De-AntiFake: Rethinking the Protective Perturbations Against Voice Cloning Attacks
Authors: Wei Fan
Kejiang Chen
Chang Liu
Weiming Zhang
Nenghai Yu
Venue: ICML 2025 poster (2025)
Keywords: Adversarial Purification
Speech Synthesis
DeepFake Defense
Adversarial Attack
Diffusion Models
Primary area: social_aspects->security
TL;DR: Our novel purification method effectively bypasses current perturbation-based voice cloning defenses, revealing vulnerabilities in these defenses.

Abstract: The rapid advancement of speech generation models has heightened privacy and security concerns related to voice cloning (VC). Recent studies have investigated disrupting unauthorized voice cloning by introducing adversarial perturbations. However, determined attackers can mitigate these protective perturbations and successfully execute VC. In this study, we conduct the first systematic evaluation of these protective perturbations against VC under realistic threat models that include perturbation purification. Our findings reveal that while existing purification methods can neutralize a considerable portion of the protective perturbations, they still lead to distortions in the feature space of VC models, which degrades the performance of VC. From this perspective, we propose a novel two-stage purification method: (1) Purify the perturbed speech; (2) Refine it using phoneme guidance to align it with the clean speech distribution. Experimental results demonstrate that our method outperforms state-of-the-art purification methods in disrupting VC defenses. Our study reveals the limitations of adversarial perturbation-based VC defenses and underscores the urgent need for more robust solutions to mitigate the security and privacy risks posed by VC. The code and audio samples are available at https://de-antifake.github.io.

De-AntiFake: Rethinking the Protective Perturbations Against Voice Cloning Attacks
Wei Fan Kejiang Chen
Chang Liu
Weiming Zhang'
Nenghai Yu
Abstract
Protective Porturbation
Imperceptible
Purification
The rapid advancement of speech generation mod- els has heightened privacy and security concerns related to voice cloning (VC). Recent studies have investigated disrupting unauthorized voice cloning by introducing adversarial perturbations. However, determined attackers can mitigate these protective perturbations and successfully execute VC. In this study, we conduct the first system- atic evaluation these protective perturbations against VC under realistic threat models that in- clude perturbation purification. Our findings re- veal that while existing purification methods can neutralize considerable portion of the protec- tive perturbations, they still lead to distortions in the feature space of VC models, which de- grades the performance of VC. From this perspec- tive, we propose a novel two-stage purification method: (1) Purify the perturbed speech; (2) Re- fine it using phoneme guidance to align it with the clean speech distribution. Experimental re- sults demonstrate that method outperforms srate-of-the-ar purification methods in disrupting VC defenses. Our study reveals the limitations of adversarial perturbation- underscores the urgent need for more robust so- lutions to mitigate the security and privacy risks posed by VC. The code and audio samples available at wttps//deeaniffkke... .it.fbbb....tuub....
Clean Speech
Purified Speech
4H
Speech
"Mly how ane you?
Voice Cloning Model
Q Attacker
Vielim-Liike Synthesized Speech
Non- Vin-Viitii Synthesized Speech
Synthesized Speech
$280 e
Speaker Verification System / Human Recognition
X
Victim
Victim
Victim
Figure I. Illustrations of existing protection methods against voice cloning attacks in the presence of adversarial purification. The dashed lines represent the operations of the attacker.
chatbots, and providing assistive devices for individuals with speech impairments (Koronka, 2024; OpenAI, 2024). However, these advancements also pose risks for illegal uses, such deceiving individuals, bypassing speaker verification systems, violating copyrights. For instance, VC technol- ogy has been used to deceive identity verification systems in banks and government agencies (Nick Evershed, 2023; Cox, 2023). In a separate incident, scammers impersonated CFO during fraudulent call, tricking an employee into transferring $25 million (Andrews, 2024). These incidents highlight the potential of VC to deceive both digital systems and humans, raising significant security and privacy con- cerns. In response, organizations such OpenAl and the FTC have released reports on VC's implications (OpenAI, 2024; FTC, 2024).
VC defenses and
1. Introduction
With rapid advancements in Voice Cloning (VC) technology, generating highly realistic speech from just a few seconds of target speaker's voice is possible. This technology has diverse applications, including enhancing virtual assistants,
To address emerging threats posed by VC, researchers have explored various solutions, including proactive and passive detection, as well as proactive defense mechanisms (Wenger et al., 2021; Liu et al., 2024b; San Roman al., 2024; Chen et al., 2024; Liu et al., 2024a; Ren et al., 2023; Deng et al., 2023; Ji et al., 2024; Li et al., 2024; Blue et al., 2022).
Anhui Province Key Laboratory of Digital Security, University of Science and Technology of China, Hefei, China. Correspon- dence to: Kejiang Chen <chenkjee Boonnkj@uutt.eeo @wwstc.cu.us...........
Proceedings of the ndnd International Conference Machine Learning, Vancouver, Canada. PMLR 267, 2025. Copyright 2025 by the author(s).
Among these approaches, protective perturbations are re- garded as a promising technique for safeguarding speech. By adding impereeptible distortions speech, they prevent

---

De-AntiFake: Rethinking the Protective Perturbations Against Voice Cloning Attacks
Clean Samples
Protected Samples
x
PurifediP rotected) Samples
(a) Clean vs. Protected
(b) Clean WavePurifier
(c) Clean vs. AudioPure
(d) Clean PhonePuRe (Ours)
Figure 2. Comparison of sample distributions (Clean vs. Protected/Purified) in the VC model embedding space. Different colors represent different speakers. (a) Protected samples. (b-c). purified samples obtained by existing methods (Guo al., 2024; Wu al., 2023), which introduce distortions in the embedding space, including O reduced interclass separability and @ deviation of purified samples from their clean counterparts. (d) Our method aligns purified samples more closely with their original clean versions.
VC models from accurately replicating authentic features of a speaker (Yu et al., 2023; Huang et al., 2021; Liu et al., 2023; Yang et al., 2024; Li al., 2023b; Wang al., 2023; Dong et al., 2024), achieving impressive results in reduc- ing the effectiveness of VC attacks. For example, applying VC to protected speech results in synthesized speech with both lower speaker verification accuracy and a perceptually distinct timbre.
embedding inconsistencies caused by current methods: (1) In the first stage, we utilize a pretrained unconditional dif- fusion model to preliminarily purify the samples; (2) In the second stage, we leverage stochastic refinement model to further adjust the samples, aligning them more closely with the original distribution. Inspired by recent progress in speech processing (Popov et al., 2021: Tian et al., 2023), we incorporate phoneme information into the refinement model to guide the refinement process.
While protective perturbation methods can prevent VC mod- els from deceiving both machines and humans under ideal conditions, their performance remains uncertain in more realistic scenarios where attackers may employ purification methods to eliminate the perturbations used for defense prior to performing VC. If these methods cannot remain ef- fective against such purification strategies, they risk giving users a false sense of security. Therefore, is essential to systematically evaluate their effectiveness in more realis- tic contexts that include potential purification methods, shown in Figure 1.
Experimental results demonstrate that our method outper- forms existing state-of-the-art adversarial purification meth- ods in overcoming protective measures, enabling VC models to better capture authentic features. Our research suggests that current adversarial perturbation-based methods for VC defense may provide a false sense of security, inspiring the need for more robust solutions to address the security and privacy risks posed by advanced VC models.
Our contributions be summarized follows:
In this paper, we perform comprehensive evaluation of pro- tective perturbation methods against VC under a realistic threat model involving potential purification methods, with extensive experiments on the most common perturbation techniques and wfate-ofthee-e VC models. Our results indi- cate that these protection methods are vulnerable to existing adversarial purification techniques. To the best of our knowl- edge, this is the first attempt to explore the vulnerabilities of protective perturbation-bast
We are the first to explore vulnerabilities of protec- tive perturbation-based VC defenses, propose a real- istic threat model, and systematically evaluate these defenses within We assess six VC methods and three protective techniques, revealing the risk that ex- isting defenses potentially fail to prevent voice cloning attacks.
VC defenses.
To probe deeper into these risks, we propose novel two-stage adversarial purification method to counter such protective techniques. Experimental results show that our method outperforms baselines in countering various protection methods across different cloning attacks, further exposing potential risks.
Moreover, we observe that existing purification methods introduce systematic distortions VC model embedding spaces, as shown Figure 2b and Figure 2c. Since VC models rely on fine-grained feature information to replicate speaker voices accurately, such distortions degrade their per- formance in VC tasks. Building on this insight, we propose novel two-stage ad versarial purification method that reduces
We evaluate the robustness of our purification method against adaptive protections a white-box setting. We
2

---

De-AntiFake: Rethinking the Protective Perturbations Against Voice Cloning Attacks
find that even with full access to the gradient infor- mation of our purification model, generating effective protective perturbations remains challenging, under- scoring the need for more advanced techniques to pre- vent unauthorized data usage in VC.
other studies (Liu et al., 2023; Yang et al., 2024; Wang et al., 2023; Dong al., 2024) have explored similar methods to generate protective perturbations for speech data. While these methods have achieved notable success in prevent- ing VC attacks, their effectiveness in real-world scenarios remains uncertain.
2. Related Work
2.3. A Adversarial Purification
2.1. Voice Cloning
Since protective perturbations can be viewed as a form of adversarial attack against VC models, a natural question arises: can existing adversarial purificaation methods bypass these perturbations? Adversarial purification aims to restore clean data by removing adversarial distortions. In the audio domain, adversarial purification methods can be broadly di- vided into two types: transformation- based approaches and reconstruction-Uee based approaches. Transformation based methods use techniques such as filtering, compression, and smoothing to disrupt adversarial perturbations (Hussain et al., 2021: Chen et al., 2023). These methods are easy to use, but not effective. On the other hand, reconstruction- based methods typically employ seff-reconstrucciinn models to restore clean audio. Recently, Wu et al. (2023) extended diffusion- based ad purification (Nie et al., 2022) to the audio domain, achieving state-of-the-ar results in mitigating adversarial perturbations in speech command recognition tasks. Further research has explored diffusion- based adversarial purification using combination of the time and frequency domains (Tan et al., 2024) and hierar- chical purification (Guo et al., 2024). However, most of these adversarial purification methods are designed for clas- sification tasks, including speaker recognition and speech recognition. Therefore, these methods tend to preserve only coarse feature information, leading to distortions in VC model embedding spaces, as illustrated in Figure 2.
Voice cloning refers to the process of generating speech that imitates the voice of specific target speaker. It can be achieved by text-to-speech (TTS) (Betker, 2023; Jia et al., 2018; Casanova et al., 2022) and voice conversion (Popov et al., 2022; Qin et al., 2023; Li et al., 2023a; Liu, 2024).
Both paradigms leverage the extracted speaker embeddings from the target speaker's s audio to capture their vocal charac- teristics. In TTS, textual input serves as the content source. The TTS acoustic model, conditioned on the target speaker's 's embeddings, processes this text to generate corresponding acoustic features (e.g., mel-spectrograms). These acoustic features are then used by a vocoder to synthesize speech in the target's voice. Alternatively, voice conversion typically utilizes acoustic features from a source speaker's utterance for the linguistic content. The voice conversion model then transforms these features using the target speaker's 's embed- dings to generate speech in the target speaker's timbre while retaining the original linguistic content.
Recent advances in deep learning- based speech synthesis have enabled zero-shot synthesis-allove
the generation of speech for target speakers whose voices were not in- cluded in the training data. These zero-shot methods sig- nificantly increase risks by lowering the barrier to attacks, as attackers can easily access zero-shot VC services (e.g., Elevenlabs (Prime Voice AI, 2025)) and open-source models without requiring specialized expertise. In response to these challenges, recent studies have explored countermesures against deep learning-basee based zero-shot VC (Huang et al., 2021; Li et al., 2023b; Yu al., 2023). Building on these works, this study focuses on zero-shot VC models.
3. Threat Model
Overview of the Conflict. Given a target speaker T with original voice samples x, the attacker may use a voice cloning model M to synthesize a forged voice (xx) that mimics the voice of T. To counter this, the protector adds imperceptible perturbation 5 to x, creating protected voice x' x - 5. The perturbation 8 is bounded by budget e, ensuring that x' remains perceptually similar to x, but prevents attackers from using x' to generate a convincing forgery of T. Therefore, the protector aims to achieve:
2.2. Protective Perturbations Against VC Attacks
To protect speech data from zero-shot VC attacks, recent studies have proposed adding imperceptible adversarial per- turbations to disrupt the VC process. Huang et al. (2021) introduce the concept of adding such perturbations to speech to prevent VC models from synthesizing the voice of pro- tected speaker. Li et al. (2023b) extended these perturba- tions to the time domain and incorporated a psychoacoustic model to ensure their imperceptibility. Yu et al. (2023) proposed an ensemble learning method to improve the trans- ferability of these perturbations across different VC models, enabling them to generalize to unseen models. Additionally,
H(z') H(x), H(M(=')) + H(z) and SV(M(z') + SV
(1)
where H(-) represents the perceived speaker identity evalu- ated by human listeners with given audio, and SV(-) repre- sents the evaluation by speaker verification (SV) systems.
The goal of the attacker is to bypass the protective pertur-
3

