing studies.
- The experimental results clearly demonstrate the improvement from the existing studies regarding both subjective and objective evaluation metrics.

Weaknesses
- The topic is specific to speech processing rather than generic machine learning and may not gain attention from general NeurIPS audiences. I think the paper would have a better fit for the speech conferences (e.g., Interspeech and ICASSP).
- The experimental evaluation should focus more on the latency. It would be good to have the performance vs. latency trade-off.
- Although the paper shows the overall improvement of the proposed method, the proposed method seems to be very different from the other methods, especially for the encoder part and training schemes in addition to the time-variant" FIR filter. For example, it is not clear about the experimental justification of this neural network architecture. The proposed method tries to disentangle various speech factors (pitch, phoneme, loudness) based on speech processing models in the encoder, but this architecture has no experimental validation. I suggest the authors provide the contribution of these factors (possibly through the ablation study of each aspect) to the overall performance.
- I have the same discussion for the loss function. There is no experimental justification for the proposed training scheme.

questions: - Did you perform automatic speech recognition? I'm expecting that ASR would be robust against the "time-invariant" FIR filter, and I'm curious how it would degrade the performance due to the proposed method based on the time-variant FIR filter.
- Is it possible to evaluate this method with the Voiceprivacy challenge benchmark? Then, the paper can compare various techniques proposed in the challenge or literature.
- "VoiceBox" is the same name as the famous (Matlab) speech processing toolkit. https://scholar.google.com/citations?view_op=view_citation&hl=en&user=HEH9cboAAAAJ&citation_for_view=HEH9cboAAAAJ:u-x6o8ySG0sC. Although this is an old toolkit (based on Matlab!), I recommend the authors respect this prior work and avoid using this name.
- I would like to have more discussions on why the authors use the time-variant FIR filter with more scientific perspectives. I agree that a time-invariant FIR filter would be less distorted than the additive noise as it would just physically change the speaker or room characteristics. But I'm not very sure about the time-variant FIR filter.
- Can you discuss 56ms? I think this range would be accepted in many speech interface applications. For example, DNS challenges and other real-time speech processing tasks set a similar range for the latency constraint. However, some hearing devices set the latency constraint to less than 10 ms (you can check the Clarity challenge). This kind of discussion makes the paper more attractive since we can imagine the main application of this method.
- How much is the phoneme classifier part robust against the other languages, speaking styles, and noise environments? Librispeech "train-clean-100" is English/clean/read speech, which would not cover many speech variations.
- Can you discuss the RTF? Is 0.255 or 0.200 sufficiently light?

limitations: The paper describes the limitation, especially for real-world applications.
review_title: null

final_score: rating: 7: Accept: Technically solid paper, with high impact on at least one sub-area, or moderate-to-high impact on more than one areas, with good-to-excellent evaluation, resources, reproducibility, and no unaddressed ethical considerations.
review_content: summary: This manuscript proposes an adversarial attack for audio-to-audio model that preserves user’s privacy against speaker recognition models. The proposed approach is based on a seq2seq neural network model, trained with multi-task losses including an adversarial loss to attack the speaker recognition model, and an auxiliary loss for finite impulse response filtering and audio reconstruction.
strengths_and_weaknesses: Strengths

* The proposed approach is interesting, and the technical are enough.
* The authors conducted both objective and subjective evaluations on the audios generated from the proposed methods, regarding the speech audio quality and the performance on (seen/unseen) victim speaker recognition models. Results show that the proposed approach significantly outperform baselines.
* The paper is well written and well organized. References are enough. 
* Sample page and code are available.

Weaknesses
* The evaluations are only conducted on the generated audios. It would be more promising to have evaluations on a couple of real audio-to-audio tasks like enhancement, voice conversion, speech-to-speech translation. Although the generated audios have satisfactory quality from the evaluations on themselves, it is possible that the extracted features are very different since the proposed approach modulates their waveforms, causing regressions on these tasks 

questions: N/A
limitations: Satisfactory
review_title: null

final_score: rating: 8: Strong Accept: Technically strong paper, with novel ideas, excellent impact on at least one area, or high-to-excellent impact on multiple areas, with excellent evaluation, resources, and reproducibility, and no unaddressed ethical considerations.
review_content: summary: This paper presents VoiceBox, an adversarial audio attack which (1) dramatically lowers the accuracy of speaker recognition systems, (2) is mostly imperceptible to humans, and (3) can operate in real-time on live audio streams. The authors further demonstrate that their proposed model may also transfer to speaker recognition systems that it was not explicitly trained to fool.
strengths_and_weaknesses: Overall, this is an interesting and well-written paper which proposes a nice method and demonstrates its efficacy through carefully-designed experiments and user studies. Moreover, the authors plan to release code and a reference implementation of the system which can run on commodity hardware. My main issue with this paper lies in a perceived contradiction in the core motivation (expanded below). However, despite this contradiction, I do think VoiceBox will be of interest to the voice privacy research community in both the short and long term, as well as possibly even to users in the short term.

**Contradiction in core motivation.** There is seemingly a large contradiction in the premise of this work: that in a landscape of automated surveillance via speaker recognition, we should work to design attacks that are imperceptible to humans, i.e., ones that _preserve the identity_ of the speaker to human listeners. I cannot understand why this is a desirable property. Suppose that, once VoiceBox is released, speaker recognition systems are augmented with a defense which detects if speech was modified by VoiceBox. In this case, users could face repercussions such as _denial of service_ (automatable) or _targeted retaliation_ (through manual audit to determine identity). In the worst case, if speaker recognition systems can also be trained to be  _robust_ to VoiceBox, users may even face _automated_ targeted retaliation, since both their use of VoiceBox and their identity would be known automatically.

**Why not voice conversion?** Given this contradiction, it seems to me that _voice conversion_ is a much more desirable goal, because it would at least remove the possibility of targeted retaliation against users (assuming that the voice conversion process eliminates the possibility of recovering original speaker identity). The authors mention voice conversion in related work, advocating in favor of their approach as it is “inconspicuous and minimally invasive to the user experience”. However it is historically unlikely that any attack which is “inconspicuous” to humans will be undetectable by a deep learning system, and it’s unclear what the “user experience” means in this context, so this justification is largely unsatisfying.
questions: Can the authors could shed more light on this contradiction in the rebuttal, or otherwise rework their submission to address this concern in a more transparent fashion?

Other comments / questions:
- Especially in a paper largely concerning privacy, a section devoted to Ethics would be nice to see. While privacy is an admirable goal, might there be some potential ethical *downsides* of releasing a de-identification system like VoiceBox?
- Seems to be a known issue already, but the author should rework their results to include the ASR results which are only present in the online supplement
- Clarify code release? The checklist indicates that code is proprietary and will not be released, but the supplement implies that it will be. (My review gives the benefit of the doubt that the code will be released)

limitations: See above
review_title: null

Meta-review: metareview: The paper proposes an adversarial attack strategy, for audio-to-audio modeling, that preserves user’s privacy against speaker recognition models.

All reviewers agree this is a relevant topic for NeurIPS, with a strong contribution on voice privacy. In addition, everyone agrees the experimental section is solid (concerns have been addressed during the rebuttal phase).
confidence: Certain
Decision: Accept