---

De-AntiFake: Rethinking the Protective Perturbations Against Voice Cloning Attacks
Purification Stage Noised
Refinement Stage
Clean
Protected
Purified
Noised
Phoneme-Guidod Reverse Fral
Refined
Forward
ISTFT
+a(Tnu)
Xyef
+6
pur
my yuf
Myr
Perturbation Generation
STFT
Guidance Computation
Phonemee
Combined Guidance
Representation
Forward
Reverse
Tou
Tpu
Text Aligner
Xadv
X
Xpur
Phoneme Dictionary
Transcript
[mpur>A A]
Figure Inference process of our snnificationRReiinmmnnn framework (gray dotted box: waveforms and corresponding spectrograms).
bations and generate a forged voice M (p(z')), where p(-) denotes potential purification function used to mitigate the perturbations x'. The attacker aims to achieve:
tions for voice eloning tasks, we apply existing adversarial purification methods designed for speech classification tasks to this problem. The results are visualized in Figure
H(M(p(z))) H(x:) or (V(M(p(=')) = SV(x), (2)
We observed that while these methods reduce adversarial noise (evidenced by clustering samples of the same class), they also introduce systematic distortions in the VC model embedding space. Specifically, (1) samples from different classes become closer, and (2) purified samples deviate further from their original clean versions. Since VC models rely on embeddings extract the speech characteristics of the target speaker, such distortions lead inability capture accurate features of the speaker, which impacts the performance of VC.
where the specific choice of targeting humans or SV systems depends on the intent of the attacker.
Capabilities of the Attacker. The attacker cannot directly record the original voice samples of the target speaker T, but can collect limited samples z' from public-domain sources such as social media, video platforms, etc. Mean- while, they can employ existing voice cloning models to per- form zero-shot voice cloning with x'. The attacker does not have the knowledge of the protection methods applied by the protector, but they may observe perceptible artifacts in x'. Alternativly,, unsatisfactory results from initial cloning at- tempts may also suggest the presence of protective measures. Therefore, they will preprocess x' to mitigate protective per- turbations before cloning.
The embedding distortions in current methods can be at- tributed to the properties unconditional diffusion models used purification. When diffusion steps are few, the model fails fully purify samples. Conversely, with enough dif- fusion steps, the details of the samples are lost, causing the model to generate similar samples, as shown in Figure 2. In essence, the distribution of samples generated by the diffu- sion model differs from that of clean samples, leading to suboptimal performance in VC tasks.
Capabilities of the Protector. The protector may recognize that attackers attempt purification strategies to bypass the protection mechanisms. We consider two scenarios: (1) Non-Adaptive Protection, where the protector knows the structure and gradients of the voice cloning model used by the attacker, but does not consider the potential purification strategies. (2) Adaptive Protection, where the protector addi- tionally knows the purification strategies of the attacker, in- cluding the structure and gradients of the purification model.
Our Proposed Purification-Reineeeee Framework. Building on the insight above, we propose two-stage framework consisting of Purification stage and a Phoneme- Guided Refinement stage. The goal of the first stage is to preliminarily mitigate the adversarial noise, and the second stage employs a phoneme-guider diffusion model to fur- ther refine the purified samples, aligning them more closely with the clean distribution. Figure illustrates the inference process of our proposed framework.
4. Proposed Method
In this section, we introduce our purification method, de- noted as PhonePuRe. It primarily consists of two compo- nents: Purification and Phoneme-Guider Refinement.
The Refinement stage is motivated by the challenge of di- rectly mapping adversarial samples to clean samples due to the unknown distribution of adversarial perturbations. To address this, our approach is based on a key observa- tion regarding our initial Purification stage. As illustrated in Figure 4, the Purification stage results in purified clean samples and purified protected samples exhiditing similar distributions. This similarity enables the Refinement model
4.1. Overview: Ceriffcation-Refieeeent Framework
Embedding Distortions in Existing Methods. We first analyze existing purification methods. Since no prior work specifically addresses the purification of protective perturba-

---

De-AntiFake: Rethinking the Protective Perturbations Against Voice Cloning Attacks
Clean Samples
The entire Purification stage can be viewed a sequence of diffusion and denoising steps, formalized as:
x
Protected Samples
Xpur = Po(Xudv);
(5)
where & denotes the parameters of the Purification stage.
4.3. Refinement: Diffusion
Phoneme-Guided Score-Based
(a) Clean vs. Protected (Before Purification)
(b) Purified (Clean) vs. Purified (Protected)
The Refinement stage operates in the complex spectrogram domain. Given set of clean speech samples (x(+) (LN we obtain their purified versions (()) = Po (x(0). We
Figure 4. Distribution comparison of clean and protected samples (a) Before and (b) After initial Purification stage in the VC model embedding space. Different colors represent different speak- ers. The distribution of clean and protected samples becomes closer from (a) to (b), indicating that this type of diffusion- based purifica- tion leads similar distributions for clean and protected samples, and provides an accessible starting point for the Refinement stage.
then create a dataset D {(x(9, Xpor J by pairing clean and purified speech, which correspond their complex speetrograms denoted as De = {mm(), m J.N. where m = (TFT(x) (Short-Time Fourier Transform). The goal of the Refinement stage is to learn the conditional distri- bution Pe P m mpur) over De- To achieve this, we employ phoneme-guides score-based diffusion model to learn a parameterized approximation of pa (m Mprr)
to be trained using only pairs of original clean samples and purified clean samples. Since purified clean data used for training is distributionally similar to the purified protected data encountered during inference, a mapping learned from the purified clean samples to the true clean distribution can then be applied to the purified protected samples. Such an application effectively maps these purified protected sam- ples toward the clean distribution, aiming reduce the embedding distortion common in existing methods.
Phoneme Representation. The intuition behind using phonemes as guidance based on the observation that pro- tective perturbations against VC models are primarily de- signed disrupt the speaker-specific characteristics of the audio, while phonemes encode the content information of speech. Since these protective perturbations are typically imperceptible and not explicitly designed to interfere with the speech content, they are likely to have a minimal impact on the phoneme information. Thus, phoneme information can be utilized as a clue to guide the Refinement phase.
4.2. Purification: Unconditional Diffussin
During the Purification stage, we employ the model pro- posed by Kong et al. (2021), which applies the diffusion process directly to audio waveforms. Given input adver- sarial audio waveform Xadv, the Purification stage P..) uses both the forward and reverse diffusion processes to produce the purified waveform Xpur- In the forward diffusion pro- cess, noise progressively added to the initial waveform Xady over pur diffusion steps to form the final noised XT At each timestep i, the process is expressed as:
Specifically, we represent phonemes using the average mag- nitude spectrogram, denoted as A, which has the same shape as the linear magnitude spectrogram |m| of the audio x. To compute A, three steps are followed: (1) First, ob- tain the text transcription for each training sample. Then, perform phoneme alignment using the forced aligner (an acoustic model which aligns text to audío the phoneme level, implemented in tools like Montreal Forced Aligner (MFA) (McAuliffe et al., 2017)) convert the transcrip- tion of each training sample into time-aligned phoneme sequence: (2) Next, compute the linear magnitude spec- trograms of all training samples; (3) For each phoneme, calculate the average linear magnitude spectrogram across instances of that phoneme the training set as its rep- resentation. These representations are stored in an average phoneme dictionary.
((xx/xx-) = (xii V 1- t = 1,2, .,, .Turs
1.
where 3r denotes the variance schedule, and X = Xadv- The reverse process denoises the waveform XT,., in the same pur steps, and at each step, is formulated as:
X,_1 ~ Po(xx, xx) N (xx ( o2
In the Refinement stage, the audio samples and their corre- sponding text are set as input. Then we use forced aligner to perform phoneme alignment and look up the phoneme dic- tionary to retrieve the average spectrograms for the aligned phonemes. These averaged values are concatenated along
(4)
Tpur, T por
1,
where eoo (Xe, f) is the mean function parameterized by 6, of is the time-dependent variance schedule, and Xg Xpur-
5

---

De-AntiFake: Rethinking the Protective Perturbations Against Voice Cloning Attacks
the time axis to form a phoneme representation A.
Protection Methods. We evaluated three mainstream pro- tective perturbation methods: Attack (Huang et al., 2021), AntiFake (Yu et al., 2023) and VoiceGuard (Li et al., 2023b), which achieve the highest protection success rates in our experiments. Details of the protection methods can be found in App. A.3.
Score-Based Diffusion. To incorporate phoneme infor- mation, we concatenate the phoneme representation A with the complex spectrogram Mpur to form the guid- ing input [mprr, A] for the Refinement stage. We em- ploy a score-based diffusion model based on the Ornstein- Uhlenbeck Stochastic Differential Equation (OUSDE) fol- lowing Welker et al. (2022). During training, given a clean sample my and its purified version mpur- the distribution of the diffused state m, can be expressed as:
Adversarial Purification Baselines. We compare our method against five recent adversarial purification meth- ods: the transformation-baat based WaveGuard (Hussain et al., 2021) and SpeakerGuard (Chen et al., 2023), and the cronstruction-based AudioPure (Wu et al., 2023), WavePu- rifier (Guo et al., 2024), and DualPure (Tan et al., 2024). Details are provided in App. A.4.
m, mm [mprr, T)) + (TT)
(6)
where μ and a are defined following the variance-exploding scheme of Särkkä & Solin (2019), and z ~ No( I). There-
Evaluation Dataset. The evaluation set consists of 25 speakers from the test-clean subset of LibriSpeech (Panay- otov et al., 2015), each contributing 5 sentences. These speakers do not overlap with those in the training set of the adversarial purification models. We apply all six VC methods to the evaluation set, resulting in 750 (25 x 5 x 6) synthetic speech samples. Following previous work (Yu et al., 2023; Huang et al., 2021; Li et al., 2023b), we filter 739 synthetic speech samples that successfully pass at least one SV system for subsequent evaluation.
fore, the denoising score matching objective is used to train the score model 86 (Song et al., 2021):
(( = E.
88 (m., [mp. A),
z (T)
where employ score estimator s based on the NCSN++ architecture (Song et al., 2021), and ob denotes the parame- ters of the Refinement stage.
During inference, we perform forward diffusion on mpr to obtain the noised state my = Mour + o (Tis)z, where z ~ No I), and Teet represents the final time step for the Refinement process. We then perform reverse sampling with step size Ar= N' where N is the total number of reverse steps. At each discrete step, we use a predictor- corrector sampling scheme, discrete sampling method, corrected by one-step annealed Langevin dynamics (Song et al., 2021), to compute mr-Ar using the score function of m,, yielding the refined spectrogram mee. Finally, mee is converted back to the time domain through the inverse STFT (ISTFT) obtain the refined audio waveform X The overall Refinement stage I((-) can be expressed as:
Evaluation Metrics. Our evaluation includes both objective and subjective metrics. Objective metrics include speaker verification accuracy (SVA) for effectiveness and objective mean opinion score (MOS) for naturalness. The SVA com- ponent measured using x-vector- SV (xSVA) (Des- planques et al., 2020) and d-vector-based SV (dSVA) (Wan et al., 2018), calculated as:
N SV (X(aame)
1 N
SVA
(9)
where Xdloned is the i-th cloned speech sample, N is the total number of cloned samples, and SV(-) is the binary decision by x-vector or d-vector-based SV model. For the objective MOS, we employ NISQA (Mittag et al., 2021), neural network-based model for objective audio quality assessment, which evaluates overall quality and naturalness on a scale of 1 to 5, with higher scores indicating better quality. Subjective metrics involve perceived speaker sim- ilarity, assessed by human listeners who determine if two samples are from the same speaker using a four-level scale: Same (Certain). Same (Uncertain), Different (Uncertain), and Different (Certain). Details are provided in App. A.6.
Xxef= (x A) = Rop(PPoXaai A),
where the refined audio waveform x is the final output of our whole purification method.
5. Experiments
5.1. Experimental Setup
Voice Cloning Methods. We selected six advanced VC methods for evaluation, including three TTS models: YOUTTTS (Casanova et al., 2022), SV2TTS (Jia et al., 2018), and TorToise (Betker, 2023); and three voice conversion models: DiffVC (Popov et al., 2022), OpenVoice V2 (Qin et al., 2023), and SeedVC (Liu, 2024). Implementation details are provided in App. A.I.
Training Details. Our method trains two models sepa- rately, and cascades them during inference. The Purification model is based on a pretrained unconditional DiffWave model (Kong et al., 2021) which is then fine-tuned on the LibriSpeech (Panayotov et al., 2015) dataset in the time
6

---

De-AntiFake: Rethinking the Protective Perturbations Against Voice Cloning Attacks
Table 1. Speaker verification accuracy of synthesized speech on the evaluation dataset.
Purification Method
Protection Method
VC Method
Protected
WaveGuard
SpeakerGuard
DualPure
WavePurifier
AudioPure
Ours
XSVA
dSVA
XSVA
dSVA
XSVA
dSVA
XSVA
dSVA
xSVA
dSVA
X5VA
dSVA
xSVA
dSVA
YourTTS
0.034
0.029
0.328
0.155
01.777
0.136
0.067
0.025
0,286
0,301
0.597
0.417
0.672
0.689
SV2TTS
0.019
0.000
0.038
0.008
0.038
0.033
0.067
0.000
0.298
0,264
0.279
0.306
0.654
0.744
Tortoise
0.059
0.042
0.051
0.025
0.034
0.025
0.025
0.000
0.203
0.167
0.441
0.475
0.627
0.725
AntiPake
DiffVC
0.029
0.040
0.048
0.032
0.096
0.113
0.019
0.016
0.317
0.379
0.231
0.331
0.673
0.823
OpenVeice*
0,433
0.405
0.327
0.207
0.240
0.241
0.048
0.026
0.337
0,190
0.471
0.534
0.625
0.776
SeedVC*
0,331
0.455
0.153
0.211
0.395
0.325
0.000
0.000
0.355
0.447
0,363
0.642
0.702
0.805
Avg.
0.152
0.164
0.159
0.105
0.186
0.146
0.037
0.011
0.299
0.293
0,401
0.451
0.660
0.762
YouTTS
0.108
0,000
0.571
0.359
0.605
0,544
0.412
0.350
0,588
0.612
0.739
0.515
0.748
0.709
SV2TTS
0.127
0.140
0.173
0.107
0.221
0.273
0.067
0.074
0.510
0.636
0.731
0.868
0.740
0.893
Tortoise
0.131
0.092
0.195
0.175
0.381
0.350
0.034
0.000
0.508
0,283
0.746
0.833
0.754
0.883
VCI
DiffVC
0,173
0.282
0.231
0.169
0,260
0,476
0.000
0.000
0.587
0.661
0.817
0.903
0.846
0.935
OpenVoice
0.000
0.000
0.394
0.293
0.327
0.345
0.048
0.043
0.481
0,336
0.635
0.724
0.663
0.862
Avg.
0,108
0.108
0.317
0.216
0.366
0.394
0.118
0.086
0.536
0,505
0.734
0.777
0.750
0.861
YouTTS
0.050
0.000
0.521
0.136
0.462
0,330
0.378
0.282
0.496
0,563
0.672
0.417
0.697
0.621
SV2TTS
0.058
0.058
0.106
0.033
0.115
0.017
0.067
0.282
0.375
0.421
0.596
0.752
0.731
0.851
Tortnise
0.042
0.008
0.161
0.175
0.136
0.025
0.000
0.407
0.242
0.712
0.742
0.754
0.892
VoiceGunrd
DiffVC
0,029
0.121
0.173
0.121
0.135
0.185
0.000
0.000
0.510
0.508
0.683
0.847
0.750
0.903
VpenVVicee
0,000
0.000
0.327
0.164
0.212
0.224
0.067
0.034
0.317
0.207
0.606
0.759
0.683
0.853
Avg.
0.036
0.039
0.262
0.125
0.217
0.163
0.113
0.115
0.423
0.385
0.656
0.712
0.723
0.830
Total
0.099
0.104
0.246
0.148
0.256
0.234
0.089
0.070
0.419
0.394
0.597
0.647
0.711
0.818
The asterisk (*) indicates black-box senario (sce App. A.3). Best performance is highlighted in bold.
domain. The Refinement model is trained on pairs of the original clean samples and purified samples derived from an augmented LibriSpeech dataset as described in section 4.3. The Refinement stage operates in the complex spectrogram domain, utilizing 16 kHz STFT with window size of 510, hop length of 128, and square-root Hann window. Details of the training process can be found in App. A.5.
AntiFake protection. Additionally, when listening to these purified samples, they appear muffled and contain notice- able artifacts, indicating that existing methods introduce distortions, which likely contribute to the lower SVA.
1.0
0.9
0.9
Spcaker Verffcatton Scare
Enteeking Sirnian Strviaiity
0.0
0.8
0.7
0.7
5.2. Main Results
0.6
6.6
0.5
Objective Evaluation.
6.5
Mean Median
Existing Protection and Purification Methods. We first eval- uate existing methods from the perspective of effectiveness under the threat model in section 3. Table 1 shows the xSVA and dSVA of speech synthesized using protected or puri- fied samples in two SV systems. We present the results of the best-performing purification methods from each paper; other results are provided in App. B.I.
0.4
Threshold
Protected
WavePuttter
AudioPure
Ous
Clean
Protected
WavaPurtler
AudioPure
Ous
(a) VC embedding similarity (b) Synthesized speech SV score
Figure 5. Distribution of (a) Cosine similarity between clean and protceted/purifidd samples in VC model embedding space; (b) Speaker verification scores for synthesized speech using clean, protected, and purified samples.
We find that without adversarial purification, all protec- tion methods successfully reduce the SVA to below 20% in a white-box box setting. However, when using purification methods, we observe a significant increase in the SVA. For instance, AudioPure can increase the XSVA to an average of 59.7%. This indicates that existing adversarial purification methods can neutralize protective perturbations, allowing attackers to successfully clone the protected speech.
Our Purification Method. We first examine whether our method reduces the distortion in VC model embedding space. As illustrated in Figure 5a and Figure 2d, embed- dings of purified samples are brought closer to those of clean samples, demonstrating effective distortion reduction.
Nevertheless, we find that existing methods still result in a relatively low SVA under certain protection methods. For example, AudioPure has a dSVA of only 45.1 1 % against the
We further evaluate the effectiveness of our method by an- alyzing speaker verification performance. As shown in Ta- ble 1, our method achieves the highest xSVA and dSVA across all VC models and protection methods, In particular,
7

---

De-AntiFake: Rethinking the Protective Perturbations Against Voice Cloning Attacks
Table 2. Ablation study of our components in different protection methods.
Purification Stage
Refinement Stage
Phoneme Guidance
Aniilake
AttacKVC
VoiceGuard
Total
Method
XSVA
dSVA
XSVA
dSVA
XSVA
dSVA
XSVA
dSVA
w/o Purification
X
/
0,324
0.339
0.446
0.500
0.279
0.274
0.350
0.371
w/o Refinement
K
0.401
0.451
0.734
0.776
0.656
0.712
0.597
0.646
w/o Phoneme
/
0.632
0.719
0,743
0.829
0.710
0.810
0.695
0.786
Full model
/
0.660
0.762
0.750
0.861
0.723
0.830
0.711
0.818
Figure presents our subjective evaluation results. The results indicate that the speech synthesized from purified voices not only bypasses SV systems but also exhibits higher speaker similarity in subjective assessments, demonstrating potential risks of VC attacks. Furthermore. tion method outperforms existing methods in enhancing the cloned speech's 's perceptual similarity to the original speaker, thereby increasing the potential for such attacks.
Table 3. Objective MOS of synthesized speech.
Clean
Protected
AudioPure
WavePurifier
Ours 3.36 + 0.58
3.42 - 0.59
3.16 + 0.65
3.14 = 0.55
3.34 + 0.67
purifica-
our method achieves a dSVA of 76.2% on the AntiFake protection method, surpassing existing methods by at least 31.1%. Figure 5b compares the distribution of speaker veri- fication scores for speech synthesized from various samples. Compared existing methods, our method's distribution is closer to that of clean speech, which aligns with the im- proved fidelity observed in VC model embedding space, confirming that our method significantly enhances the abil- ity of VC models to replicate the target speaker identity.
5.3. Ablation Study
Purification-Reinnemnn Framework. We first evaluated the effectiveness of our two-stage framework, as shown in Table 2. Compared to the full framework, removing either the Purification or Refinement stage resulted in worse per- formance. Without the Refinement stage, the performance decreased, emphasizing its contribution to improvement. Conversely, omitting the Purification stage led to much lower performance, indicating that the Refinement model fails to neutralize perturbations without prior Purification stage. This suggests that the Purification stage neutralizes perturbations, while the Refinement stage enhances perfor- mance, confirming the effectiveness of our framework.
Quality of Synthesized Speech. Table shows the objective MOS scores for speech synthesized from samples purified using our method and existing purification methods. The re- sults demonstrate that our method yields greater naturalness, enhancing the ability of the VC model to both replicate the target speaker identity and produce more natural speech.
Subjective Evaluation.
Thoneme-Guidance in Refinement. We further evaluated the impact of phoneme guidance in the Refinement phase on our method, as shown in Table 2. We found that introducing phoneme guidance improved SVA. Moreover, even with- out phoneme guidance, our method outperforms existing methods under all protection strategies.
We follow previous work (Huang al., 2021) and conduct listening test with 20 participants, who asked to rate the perceived speaker similarity between the original clean speech and speech synthesized using clean, protected, and purified samples. For each pair of utterances, participants decide if the two utterances are from the same speaker by selecting one of four options: Same (Certain). Same (Uncer- tain), Different (Uncertain), and Different (Certain). Each participant is asked to assess 40 speech pairs, resulting in total of 800 evaluations.
Perturbation Budget and Purification Steps. Since Purification and Refinement stages are cascaded, a natural question is whether our method simply improves perfor- mance by increasing the number of diffussio steps. Figure 7 shows the performance of our method against the Attack protection method under different perturbation budgets e and Purification stage diffusion steps T Tpu..
100%
Same (C Certain) Same (U Incertaint
80%
Different (Uncertain)
60%
Different (Certain)
We find that, for the same perturbation budget, the number of Purification stage diffusion steps Tpur increases, the pu- rification performance initially improves and then decreases. This aligns with our intuition, as more diffusion steps di- lute both the perturbations and the sample details, making purified samples blurry or overly smooth. For smaller per- turbation budgets, fewer diffusion steps generally perform better, while larger budgets favor more steps.
40%
20%
Clean
Protected
AudioPure
Figure 6. Perceived speaker similarity between original clean speech and synthesized speech using clean, protected, and pu- rified samples, as assessed by human listeners. Audio samples are available online: https//de--mtifakk.gnn wwwptiiaak.iittb.iooo.. github.io/sampplee
8

---

De-AntiFake: Rethinking the Protective Perturbations Against Voice Cloning Attacks
Moreover, our full two-stage model outperforms the Pu- rification stage alone across all perturbation budgets and diffusion steps, even when the perturbation budget is small. This suggests that performance improvement comes not from adding more diffusion steps (since Purification stage does not achieve the same performance gains with an in- creased number of steps), but from aligning the purified distribution with the clean distribution via Refinement, fur- ther confirming the effectiveness of our framework.
(EOT) on BPDA adaptive protection, using EOT sizes of 5, 10, and 15. We use the AttackVC protection method and implement 150-step BPDA+EOT adaptive protection for the DiffVC model.
Adjoint Brudient-Basell Adaptive Protection. We inte- grate the Purification stage into the perturbation generation pipeline, using the adjoint method from Wu et al. (2023) to calculate the gradients of the Purification stage, avoiding out-of-memone issues. Other experimental settings remain consistent with the BPDA adaptive protection.
1.0
0.49
0.42
0.35
0.28
0.38
0.93
0.03
0.06
0.17
62
0.74
Adaptive Protection Results. We implement two adaptive protection strategies for different purification methods re- spectively, purify the generated adaptive protection samples, and then use the purified samples to perform the VC process. The resulting dSVA of the synthesized speech is shown in Figure 8. We observe that under both adaptive protection strategies, our method demonstrates greater robustness than existing methods. The small variation in dSVA across dif- ferent EOT sizes indicates that EOT plays a limited role in generating effective adaptive perturbations. Even at an EOT size of 15, our method maintains a VS above 0.8, indi- cating that substantial proportion of synthesized speech using the purified samples can still evade speaker verifi- cation. Consequently, even under white-box conditions, designing adaptive protection for our purification method remains a challenge for protectors, highlighting the risks we have identified.
0.53
0.63
0.69
0.91
0.85
0.04
0.05
0.13
0.47
2.
76
0.79
0.77
0.72
0.67
0.67
0.85
0.90
0.97
0.87
0:50
0.84
0.53
0.73
0.03
0.06
0.37
0.75
0.06
85
0.81
0.77
0.77
0.77
Patturadion hudgee
0.87
0.94
0.96
0.92
0.90
0.88
0.85
0.81
0.79
0.8
0.02
0.28
0.85
0.91
96
0.75
0.92
0.95
0.95
0:83
0.86
0.82
0.015
0.93
0.87
87
0.81
0.74
0.98
0.35
0.98
0.94
89
0.88
0.87
0.83
0.79
0.01
0.91
0.93
0.60
0.8
87
0.78
0.7
75
0.72
0.68
0.6
0.99
0.96
0.93
0.90
92
0.86
0:87
0.88
0.73
0.005
0.94
0.95
0.91
0.60
85
80
80
0.77
0.73
0.97
0.96
0.96
90
0:85
0:25
0.78
0.4
0.0025
0.96
0.92
0.90
0.8
0.74
83
2
Purfication tep
Figure 7. Impact of perturbation budget and diffusion steps of Pu- rification stage on our method. In each grid, the lower-left comerr represents the Purification stage only. while the upper-right corner shows the results for the full two-stage framework.
1.0
No Punfication Adjoint-AudioP ure Adjoint: Durs BP DA AudicPure 3P DA-Ours
0.8
5.4. Adaptive Protection
g 0.6
0.4
Adaptive Protection Strategies. Adaptive protection en- hances the robustness of perturbations by considering the impact of purification methods. In white-box scenario, where the protector has full access to the attacker's VC model, purification methods, and gradients, a common ap- proach is integrating the purification into the perturbation generation pipeline to optimize with gradients.
0.2
0.0
10
EOT Size
Figure 8. Robust dSVA under different adaptive strategies.
However, the iterative nature of the diffusion models in our Purification and Refinement stages creates deep computa- tional graphs, leading to high memory costs, vanishing gra- dients, and exploding gradients (Lee & Kim, 2023a; Kang et al., 2024), complicating gradient computation. To over- come these challenges, we use two approximation methods:
6. Conclusion
In this paper, we conduct the first systematic evaluation of protective perturbation- VC defenses under realistic threat models that include perturbation purification. Our experiments demonstrate that attackers can use purification methods to bypass most of these protections and success- fully synthesize speech that can deceive both speaker ver- ification systems and human perception. Furthermore, we introduce novel two-stage adversarial purification method, proposing Purification- -eefiiiion--eeemeent framework that incor- porates phoneme guidance during the Refinement stage. Ex- perimental results demonstrate that our method outperforms state-of- sate-of-the-aal methods in bypassing perturbation based VC defenses and robust against adaptive protections.
Backward Pass Differentiable Approximation (BPDA) Adaptive Protection. We integrate the full purification method into the perturbation generation pipeline. Following Nie et al. (2022), we treat the purification process an iden- tity transformation during backpropagation, allowing us to compute approximate gradients and optimize perturbations end-to-end. Due to the randomness in the diffusion and re- verse processes, we apply Expectation Over Transformation

---

De-AntiFake: Rethinking the Protective Perturbations Against Voice Cloning Attacks
Acknowledgements
Computing, 20 September 2023, ISSN 1941-0018. doi: 10.1 1011009/TDDSC.002222207.. URL hog.:/ppoo.e.........ooooommmmo. document/
This work was supported part by the National Natu- ral Science Foundation of China under Grant 62472398, U2336206, U2436601, and 62121002.
Chen, G., Wu, Y., Liu, S., Liu, T., Du, X., and Wei, F. WavMark: Watermarking for Audio Generation, Jan- uary 2024. URL 12770.
Impact Statement
org/ abs/2308.
This study aims to assess the limitations of existing voice cloning defenses based on protective perturbations and pro- poses a novel adversarial purífication method to undermine these defenses. The societal implications of this work are complex and may raise potential ethical and social con- cemns. On one hand, our findings contribute to deeper understanding of the vulnerabilities in current VC defenses, which can inform the development of more robust solutions to prevent malicious use of voice cloning technology. On the other hand, the technique we propose could be misused to bypass VC defenses, enabling malicious actors to clone voices more effectively for fraudulent or harmful purposes. This underscores the urgent need for ethical considerations, regulatory frameworks, and public awareness to mitigate the risks associated with voice cloning technology. We en- courage collaboration between the research community and policymakers to address these challenges and ensure that ad- vancements in this field are guided by principles of security, privacy, and societal well-being.
Cox,
How broke into a bank account with an Al-generated voice, 2023. URL https://www. www. wwwpa//eeeaaaaaaaeeeee we/aarice/e/ott i ai ai-generated-vooic.
Deng, J., Chen, Y. Zhong, Y., Miao, Q. Gong, X., and Xu, W. CATCH YOU AND I CAN: Revealing Source Voiceprint Against Voice Conversion. USENIX, 2023.
Desplanques, B., Thienpondt, J., and Demuynck, ECAPA-TDNN: emphasized channel attention, propa- gation and aggregation in TDNN based speaker verifi- cation. In Meng, H., Xu, B., and Zheng, T. F. (eds.), 1 Annual Conference of the International Speech Communication Association, Interspeech 2020, Virtual Event, Shanghai, China, October 25-29, 2020, pp. 3830- 3834. ISCA, 2020. doi: 10.2147/NNTERSPECCHH 2020-2650. URL https: /ooi. 0tt...orgg10.214399 Interspeech 2020-2650
References
Andrews, L. used AI voice cloning steal .250. took 15 minutes, 2024. URL httph:///www/ thetimes. com/bus hoansiinesssmooee//mnee///rraaaa
Dong. S., Chen, B., Ma, K., and Zhao, G. Active Defense Against Voice Conversion Through Generative Adversar- ial Network. IEEE Signal Processing Letters, 31:706- 710, 2024. ISSN 1070-9908, 1558-2361. doi: 10.1109/ LSP:2024.3365034, URL https://eeeexplore i eee www.ooog//ooooo.. wwwooooeee/10300000
it-took 11---1--miiintts 6vj586753.
Betker, J. Better speech synthesis through scaling. arXiv
preprint arXiv:2305.072 00240,, 2023.
FTC. FTC submits comment to FCC on work to protect con-
sumers from potential harmful effects of AI, 2024. URL
Blue, L., Warren, K., Abdullah, H., Gibson, C., Vargas, L., O'Dell, J., Butler, K., and Traynor, P. Who Are You (I Really Wanna Know)? Detecting Audio DeepFakes Through Vocal Tract Reconstruction. In 31st USENIX Security Symposium (USENIX Security 22), pp. 2691- 2708, 2022.
press--eeleaasss/222////tooooooo /nwws/
https::/www.ff. ftc http://www....eeeee///eeeete////
Guo, H., Wang. G., Chen, B., Wang, Y., Zhang, X., Chen, X., Yan, Q., and Xiao, L. WavePurifier: purifying audio adversarial examples via hierarchical diffusion models. In Proceedings of the 30th Annual International Conference on Mobile Computing and Networking. pp. 2024.
Casanova, E., Weber, J., Shulby, C. D., Junior, A. C., Gölge, E., and Ponti, M. A. Yourtts: Towards zero-shot multi- speaker tts and zero-shot voice conversion for everyone. In International Conference on Machine Learning, pp- 2709-2720. PMLR, 2022.
Huang, C.-y., Lin, Y. Y., Lee, H.-y., and Lee, L.-s. De- fending Your Voice: Adversarial Attack on Voice Con- version. In 2021 IEEE Spoken Language Technology Workshop (SLT), pp. 552-559, Shenzhen, China, Jan- uary 2021. IEEE. ISBN 978-1-7281-7066-2 doi:
Chen, G., Zhao, Z., Song, F., Chen, S., Fan, L., Wang. F,, and Wang, J. Towards Understanding and Mitigating Audio Adversarial Examples for Speaker Recogni- tion. IEEE Transactions on Dependable and Secure
10

---

De-AntiFake: Rethinking the Protective Perturbations Against Voice Cloning Attacks
10.1 00.11099SL44499022221999833 URL https:// ieeexplore, .ew.ee...o...eeeeeeeeeeeeeeeeeee wttpg///oooee//////e 9333359//
J., Ye, D., Tang, L.., Chen, C., and Hu, S. Voice Guard: Protecting Voice Privacy with Strong and Imperceptible Adversarial Perturbation in the Time Domain. In Proceed- ings of the Shirny-Second International Joint Conference on Artificial Intelligence, pp. 4812 1812-4820, Macau, SAR
Hussain, S., Neekhara, P., Dubnov, S., McAuley, J., and Koushanfar, F. WaveGuard: Understanding and Mitigat- ing Audio Adversarial Examples. USENIX, 2021.
China, August 2023b. International Joint Conferences on Artificial Intelligence Organization. ISBN 978-1-956792- 03-4. doi: 10.244966/ijcci220233/3333 URL https: / //www. iiaaaicaaaa. wttp:/aaa...g.p.ommm httpp//oeeoooeeeeegggg2/2/22////
Ji, Z., Lin, C., Wang, H., and Shen, C. Speech-Forensics: Towards Comprehensive Synthetic Speech Dataset Estab- lishment and Analysis. In Proceedings of the Thirty- Third International Joint Conference on Artificial In- telligence, pp. 413-421, Jeju, South Korea, August 2024. International Joint Conferences on Artificial In- telligence Organization. ISBN 978-1-956792-04-11 doi: 10.249 2224966//jcaii.2224444 URL https: org/ htt:://ooceeeee ngs 2024/46.
Li, X., Li, K., Zheng, Y., Yan, Ji, X., and Xu, W. SafeEar: Content Privacy-Preserviin Audio Deepfake Detection. CCS, 2024.
Liu, C., Zhang, J., Zhang, T., Yang, X., Zhang, W., and Yu, N. Detecting Voice Cloning Attacks via Timbre Water- marking. In Network and Distributed System Security Symposium, 2024a. doi: 10.14422/ndss.2000
Jia, Y., Zhang, Y., Weiss, R., Wang, Q. Shen, J., Ren, F., Nguyen, P., Pang, R., Lopez Moreno, I., Wu, Y., et al. Transfer learning from speaker verification mul- tispeaker text-to-speech synthesis. Advances in neural information processing systems, 31, 2018.
Liu, S. Zero-shot voice conversion with diffusion transform- ers. arXiv preprint arXiv:241 1.09943, 2024.
Liu, W., Li, Y., Lin, D., Tian, H., and Li, H. GROOT: Gen- erating Robust Watermark for Diffusion M-oel--Bdeeed Audio Synthesis. In Proceedings of the 32nd ACM In- ternational Conference on Multimedia, pp. 3294-3302, 2024b.
Kang, M., Song, D., and Li, B. Diffattack: Evasion attacks against diffusion-based adversarial purification. Advances in Neural Information Processing Systems, 36, 2024.
Kong, Z., Ping, W., Huang, J., Zhao, K., and Catanzaro, B. DiffWave: A Versatile Diffusion Model for Audio Synthe- sis. In International Conference on Learning Represen- tations, March 2021. URL https: / openreview. net/ forum? - XJJJ.
Liu, Z., Zhang, Y., and Miao, C. Protecting Your Voice from Speech Synthesis Attacks. In Annual Computer Security Applications Conference, pp. 394-408 408, Austin TX USA, December 2023. ACM. ISBN 979-8-4007-0888--. doi: 10. 00.144/3627100636277100 URL https:h/tll.......eeee acm. org/ / http//oi/11...00 http://......///311 3
Koronka, P. How AI is giving motor neurone disease sufferers their old voices back, 2024.
McAuliffe, M., Socolof, M., Mihuc, S., Wagner, M., and Sonderegger. M. Montreal forced aligner: Trainable text- speech alignment using kaldi. In Interspeech 20/7 pp. 498-502, 2017. doi: 1022144//neergpecch201111--
URL https: www.::ttttimmmcoommmm com/uk/ shone-ai-als-ttntt
Lee, M. and Kim, D. Robust evaluation of diffusion-basse adversarial purification. In Proceedings the IEEE/CVF International Conference on Computer Vision, pp. 134- 144, 2023a.
Mittag, G., Naderi, B., Chehadi, A., and Möller, NISQA: deep enn-self-attennion model for multidi- mensional speech quality prediction with crowdsourced datasets. In Hermansky, H., Cernocký, H., Burget, L., Lamel, I.., Scharenborg, O., and Motlicek, P. (eds.), 22nd Anmual Conference of the International Speech Communication Association, Interspeech 2021, Brno, Czechia, August 30 September 3. 2021, pp. 2127- 2131. ISCA, 2021. doi: 10.21437/NTERSSPECCH 2021-299. URL https: / /oii/iioo//// ottg/1..1/1117 Interspeech.c 2ww.echh...2299....
Lee, M. and Kim, D. Robust Evaluation of Diffusion- Based Adversarial Purification. In 2023 IEEE/CVF In- ternational Conference on Computer Vision (ICCV). pp. 134-144, Paris, France, October 2023b. IEEE. ISBN
979-8-3503-0718-4, doi: 10.1109/CCCV11000.222..
00019. URL httpt:tt///// document/ /00
httt:::://ieeepploreeee weee...eooooo .rg/
Nick Evershed, J. T. AI can fool voice recognition used to verify identity by centrelink and australian tax office, 2023. URL https::/www.thhqaaztt
Li, J., Tu, W., and Xiao, L. Freeve: Towards high- quality text-free one-shot voice conversion. In ICASSP 2023-2023 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). pp. 1-5. IEEE, 2023a.
cam//techooleeyy/200////////oooe
Santrellit--can-----ooooo------

---

De-AntiFake: Rethinking the Protective Perturbations Against Voice Cloning Attacks
Nie, W. Guo, B., Huang, Y., Xiao, C., Vahdat, A., and Anandkumar, A. Diffusion models for adversarial purifi- cation. In International Conference on Machine Learning, pp. 16801-8800000 16827. PMLR, 2022.
doi: 1021187/hnexxpechh222---- URL https:
www..isca-archivve.. 2024 2024/tan24 int.rspeerr...hhh.e html.
Thiemann, J., Ito, N., and Vincent, E. The diverse environ- ments multi-channe acoustic noise database (demand): database of multichannel environmental noise recordings. In Proceedings of Meetings on Acoustics, volume 19. AIP Publishing, 2013.
OpenAI. Navigating the challenges and op- portunities of synthetic voices, 2024. URL https://openai: com/index/navigaainng aawp:/ggeeeaaddoooooooooitteeeee synthetic-voices/
Tian, Y., Liu, W., and Lee, T. Diffusion- Mel-Spectrogram Enhancement for Personalized Speech Synthesis with Found Data. In 2023 IEEE Automatic Speech Recognition and Understand- ing Workshop (ASRU), pp- 1-7, December 2023. doi: 10.1009/ASRUS7964.2003..888 1033977. URL https::/ Lewe http:///or........e//ooo/oooooee document/ 1 10389748 1083778//acmummbrr10033939
Panayotov, V., Chen, G., Povey, D., and Khudanpur, S. Librispeech: an corpus based on public domain au- dio books. In 2015 IEEE international conference on acoustics, speech and signal processing (ICASSP), pp. 5206-5210. IEEE, 2015.
Popov, V., Vovk, I., Gogoryan, V., Sadekova, T., and Kudi- nov, M. Grad-TTS: A Diffusion Probabilistic Model for Text-to-Speech. In International Conference on Machine Learning, pp. 8599-8608. PMLR, 2021.
Wan, L., Wang, Q., Papir, A., and Moreno, I. L. Generalized end-to-end loss for speaker verification. 2018 IEEE In- ternational Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 4879-4883 IEEE, 2018.
Popov, V., Vovk, I., Gogoryan, V., Sadekova, T., Kudinov, M. S., and Wei, J. Diffusion-based voice conversion with fast maximum likelihood sampling scheme. In Interna- tional Conference on Learning Representations, 2022.
Wang. Y., Guo, H., Wang, G., Chen, B., and Yan, Q. VS- Mask: Defending Against Voice Synthesis Attack via Real-Time Predictive Perturbation. In Proceedings the 16th ACM Conference Security and Privacy in Wire- less and Mobile Networks, pp. 239-250, Guildford United Kingdom, May 2023. ACM. ISBN 978-1-4503-9888 1-4503-9859--6 doi: 10. 10.1145/3588422.5590119 URL https: /dl. acm. wttp://pp//.ooo.//////////o....t acm.org/aaa./...115555555555 82. http:/555554223551115 3590189.
Prime Voice AL Elevenlabs, 2025. URL https://
elevenlad aatonlabs..... abs.io/.
Qin, Z., Zhao, W., Yu, X., and Sun, X. Openvoice: Versatile instant voice cloning. arXiv preprint arXiv22312.0149, 2023.
Ren, Y., Zhu, H., Zhai, I.., Sun, Z., Shen, R., and Wang. I.. Who Speaking Actually? Robust and Versatile Speaker Traceability for Voice Conversion. In Proceedings of the s1 ACM International Conference Multimedia, pp. 8674-8685. 2023.
Welker, S., Richter, J., and Gerkmann, T. Speech en- hancement with score-based generative models in the complex STFT domain. In Ko, H. and Hansen, J. H. L. (eds.), 23rd Annual Conference of the Interna- tional Speech Communication Association, Interspeech 2022, Incheon, Korea, September 18-22, 2022, pp. 2928- 2932. ISCA, 2022. doi: 10.2447/NNTERSPEECCH.
San Roman, R., Fernandez, P., Elsahar, H., Défossez, A., Furon, T., and Tran, T. Proactive Detection of Voice Cloning with Localized Watermarking. In ICML 2024- 41st International Conference on Machine Learning, vol- ume 235, pp. 1-17, 2024.
2022-10653. URL https: / /ooii http:o.../...111331 Interspeech. 2022-10653
Wenger, E., Bronckers, M., Cianfarani, C., Cryan, J., Sha, A., Zheng, H., and Zhao, B. Y. "Hello, It's Me" Deep Learning-based Speech Synthesis Attacks in the Real World. In Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Secu- rity, pp. 235-251, Virtual Event Republic of Korea, November 2021. ACM. ISBN 978- --550-8844444444 doi: 10.1 00.145534601220.4444444 URL https: //dl acm. org 0ttp//bb/11..115/444111111 3484742.
Särkkä, S. and Solin, A. Applied stochastic differential equations, volume 10. Cambridge University Press, 2019.
Song, Y., Sohl-Dickstein, J., Kingma, D. P., Kumar, A., Er- mon, S., and Poole, B. Score-based generative modeling through stochastic differential equations. In International Conference on Learning Representations, 2021.
Tan, H., Liu, X., Zhang, H., Zhang, J., Qian, Y., and Gu, Z. DualPure: An Efficient Adversarial Purification Method for Speech Command Recognition. Inter- speech 2024, pp. 1280 1284. ISCA, September 2024.
Wu, S., Wang, J., Ping. W., Nic, W., and Xiao, C. Defend- ing against adversarial audio via diffusion model. The
12

---

De-AntiFake: Rethinking the Protective Perturbations Against Voice Cloning Attacks
Eleventh International Conference Learning Represen- fations, 2023. URL https:/ pesttss:/operreee http///peneeeeeeeeeeeee net./
Yang, C.-Y., Upadhyay, S. G., Wu, Y.-T., Su, B.-H., and Lee, C.-C. RW-VoiceShield: Raw Waveform-based Adversarial Attack on One-shot Voice Conversion. In In- terspeech 2024, pp. 2730-2734. ISCA, September 2024.
doi: 1021157/niesspech22244453
URL https:
//www. iscc-isaass wwwpwwssc-arrchee wtt.aaaiiee.eoo//ettereeeeeeee 2024/yang255 htt.:/agggeeetttsespec......ct
Yu, Z., Zhai, S., and Zhang, N. AntiFake: Using Adver- sarial Audio to Prevent Unauthorized Speech Synthe- sis. In Proceedings of the 2023 ACM SIGSAC Con- ference on Computer and Communications Security, Pp. 460-474, Copenhagen Denmark, November 2023. ACM. ISBN 779-8-4007-0050-77 doi: 10.1145/3576915. 3623209. URL https://dl.. wttp://////aa.a..ooo/oo//oooo/// wtt.:/acc.oo///////////////////. 1145/3576915. 3623209.
13

---

De-AntiFake: Rethinking the Protective Perturbations Against Voice Cloning Attacks
A. Implement Details
setting. For each VC model, adjust the perturbation budget e ensure SVA under 20%. However, for the SeedVC model, the embedding defense was unsuc- cessful, as this model not only relies on the speaker encoder for speaker information but also uses addi- tional spectral features. Therefore, we only report the results for the other five VC models.
A.1. Implement Details of Voice Cloning
We selected six advanced VC methods for evaluation, in- cluding three TTS models: YouTTS (Casanova et al., 2022), SV2TTS (Jia et al., 2018), and TorToise (Betker, 2023); and three voice conversion models: DiffVC (Popov et al., 2022), Voine V2 (Qin et al., 2023), and SeedVC (Liu, 2024).
VoiceGuard (Li et al., 2023b): We defend against all VC models in a white-box setting. For each VC model, we adjust the adaptive parameter a, which balances stealth and protection capability, to ensure an SVA un- der 20%. For the same reasons as with Attack VC, the defense against the SeedVC model was unsuccessful. Therefore, we only present the results for the other five VC models.
We use official implementations and default parameters for all VC methods. For TTS models, we follow previous work (Yu et al., 2023) and use 24 sentences designed to simulate real-world threat scenarios as the synthetic speech content. For voice conversion models, we select random utterances from speakers in the evaluation set who are differ- ent from the current speaker as the synthetic speech content.
AntiFake (Yu et al., 2023): We used their default pa- rameters and the combination of all four speaker en- coders in the ensemble learning strategy, applying the target-based method from the paper to defend against all VC models. Since the encoders of the Open Voice and SeedVC models are not included in their ensem- ble learning strategy, we present the results for these two models as black-box setting results in Table and Table 5, while the results for the other four models presented as white-box setting results.
0.8
0.6
0.2
YourTTS
SV2TTS
Tortolse
DITVC
OpenVoice
SeedVC
*XSV
dSVA
Figure 9. Effectiveness of VC models in bypassing the SV systems.
A.2. Composition of the Evaluation Dataset
A.4. Implement Detials of Purification Baselines
The evaluation set consists of 25 speakers from the test- clean subset of LibriSpeech (Panayotov et al., 2015), each contributing 5 sentences, ranging from short (2-4 seconds) to long (10-15 15 seconds). These speakers do not overlap with those in the training set of the purification models. We apply each of the six VC methods to the evaluation set, generat- ing a total of 750 (25 X 5 x 6) synthetic speech samples. Figure shows the xSVA and VSVA of synthesized speech from original clean samples using different VC models in experiment, demonstrating the ability of each model to clone the target speaker's voice and their effectiveness in bypassing the SV system. In accordance with prior stud- ies (Yu et al., 2023; Huang et al., 2021; Li et al., 2023b), we filter 739 synthetic speech samples that successfully pass at least one SV system for subsequent evaluation.
For existing adversarial purification methods, we use their official implementations and default parameters for the ex- periments. For the reconstruction- -baee purification meth- ods, we fine-tuned their official checkpoints on the Lib- riSpeech dataset for fair comparison.
We have listed the parameters of the existing purification methods used in our experiments in Table 4. For papers with multiple methods, the boldface represents the method with the highest average SVA in our experiments. We discussed the effectiveness of these methods in section 5.2, and other results are presented in App. B.I.
A.5. Implement Details of Our Proposed Method
Implement Details of the Purification Model.
A.3. Implement Details of Protection Methods
The Purification model is based on a pretrained uncondi- tional DiffWave model', which is then fine-tuned on the LibriSpeech (Panayotov et al., 2015) dataset for 16k steps with a learning rate of 10-4, Due to the input length limita- tion of the DiffWave model (16,000 samples), we trimmed all speech samples to a length of 16,000 and fed them indi- vidually into the Purification model. During the inference stage, the outputs were then concatenated match the orig-
For methods with official implementations, we use their official code. For others, we reproduce them base on the original descriptions and adjust the parameters as needed to ensure an SVA of under 20% in white-box setting.
VC (Huang et al., 2021): We implemented the default embedding defense (emb) method from the pa- per to defend against all VC models in a white-box
14

---

De-AntiFake: Rethinking the Protective Perturbations Against Voice Cloning Attacks
Table 4. Parameters of existing purification methods in experiments.
Bascline
Method Description
Parameters
Parameter Value
Mel Extraction Inversion (Mel.)
Number of mel bins
80
Downsampling- Upsampling (DS)
Down-sampling rale (HIz)
8000
WaveGuard
Lincar Predictive Coding (LPC)
LPC order
20
(Hussain et al., 2021)
Prequency Filtering (FF)
Negative gain magnitude (dB)
30
Quantization Dequantization (QT)
Number of quantization bits
8
MPEG Compression (MP3-C)
Bit rate (constant)
16000
Average Smoothing (AS)
Kemel size
Median Smoothing (MS)
Window size
Cut-off frequency (Hz)
4000
SpeakerGuard (Chen al., 2023)
Stop-band frequeney (Hz)
8000
Low-Pass Filter (LPF)
Pass-hand ripple (dR)
Stop-band attenuation (dB)
40
Pass-band edge frequencies (Hz)
[300, 4000]
Stop-hand frequencies (Hz)
[50, 8000)
Band-Pass Filter (BPT)
Pass-band ripple (dB)
Stop-band attenuation (dB)
40
AudioPure
DiffWave DiffSpec
Number of reverse steps
3
(Wu et al., 2023)
Number of reverse steps
3
Number of reverse steps on [0, 2000] Hz
56
WavePurifier (Guo el ul., 2024)
Number of reverse sleps on [2000, 4000] Hz
40
Number of reverse sleps on (4000, 8000) Hz
40
DualPure (Tan al., 2024)
Number of sleps
3
inal length. The Purification model operates at a sample rate of 16 kHz. For reverse diffusion, we set the number of Purification steps as Tpur = 3, and employ the Denoising Diffusion Probabilistic Models (DDPM) sampling method to generate the purified audio.
MAND dataset (Thiemann et al., 2013) the train-clean- 100 subset of LibriSpeech (Panayotov et al., 2015), using only the first channel of the noise data. The Signal-to-Noiss Ratio (SNR) levels for the added noise are randomly se- lected from [0, 5, 10, 15, None], where None indicates that no noise added to the sample. Then, we use the Purifica- tion model fine-tuned on the LibriSpeech dataset purify these noisy samples and generate the purified data, where the Purification steps is set Tpur 5. The purified data is paired with the original clean data to form the training data pairs for the Refinement model. Note that the noise addition here is not intended for the Refinement model to learn denoising but serves as a data augmentation strategy designed to expose the Refinement model to various variants of the Purification distribution during training.
Implementation Details of the Refinement Model.
Model Architecture and Diffusion Details. For the Refine- ment model described in section 4.3, we utilize score estimator based on the NCSN++ architecture (Song et al., 2021). The stiffness parameter is fixed at 1.5, the ex- tremal noise levels are set to min = 0.05 and max = 0.5, and the extremal diffusion times are set to T = 1 and To = 0.03. For reverse diffusion, we use N steps and adopt the predictor-correctt scheme (Song al., 2021), applying step of annealed Langevin dynamics correction with step size of r = 0.4.
time
A.6. Implement Details
of Evaluation Metrics
Data Representation. The Refinement stage operates in the complex spectrogram domain, using STFT parameters with a window size of 5 510, a hop length of 128, and a square-root Hann window, all a sample rate of 16 kHz. To compress the dynamic range of the input spectrograms, we apply square-root magnitude warping. During training, sequences of 256 STFT frames (approximately 2 seconds) are ran- domly sampled from full-length audio samples, normalized by the maximum absolute value of the purified samples, and then fed into the network.
Speaker Verification Systems. We employ two widely adopted SV systems: the x-vector-based sv² (xSVA) and the d-vector-based SV3 (dSVA), which achieve equal er- ror rates (EERs) of 0.018 and 0.016, respectively, our evaluation dataset, representing their ability to distinguish between different speakers. For XSVA, we use the default threshold 0.25. For dSVA, we set the threshold to 0.697 using the EER criterion, as there no default.
Objective Mean Opinion Score. We employ NISQA (Mit- tag et al., 2021), neural network-based model for objective
Data Augmentation. For the training set of the Refinement model, we first add noise randomly selected from the DE-
15

---

De-AntiFake: Rethinking the Protective Perturbations Against Voice Cloning Attacks
Table 5. Speaker verification accuracy of synthesized speech using more existing purification methods.
Pusilication Method
Protection
VC
WaveGuard
SpeakotCuard
AudioPure
Method
Method
QT
LPC
AS
MS
LPF
Dif'Spee
VSVA
dSVA
KSVA
dSVA
XSVA
dSVA
xSVA
dSVA
XSVA
dSVA
KSVA
dSVA
VSVA
dSVA
XSVA
aSVA
XSVA
dSVA
YourTTS
0.042
0,049
0.118
0.068
0.050
0.029
0.151
0.078
0.034
0.010
0.168
0.307
0.034
0.019
0.059
0.010
0.048
0.050
SV2TTS
0.019
0.017
0.077
0.000
0,029
0.025
0.038
0.017
0,019
0,055
0.038
0.008
0,038
0.008
0.048
0.025
0.067
0.000
Tortoise
0.085
0,042
0.042
0.088
0.089
0.053
0.068
0.008
0,085
0,042
0.034
0.017
0.068
0.033
0.085
0.17
0.034
0.000
Fake
Difve
0.048
0,040
0.058
0.000
0.202
0.048
0.048
0.024
0.096
0.065
0.077
0.048
0.019
0.040
0.096
0.048
0.000
0.008
OpenVoice
0.442
0.388
0.033
0.106
0.390
0.385
0.240
0.259
0,308
0.422
0.471
0.774
0.452
0.483
0.221
0.078
0.038
0.043
SeedVC
0.323
0.463
0.033
0.105
0.452
0.250
0.266
0.309
0.379
0.447
0.331
0.431
0.347
0.528
0.282
0.138
0.016
0.008
Arg.
0.160
0.168
0.060
0,047
0.198
0.151
0.141
0.116
0.156
0.171
0.187
0.181
0.160
0.158
0.134
0.054
0.034
0.017
YourTIS
0.084
0.010
0.328
0.049
0.059
0.010
0.261
0.155
0.067
0.000
0.378
0.262
0.059
0.000
0.084
0.039
0.429
0.165
SV2TTS
0.096
0.174
0.087
0.000
0.413
0.215
0.173
0.174
0.163
0.273
0.154
0.182
0.192
0.182
0.183
0.066
0.038
0.050
AttakVCC
Tortoise
0.237
0.275
0.085
0.008
0.381
0.150
0.339
0.200
0.322
0.150
0.297
0.375
0.254
0.208
0.263
0.075
0.059
0.008
DifVC
0.183
0.282
0.144
0.000
0.663
0.476
0,260
0.427
0.356
0.492
0.327
0.444
0.240
0.371
0.212
0.153
0.067
0.113
OpenVoice
0.010
0,009
0.173
0.026
0.029
0.009
0.154
0.161
0.202
0.284
0.375
0.397
0.135
0.216
0.115
0.052
0.106
0,060
Avg.
0.124
0.156
0.166
0.015
0.304
0.180
0,240
0.228
0,230
0.248
0,308
0.334
0.175
0.202
0.171
0.079
0,146
0,077
YourTIS
0.042
0,019
0.269
0.078
0.042
0.029
0.143
0.029
0.042
0.010
0,269
0.058
0.042
0.010
0.067
0.029
0.202
0.039
SV2TTS
0.096
0.025
0.018
0.000
0.173
0.066
0.077
0.033
0.135
0.058
0.077
0.033
0.067
0.050
0.058
0.033
0.077
0.058
VoiceGuard
Tortoise
0.085
0.042
0.119
0.038
0,229
0.050
0.161
0.042
0,186
0.033
0.136
0.075
0.195
0.050
0.144
0.000
0.042
0.000
DirvC
0.058
0.145
0.125
0.000
0.316
0.274
0,111
0.113
0.192
0.177
0.135
02118
0.067
0,105
0.221
0.089
0.018
0.016
OpenVoice
0,000
0.000
0.106
0.009
0,029
0.000
0.087
0.138
0.135
0.198
0.221
0.216
0.096
0.060
0.048
0.009
0.067
0.060
Avg
0,056
0.048
0.137
0.017
0.162
0.087
0.124
0.072
0.137
0.098
0.169
0.122
0.095
0.057
0.107
0.043
0.089
0.034
Total
0.114
0.124
0.121
0.026
0.222
0.133
0.168
0.139
0.171
0.172
0.221
0.212
0.143
0.149
0.137
0.058
0.090
0,043
The ustorisk (*) indicates black box senanio (sec App. A.3).
audio quality assessment, which evaluates overall quality and naturalness on a 1-5 scale, with higher scores indicating better quality. For reference, the average objective MOS for the TIMIT dataset is 3.45 = 0.52 (Yu et al., 2023). Our method achieves an average objective MOS of 3.36 + 0.58 on the evaluation dataset as shown in Table 3, indicating that the synthesized speech is of high quality and naturalness.
tiple methods, the boldface represents the method with the highest average SVA in our experiments. We have discussed the effectiveness of these methods in section 5.2. In Table 5, we provide the SVA results for other methods from these papers. We found that the average SVA of these methods ranges from 0.043 to 0.222, showing limited effectiveness in bypassing the protected perturbations. As a result, we did not discuss these methods in section 5.2.
Subjective Evaluation. We follow previous work (Huang et al., 2021) and conduct a listening test with 20 partici- pants, who are asked to rate the perceived speaker similarity between the original clean speech and speech synthesized using clean, protected, and purified samples. For each pair of utterances, participants decide if the two utterances are from the same speaker by selecting one of four options: Same (Certain), Same (Uncertain), Different (Uncertain), and Different (Certain). Each participant is asked to assess 40 speech pairs, resulting in a total of 800 evaluations. The clean speech samples are randomly selected from our eval- uation set. For each selected sample, protection method is randomly assigned generate the protected and purified versions. Subsequently, a randomly selected VC method is employed to generate the corresponding synthesized speech from clean, protected and purified versions. The subjective evaluation results are presented in Figure 6.
The underperformance of transformation based methods may be due to simple transformations failing to distinguish between the features of protective perturbations and the original speech. For example, low-pass, band-pass filtering, and downsampling can remove certain frequency compo- nents of the speech, thereby affecting the ability of VC models to capture speaker characteristics. Additionally, the underperformance of the DualPure (Tan et al., 2024) and DiffSpec (Wu et al., 2023) can be attributed to their mel- spectrogram processing parameters. These methods operate on spectrograms with 32 mel-bins, which were initially designed for classification tasks. While 32 mel bins are sufficient for classification (for the classification models are trained on inputs of the same dimensionality), recon- structing waveforms from such a low-resolution spectro- gram can lead to significant distortion. However, existing voice cloning models (Casanova et al., 2022; Betker, 2023) typically utilize mel-spectrograms with 80 mel bins or more as input, relying on high-fidelity fidelity spectral features. In con- trast, WavePurifier (Guo al., 2024) employs higher reso- lution (256 x 256) spectral representation, which preserves the essential details for voice cloning, thereby performing significantly better in our experiments. DiffWave, operat-
B. Additional Experimental Results
B. Additional Results on the Effectiveness of Existing Adversarial Purification Methods
We have listed the parameters of the existing purification methods in our experiments in Table 4. For papers with mul-
16

---

De-AntiFake: Rethinking the Protective Perturbations Against Voice Cloning Attacks
Table 6. Ablation study the impact of data augmentation in different protection methods.
Purif.
Ref.
Data
Phon.
AntiFake
AttackVC
VoiceGuard
Total
Method
Stage
Stage
Aug.
Guide
xSVA
dSVA
xSVA
dSVA
xSVA
dSVA
XSVA
dSVA
WavePurifier
N/A
N/A
N/A
0.299
0.293
0.536
0.505
0.423
0.385
0.419
0.394
AudioPure
N/A
N/A
N/A
0.401
0.451
0.734
0.776
0.656
0.712
0.597
0.646
Ours (w/ Augmentation)
0.582
0.689
0.747
0.872
0.716
0.812
0.682
0.791
Ours (Full model)
0.660
0.762
0.750
0.861
0.723
0.830
0.711
0.818
1.0
Table Ablation study on the impact of speaker gender.
Speaker Gender
Protected
WavePurifier
AudioPure
Ours
Female speakers)
0.103
0.383
0.603
0.796
Male speakers)
0.106
0.414
0.677
0.856
0.4
dSVA
ing directly in the waveform domain, avoids this type of distortion, similarly leading to better results.
0.0
20
40
Number of efinement teeps
B.2. Quality of Synthesized Speech
Figure 11. Impact different Refinement steps.
Figure 10 shows the objective MOS of the synthesized speech from our method and existing adversarial purifica- tion methods. The results show that our method achieves greater naturalness across different VC models, indicating that our method not only improves the ability of VC mod- els to replicate the target speaker's 's identity characteristics but also enhances their ability to synthesize natural speech. Numerical results are provided in Table 3.
Table 8, Cross loos-lingual performance of the Refinement stage.
Metric
Protected
wlo Retinement
Full Model
dSVA
0.212
0.933
0.981
Impact of Data Augmentation. We described our data augmentation strategy in App. A.5. The impact of data augmentation on SVA is presented in Table 6. The results indicate that applying data augmentation during the Refine- ment stage can slightly improve SVA in most cases. Further- more, even without data augmentation, our method consis- tently outperforms existing purification methods, showing our method does not rely on data augmentation.
4.5
Clean
Protected
AudioP ure
Ours
MDS
3.5-
Impact of Speaker Gender. We present the dSVA results of our method and existing purification methods for speak- ers of different genders in Table We observed that our method outperforms existing purification methods across both male and female speakers, achieving higher dSVA values. Additionally, all purification methods yield higher dSVA results for male speakers compared to female speak- ers. This may be because female voices typically contain more high-freeqency information, making the separation of speech from high- frequenyyyny artifacts introduced by protec- tive perturbations more challenging.
YourTTS
SVITTS
Tortoise
Divv
OpenVokee
SeedVC
Voice Cloning Method
Figure 10. Objective MOS of VC models synthesized speech.
B.3. Extended Ablation Study
Impact of Refinement Steps. Figure 11 shows the impact of different Refinement steps N on the SVA of synthesized speech. We find that the Refinement model approaches op- timal performance at step N 15, and the SVA remains stable between steps 25 and 50. We choose N = 30 as the number of steps for the Refinement model our experi- ments to balance performance and computational efficiency.
Cross-Lingual Performance of the Refinement Stage Since phoneme representations are language-dependee investigate the impact of language on our method. We con- duct a small-batch inference on the Russian LibriSpeech",
we
fhtps://www.openssrorg////
17

---

De-AntiFake: Rethinking the Protective Perturbations Against Voice Cloning Attacks
Protected (AntiFake)
Purified (WavePurifier)
Purified (AudioPure)
Purified (Ours)
Phoneme Representations
Cleun
Figure 12. Spectrogram comparison of speech samples as voice cloning inputs. Existing purification methods tend to produce samples with similar patterns blurred details, whereas method retains details similar to those of the clean samples.
which utilizes a non-Latin script. We apply the Attack protection against the DifVVC model and use dSVA as the evaluation metric. Results in Table 8 indicate our Refine- ment stage remains effective even when inferring on a lan- guage distinct from the English training data.
Table 9, Average time consumption per second audio sample. N represents the number of Refinement steps.
Method
WavePurifier
AudioPure
Ours 30)
Ours 15)
Time Cost
4.405
0.152
1.405
0.866
B.4. Visualized Results
method is greater than that of AudioPure.
The visualization of the samples as voice cloning inputs and outputs are shown in Figure 12 and Figure 13. As shown in Figure 12, existing purification methods tend to produce similar patterns. For example, WavePurifier introduces a blotchy pattern, while AudioPure's purified samples typi- cally exhibit vertical stripes with blurred details, causing them to deviate from the clean distribution and leading to decline in the performance of the VC models (see Fig- ure 13). In contrast, samples purified with our method retain details similar to those of the clean samples, enabling the VC model to better capture the speaker's ' characteristics. These visual results align with both our design objectives and the numerical experiments.
We believe this is acceptable for determined voice cloning attackers, voice cloning attacks are typically performed offline. Attackers usually have only a few protected audio samples (ranging from a few seconds to a few minutes) and ample time to prepare their attacks. Moreover, our method's 's computational cost of our method can be reduced by decreasing the number of steps in the Refinement phase. For example, when the number of Refinement steps is set to N = 15, the SVA approaches optimal performance (as shown in Figure 11), and the processing time per second of speech sample 0.866.
C. Discussion
B.5. Time Cost
Advanced Adaptive Protection Methods. Although in section 5.4, white-box adaptive strategies like BPDA and adjoint struggle to generate effective perturbations in our ex- periments, several works in vision tasks (Kang et al., 2024; Lee & Kim, 2023b) have successfully performed adaptive adversarial attacks against diffusion-basse adversarial pu-
run different purification methods on the NVIDIA RTX A6000 and obtain the average time spent processing each second of audio for each method, as shown in Table 9, Since method introduces based diffusion model dur- ing the Refinement phase, the computational time for our
18

---

De-AntiFake: Rethinking the Protective Perturbations Against Voice Cloning Attacks
Protected (AntiFake)
Purified (WavePurifier)
Purified (AudioPure)
Purified
Clean
(Ours)
Voice Cloning Input
TIS Synthesized (SVITTS)
Voice Conversion Synthesized (Open Voice)
Figure 13. Visualization of voice cloning inputs and corresponding synthesized speech. The first row displays the speech samples as voice cloning input, while the second and third show the corresponding synthesized speech using different voice cloning models. Our method retains more details in the purified samples, thereby enhancing the VC model's ability to replicate the speaker's characteristics.
rification methods. As these methods are primarily designed for image classification tasks and face challenges such as in- creased memory usage due to the high resolution of speech data (e.g., 96k data points for 6s audio at 16kHz vs. for image in CIFAR-IO), they cannot be directly applied to construet more robust protective perturbations against voice cloning attacks. However, by processing long audio in chunks to reduce memory overhead, or by using accelerated sampling methods as surrogates to reduce computational graph depth, their core mechanisms could potentially adapted for speech tasks, enabling the construction adap- tive protection methods robust against our purification.
in experiments, there are still some limitations. For in- stance, our method employs fixed Purification and Refine- ment timestep in all experiments. However, some studies have shown that there exists an optimal timestep when diffu- sion models are used for adversarial purification (Guo et al., 2024; Nie et al., 2022). Therefore, fixed timestep may limit the effectiveness of our method. Future work could explore the use of adaptive timestep selection strategies to improve purification effectiivensss.
Additionally, our method does not utilize information from the VC model, which means that our method does not de- pend on specific VC model and attacker's knowledge about it. However, this design leaves room for improvement: attackers with access to the VC model and expertise in it could exploit this information to increase the success rate of their attacks. For example, attackers could adversarially fine-tune the purification model using adversarial samples targeting their VC model to enhance its ability to purify adversarial perturbations. Future work could investigate how leverage information from the VC model to improve purification effectiveness and thereby increase the success rate of VC attacks. Furthermore, although we have explored the use of specific backbone as the Purification and Re- finement model this paper, our Purification- -eeeiinmeeRi framework could benefit from more advanced Purification and Refinement models.
Future Work Protection Methods. Our experimental results indicate that existing perturhation-base VC defenses are vulnerable when adversarial purification is present in the attack pipeline. Future work could explore more robust pro- tective perturbation strategies, such as integrating distortion layers composed of different types of distortions into the perturbation generation pipeline to enhance their robustness against adversarial purification. Additionally, adding pro- tective perturbations at more advanced speech feature levels may also enhance the robustness of protective perturbations.
Discussion of Our Purification Method. Although our purification method has outperformed existing methods
19


Reviews:
[{"review_id": "CgdIk3LumY", "reviewer": "Reviewer_JTkR", "summary": "The paper \"De-AntiFake\" systematically evaluates current voice cloning defense mechanisms that use protective perturbations, revealing their vulnerability to adversarial purification techniques. To demonstrate this vulnerability, the authors propose a novel two-stage purification method called PhonePuRe that combines unconditional diffusion with phoneme-guided refinement to effectively bypass these protections. Through extensive experiments across six voice cloning methods and three protection techniques, they show their method significantly outperforms existing purification approaches, achieving higher speaker verification accuracy and better perceptual similarity even against adaptive protections.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for the insightful and valuable comments. We respond to each comment as follows and sincerely hope that our rebuttal could properly address your concerns.\n# Weaknesses\n>W1. More discussion about practical limitations.\n\nOur implementation utilized an RTX A6000 GPU and Xeon Gold 6130 @2.1GHz CPU. The peak computational resource usage is detailed below:\n||GPU RAM|CPU RAM|GPU Usage|CPU Usage\n-|-|-|-|-\nTrain|25.7G|6.0G|100%|433%\nInference|9.2G|5.2G|100%|124%\n\nThese requirements indicate that executing our attack is **not feasible on lightweight devices, and requires moderate computational resources** as illustrated in our threat model (Sec. 3).\n>W2. **(& Theoretical Claims)** Consider developing theory for better understanding of proposed method's interpretability and limitations.\n\nThank you for your insightful suggestion. According to the proof in [1], as the forward diffusion time $t$ increases, the KL divergence between the clean distribution $p_t$ and the adversarial distribution $q_t$ is monotonically decreasing, meaning the clean and the adversarial distribution become closer. This provides theoretical support for our Purification stage to effectively mitigate adversarial noise. Building upon this, developing a systematic theory specific to our 2-stage method will lead to a better understanding of our method's limitations and interpretability. However, due to time/space limitations, we can only explore this issue in future work.\n>W3. **(& Question 6)** Do you think there is a fundamental limitation to protective perturbations?\n\nThough our method shows limitations in existing VC defenses, we did not 100% success in bypassing the protections, indicating that current defenses still offer some level of protection. Furthermore, as is common in all areas of information security research, defenders will likely develop countermeasures against our purification. Therefore, we believe **it is premature to assert a fundamental limitation of existing protections, and the arms race between attack and defense will likely continue.**\n>W4. Define dSVA and xSVA with math formulation.\n\nWe will add definitions for SVA like follows: $dSVA = \\frac{1}{N} \\sum_{i=1}^{N} SV_d(x_{test}^i, x_{clean}^i)$.\n\n# Questions\n>Q1. Cross-lingual performance of the Refinement stage.\n\nWe show the results of a small-batch inference on Russian LibriSpeech (non-Latin script) below. Our Refinement stage **remains effective** outside the training data (English).\n| |Protected|w/o Refinement|Full Model\n-|-|-|-\ndSVA|0.21|0.93|0.98\n>Q2. Future directions for robust VC defenses.\n\nWe think embedding protective perturbations in higher-level semantic features for robustness appears promising. Combining perturbations with other defenses like proactive watermarking for a multi-layered defense is another promising direction.\n>Q3. Optimizations for computational overhead.\n\nOur paper focuses on revealing existing defense vulnerabilities, and we believe the current time cost (second-level) is acceptable for offline attacks. Your question is constructive, due to time, we will strive to optimize in future work to enhance real-world efficiency.\n>Q4. Effectiveness for few/many-shot VC attacks.\n\nAlthough existing VC defenses [2-4] don't consider few/many-shot scenarios, we run a small-batch VC attack where attacker have 5 reference audio and find our method **remains effective**:\n| |Protected|AudioPure|Ours\n-|-|-|-\ndSVA|0.03|0.17|**0.82**\n\n>Q5. Reasons and potential solutions for gender disparity.\n\nFigure in anonymous link https://github.com/de-antifake/1/blob/main/1.png show protective perturbations mainly affect higher frequencies where female voices have more energy. We infer **the frequency overlap makes separating perturbations from female voice characteristics harder** during purification, explaining the disparity. Potential solutions include hierarchical purification: use different purification steps for high/low frequencies could mitigate this.\n\n# Other Comments Or Suggestions\n> Explore trade-offs between attack success and audio quality.\n\nWe **do not observe a clear trade-off** between audio quality and attack success. We use PESQ to evaluate the audio quality of the purified audio using a small batch of data:\nPurification Steps|1|2|3|4|5\n-|-|-|-|-|-\nPESQ|1.56|1.81|**1.88**|1.87|1.81\ndSVA|0.87|0.94|**0.96**|0.92|0.90\n\nAs purification steps increases, both PESQ and dSVA initially improve and then decline, reaching their optimal values at the same step. This suggests that the protective noises degrades both audio quality and attack success, and proper number of purification steps improves both.\n\n[1] Diffusion Models for Adversarial Purification. ICML22.\n\n[2] AntiFake: Using Adversarial Audio to Prevent Unauthorized Speech Synthesis. CCS23. \n\n[3] Defending Your Voice: Adversarial Attack on Voice Conversion. SLT21. \n\n[4] Voice Guard: Protecting Voice Privacy with Strong and Imperceptible Adversarial Perturbation in the Time Domain. IJCAI23.", "claims_and_evidence": "The claims are generally well-supported with comprehensive experimental evidence. The authors thoroughly evaluate three protection methods (AntiFake, AttackVC, VoiceGuard) against six VC models, showing convincingly that their method achieves higher speaker verification accuracy.", "methods_and_evaluation_criteria": "The methods and evaluation criteria are appropriate for the problem. The speaker verification accuracy (SVA) metrics (xSVA and dSVA) are standard and appropriate measures for evaluating the effectiveness of voice cloning and protection bypassing. The objective MOS score and human evaluation of perceived speaker similarity provide complementary evidence for perceptual assessment.", "theoretical_claims": "The author should consider developing theory for why their proposed is able to perform effective VC against various protection. E.g. certain transformation/diffusion computation can mitigate the bounded adversarial noise. It would be helpful to know to what extent (protective setup) we can view this 2-stage procedure as effective. The condition could be sth like the signal is not degraded too much from the transformation", "experimental_designs_or_analyses": "The experimental design is sound:\n\nThe evaluation dataset is appropriate and of sufficient size. The comparison with five existing adversarial purification methods is comprehensive. And the discussion of adaptive defense protection is very helpful.", "relation_to_broader_scientific_literature": "I think this work points a good direction for the community where people focused on the protective perturbations.\nNot aware.", "essential_references_not_discussed": "Not aware.", "other_strengths_and_weaknesses": "- Ablation study like the discussion of adaptive protection is very well-conducted.\n\nWeaknesses:\n\n- The paper could benefit from more discussion about the practical limitations of their attack (e.g., computational requirements for real-world deployment)\n- The author should consider include some theoretical discussion which can give a better understanding on the limitations of this methods. \n- The paper could explore more deeply whether there are fundamental limitations to protective perturbation approaches given the effectiveness of their purification method\n- The author should define dSVA and xSVA with explicit math formulation.", "other_comments_or_suggestions": "- Explore Trade-offs Between Attack Success and Audio Quality: Consider a more detailed analysis of the trade-offs between successful bypassing of protections and the resulting audio quality.", "questions_for_authors": "- How does your PhonePuRe method perform when dealing with speech in different languages outside of the training data? Since phoneme representations are language-dependent, would your refinement stage maintain its effectiveness for languages with significantly different phonetic structures?\n- The paper demonstrates the vulnerability of current protective perturbation methods, but what do you believe are the most promising directions for creating more robust voice cloning defenses that could withstand purification attacks like yours?\n- Your time cost analysis in Appendix C.5 shows that PhonePuRe requires more computational resources than some existing methods. Have you explored potential optimizations that could reduce this overhead while maintaining similar performance?\n- Your experiments focus on zero-shot voice cloning models. Would your conclusions and the effectiveness of your method change when considering few-shot or many-shot voice cloning attacks where attackers have access to more reference audio?\n- The paper mentions that your method performs better for male speakers than female speakers. Could you elaborate on the underlying technical reasons for this gender disparity and potential approaches to address it?\n- Given that your method significantly reduces the effectiveness of current protective perturbations, do you think there is a fundamental limitation to adversarial perturbation-based defenses against voice cloning, or is this an arms race that will continue to evolve?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "TlJZrX2IWK", "reviewer": "Reviewer_VwKh", "summary": "Some works claim that an individual can protect their audio samples from voice cloning via perturbations that induce odd behavior from the voice cloning model (generative), or from voice classification models (discriminative). Another set of works show that these defensive perturbations can be removed at least for classification models, effectively removing the defensive capabilities. But the authors contend that these methods also remove natural features and thereby induce a distribution shift from the original audio. This is apparently fine for discriminative models that don't need all the features, but not for generative models which do. So the voice cloning no longer works. The authors thus propose an additional phenome-based refining step, that essentially maps from the shifted distribution back to the original distribution.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for the insightful and valuable comments. We respond to each comment as follows and sincerely hope that our rebuttal could properly address your concerns.\n# Claims And Evidence\n>Concern about subjective 'human' notation (H). Embedding proxy may not reflect human perception. Suggest adding author evaluation.\n\n- We follow [1] using similar notation $H$. We will make this clearer in the paper: $H(\\cdot)$ represents the *perceived speaker identity* evaluated by human listeners with given audio.\n- To clarify, (clean, protected, purified) speech is the *reference speech* (VC model input). *Synthesized speech* is the VC model output, potentially used to deceive humans/SV models. We used the VC model's embedding as a proxy evaluation for 'purified speech' as it's the VC model's input; our goal is reduced distortion for the cloning model in 'purified speech' to facilitate successful voice cloning (deceiving SV models/humans). Humans don't evaluate 'purified speech'. However, synthesized speech (VC model output from source speech) may deceive humans.\n- Therefore, we have a subjective test (Sec. 5.2) with 20 humans evaluating *synthesized speech* from (clean, protected, purified) inputs, aligning with our threat model's $H$. For the purified speech, we don't involve human evaluation in the threat model (Sec. 3), so we think it is enough to use VC model embedding as proxy evaluation.\n# Methods And Evaluation Criteria\n>Fig. 2 unclear on reduced inter-class separability. Show embeddings after step 1 and full 2-steps for comparison.\n- We add some arrows pointing from clean to purified samples within Fig. 2(b-c) of anonymous link https://github.com/de-antifake/1/blob/main/2.png to better convey the reduced inter-class separability.\n- Fig. 2(c) already shows the embedding results after applying only step 1 (our method uses DiffWave for Purification stage, which is consistent with AudioPure), while Fig. 2(d) shows the results of applying the complete 2-step method.\n# Experimental Designs Or Analyses\n>Discuss adaptive attack against purification like DiffAttack in the audio domain.\n- We actively experimented with DiffAttack's core mechanisms (deviated-reconstruction loss and segment-wise forwarding-backwarding) following public code on an RTX A6000 (48GB VRAM). However, audio data's high resolution (e.g., 96k data points for 6s audio at 16kHz vs. 1k for DiffAttack's CIFAR-10) caused out-of-memory issues for DiffAttack on our task.\n- Possible solutions include using a lower-resolution diffusion model as surrogate, or processing long audio in chunks to reduce memory overhead. Furthermore, using accelerated sampling methods as surrogate to reduce computational graph depth might also help. Overall, running something like DiffAttack in the audio domain is challenging for defenders due to the high cost of calculating diffusion model gradients. Due to time, we didn't do further experiments, but future work can explore these adaptive defense methods. We will add this discussion to Sec. 5.4 or App. D in the revised paper.\n# Weaknesses/Questions\n>W1. & W2. There is an assumption: diffusion-based removal leads to similar distributions for clean & protected audio in the paper, which allows training refinement on (clean, purified(clean)) and applying to purified(protected). This non-intuitive observation should be mentioned in the paper.\n\nWe show embedding distributions of Clean vs Protected, and Purified(Clean) vs Purified(Protected) Speech in anonymous link https://github.com/de-antifake/1/blob/main/3.png. We observed that diffusion-based perturbation removal brings clean and protected audio to similar distributions, which is a key assumption for our method's effectiveness. Thus, we don't need to generate adversarial data for training. We will mention this observation in the revised paper to clarify the Refinement stage's motivation.\n# Other Comments or Suggestions\n>Explain voice cloning model inference in the text.\n\nWe apologize for not providing a clear explanation of how VC models work. Our work considers two main types of voice cloning: Text-to-Speech (TTS) and voice conversion. Both leverage speaker embeddings extracted from the victim's audio to capture their voice characteristics.\n- For TTS-based voice cloning, the attacker provides arbitrary text. The TTS acoustic model, conditioned on the victim's speaker embeddings, takes this text and generates corresponding acoustic features (e.g., mel-spectrograms). These acoustic features are then used by the vocoder to synthesize the cloned voice.\n- For voice conversion, the model typically takes the acoustic features of an arbitrary speaker's utterance provided by attacker (representing the content) and transforms them using the victim's speaker embeddings to generate speech with the victim's voice.\n\nWe will provide a detailed explanation of these mechanisms in the revised paper.\n\n[1] Antifake: Using adversarial audio to prevent unauthorized speech synthesis. CCS23.", "claims_and_evidence": "- One should be careful about using the \"human\" notation of H. This is very hard to define. My human is different from yours. You eventually try some proxy evaluation using the embeddings to show reduced distortion using your method. But this doesn't necessarily imply reduced distortion to a human. A somewhat silly example would be me finding point using PGD in the embedding space that is within some ball of the clean audio, but when has no meaning when mapped back to the input space. I'm not sure how exactly you can change this. Simply adding some author evaluation would be fine I think.", "methods_and_evaluation_criteria": "- Quite honestly Figure 2 does not easily communicate that there is reduced inter-class separability after applying diffusion-based-perturbation-removal. The points are too small, and there are too many speakers, i.e., colors. Can you also show that embedding results after applying only step 1 of your method? That should align with (b) and (c), and would communicate that you're doing +1 step on top of them.", "theoretical_claims": "NA", "experimental_designs_or_analyses": "- I am not convinced entirely by your adaptive protection discussion. I can preface this by saying I am not asking for more experiments, or that you are even mandated to explore these routes given the scope limits enforced by the page limits of an ML venue paper. But, you should discuss the adaptive attack works that have been effective against adversarial purification like DiffAttack (https://proceedings.neurips.cc/paper_files/paper/2023/file/ea0b28cbbd0cbc45ec4ac38e92da9cb2-Paper-Conference.pdf). Sure, it is the audio domain. But what would a defender need to do to run something like DiffAttack here, and make their perturbations survive? It seems rather intuitive to me that BPDA+EoT wouldn't work that well here since the papers you cite evaluated them and were also \"robust\" to them. Again, the onus is on the defenders here to make a better defense, but improved discussion would improve your paper.", "relation_to_broader_scientific_literature": "The paper falls in line with attacks against perturbation-based training disruption defenses in other domains like face recognition and style transfer.", "essential_references_not_discussed": "NA", "other_strengths_and_weaknesses": "- Strengths:\n    - The community is moving towards a consensus that protective perturbations do not work for the image domain, a la glaze. It is nice to show this for audio.\n    - First to evaluate for cloning, which honestly is the more realistic threat, at least when compared to discriminative applications.\n\n- Weaknesses/questions:\n    - I think there is some assumption here (that likely holds true since your experiments work) that the two audio distributions induced by applying diffusion-based-perturbation-removal (your first step) to clean and defensively-perturbed audio are nearly the same. So, that would be why you can train your refinement model that maps back to the original distribution using some pairs from - (clean sample, diffusion-based-perturbation-removal(clean sample)). And then you can apply this at inference time to some diffusion-based-perturbation-removal(defensively-perturbed point), and expect to obtain a clean sample. \t\n  - It's not very intuitive to me that the diffusion-based-perturbation-removal always outputs the same or \tnearly same audio distribution regardless of the input distribution being clean or adversarial. That in and of itself is an observation, so i think you should mention this at least somewhere. If it were not true you would need to run these attacks to generate training data for refinement, and that seems more likely to fail to generalize to unseen attacks.", "other_comments_or_suggestions": "- Can you please explain in the text how voice-cloning models work? At least the inference? Figure 1 is not explicit enough. I understand you use audio embeddings from the victim, and I am guessing you take text embeddings from the adversary? Or is that also audio embeddings? I suppose it's not critical to the paper but it's rather unfortunate that I went through the entirety of this paper and still don't have the remotest idea how voice cloning works.", "questions_for_authors": "NA", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "g5FABFgkR3", "reviewer": "Reviewer_JFuf", "summary": "The paper evaluates limitations of existing purification methods in countering adversarial perturbations designed to block unauthorized voice cloning (VC), revealing they cause feature distortions that degrade VC performance. A novel two-stage purification method is proposed, combining perturbation removal with phoneme-guided refinement to align purified speech with clean speech distribution. Experiments demonstrate this approach outperforms state-of-the-art methods in disrupting VC defenses, highlighting vulnerabilities in current adversarial perturbation-based security strategies.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for the insightful and valuable comments. We respond to each comment as follows and sincerely hope that our rebuttal could properly address your concerns.\n# Weaknesses\n>W1. The purification method employed is relatively outdated, specifically an unconditional DiffWave model. Could the proposed method be generalized to other audio diffusion models?\n\nRecent audio diffusion models are often designed for specific tasks such as conditional generation or speech enhancement, and therefore, the majority of them are conditional models. We experimented with applying newer conditional models [1, 2] to our current task, and the table below shows the dSVA after applying only the Purification stage with different models:\n| Purification Model | dSVA |\n| --- | --- | \n| Uncond. DiffWave | 0.647 |\n| SGMSE [1] | 0.638 |\n| DMSE [2] | 0.598 |\n\nWe find that their performance was generally not as good as unconditional DiffWave. We infer that **an unconditional model is more suitable as our Purification model**, possibly because it lacks conditional constraints and might be more robust to unseen noise.\n\nDespite this, we attempted to apply another audio diffusion model to our task, specifically the one from [2], to investigate the potential of our method to generalize to other diffusion models. The resulting dSVA values are presented in the following table. The results indicate that when using another audio diffusion model as the Purification model, our Refinement stage also improved performance. This suggests that **our method has the potential to generalize to other audio diffusion models.**\n| Purification Model | dSVA (Purification Stage Only) | dSVA (Full Model) |\n| --- | --- | --- |\n| DMSE [2] | 0.598 | 0.622 |\n\n>W2. It is suggested that the authors consider adopting some diffusion model acceleration sampling techniques or flow-matching models to further improve the speed of purification. Additionally, I am curious about the respective time costs of the purification stage and the refinement stage. Please list them.\n\n- We list the processing time per second of audio for the Purification and Refinement stages separately in the table below. The results indicate that the Refinement stage takes up the majority of the processing time.\n| | Purification Stage | Refinement Stage (N=15) | Refinement Stage (N=30) |\n|----|----|----|----|\n| Time Cost (s) | 0.152 | 0.715 | 1.253 |\n- Your suggestion regarding acceleration is very constructive. We agree that acceleration sampling or flow-matching models could be helpful for real-world efficiency. Due to time constraints, we will explore potential accelerated sampling techniques or more efficient models in our future work to enhance the  practicality of our method for real-world applications and advance the field.\n\n>W3. In Section 4.2, the sampling process of the diffusion model is not clearly articulated. It is recommended that the authors replace Equation 5 with an iterative sampling formula (such as DDPM or DDIM).\n\nWe will clarify the sampling process in Section 4.2, including replacing Equation 5 with the following iterative sampling formula:\n\n$x_{t-1} \\sim p_{\\theta}(x_{t-1} | x_t) = N(x_{t-1}; \\mu_{\\theta}(x_t, t), \\sigma_t^2 {I}), t = T_\\text{pur}, T_\\text{pur}-1, ..., 1$\n\nwhere $x_0 = x_\\text{pur}$.\n\n[1] Richter J, et al. Speech enhancement and dereverberation with diffusion-based generative models. IEEE/ACM Transactions on Audio, Speech, and Language Processing (TASLP), 2023.\n\n[2] Tian Y, Liu W, Lee T. Diffusion-Based Mel-Spectrogram Enhancement for Personalized Speech Synthesis with Found Data. IEEE Automatic Speech Recognition and Understanding Workshop (ASRU), 2023.", "claims_and_evidence": "The paper's claims are appropriate and well-supported. The authors claim that they are the first to explore vulnerabilities of protective VC (voice cloning) defenses, which is accurate and justified, as demonstrated through comprehensive experiments validating the proposed method's superiority. The substantial experimental evidence effectively reinforces the validity of their claims.", "methods_and_evaluation_criteria": "The method presented in this paper demonstrates important innovation, proposing a novel two-stage purification-refinement architecture. Additionally, the use of evaluation metrics such as xSVA, dSVA, and Mean Opinion Score (MOS) is well-justified and contextually appropriate for assessing the framework's effectiveness.", "theoretical_claims": "The paper elaborates on the purification process in detail via Equations (3)-(5).", "experimental_designs_or_analyses": "The experimental and analyses of this paper are sound and valid. It compares with many adversarial purification baselines and analyzes the results on many tables and visualization figures.", "relation_to_broader_scientific_literature": "None", "essential_references_not_discussed": "None", "other_strengths_and_weaknesses": "**Strength**\n\n1. The writing of this paper is smooth and well-organized. The task scenario is clearly defined through the threat model and Figure 1, while the method is introduced in a general-to-specific manner, providing a logical and easy-to-follow structure. Additionally, the related works are presented in a clear and concise way.\n\n2. The experiments are extensive and comprehensive, involving a wide range of voice cloning and protection methods. The comparison methods include most SOTA purification methods. Additionally, detailed ablation studies are provided to thoroughly analyze the impact of different components and parameters, further enhancing the robustness and credibility of the research.\n\n**Weakness**\n\n1. The purification method employed is relatively outdated, specifically an unconditional DiffWave model. Could the proposed method be generalized to other audio diffusion models?\n\n2. Although the time complexity presented in Table 8 is acceptable, it is suggested that the authors consider adopting some diffusion model acceleration sampling techniques or flow-matching models to further improve the speed of purification. Additionally, I am curious about the respective time costs of the purification stage and the refinement stage. Please list them.\n\n3. In Section 4.2, the sampling process of the diffusion model is not clearly articulated. It is recommended that the authors replace Equation 5 with an iterative sampling formula (such as DDPM or DDIM).", "other_comments_or_suggestions": "Please refer to the weakness.", "questions_for_authors": "None", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "KYVMTbxhjj", "reviewer": "Reviewer_uK8k", "summary": "This paper investigates the vulnerabilities of protective perturbation-based voice clone (VC) defenses, demonstrating that these defenses are susceptible to existing adversarial purification techniques. Additionally, the authors propose an enhanced two-stage adversarial purification method that mitigates embedding inconsistencies caused by current methods, thereby further exposing the weaknesses of these VC defenses. Even with full access to the gradient information of their purification model, the study underscores the urgent need for more advanced techniques to prevent unauthorized data usage in VC. Both objective and subjective evaluations confirm the superior performance of their purification method.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for the insightful and valuable comments. We respond to each comment as follows and sincerely hope that our rebuttal could properly address your concerns.\n# Weaknesses\n>W1. The process of purification, specifically unconditional diffusion, requires further explanation. For instance, Equations (3) and (4) should explicitly include $x_\\text{adv}$.\n\nIn Equations (3) and (4), $x_t$ refers to audio sample at time $t$, $x_\\text{adv}$ refers to adversarial audio sample, and $t$ ranges from $1$ to $T_\\text{pur}$. The foward process starts with $x_{0}$ ($x_\\text{adv}$) and generates noisy sample $x_{T_\\text{pur}}$; the reverse process starts with $x_{T_\\text{pur}}$ and generates $x_{0}$ ($x_{\\text{pur}}$). We will clarify these terms in Section 4.2 as follows:\n- (**Revision**) At each timestep $t$, the process is expressed as:\n$q(x_t | x_{t-1}) = \\mathcal{N}(x_t; \\sqrt{1-\\beta_t} x_{t-1}, \\beta_t \\mathbf{I}), t = T_\\text{pur}, T_\\text{pur}-1, ..., 1$\nwhere $\\beta_t$ denotes the variance schedule, and $x_0 = x_\\text{adv}$.\n- The reverse process denoises the waveform $x_{T_\\text{pur}}$ in the same $T_\\text{pur}$ steps, and at each step, it is formulated as:\n$p_{\\theta}(x_{t-1} | x_t) = \\mathcal{N}(x_{t-1}; \\mu_\\theta(x_t, t), \\sigma_t^2 \\mathbf{I}),$\nwhere $\\mu_\\theta(x_t, t)$ is the mean function parameterized by $\\theta$, $\\sigma_t^2$ is the time-dependent variance schedule, and $x_0 = x_\\text{pur}$.\n\n>W2. The training details are insufficiently clear. For example, the statement \"The Purification model is a pretrained unconditional DiffWave model\" contrasts with the context, which states, \"Our method trains two models separately.\" The authors should clarify the detailed settings.\n\nThank you for pointing out this ambiguity. We will clarify the description, avoiding the term \"pretrained\" to describe a model fine-tuned on a specific dataset as follows:\n\n- (**Revision**) The Purification model is **based on** a pretrained unconditional DiffWave model which is **then fine-tuned** on the LibriSpeech dataset.\n\n>W3. In Figure 11, the authors note that \"Existing purification methods tend to produce samples with similar patterns and blurred details,\" but the similar patterns are difficult to discern. This section also requires further clarification.\n\nWe apologize for not clearly explaining \"the similar patterns.\" This was because the pattern is not evident from the small number of examples provided. We will address this by adding more examples in Figure 11 to clarify these patterns.\n\n# Other Comments or Suggestions\n>C1. The description of the summarized contributions could be refined, for example, by directly highlighting the specific risks identified.\n\nWe will refine the descriptions of our contributions in the introduction by directly highlighting the specific risks identified. Details are as follows:\n\n- (**Revision**) We assess six VC methods and three protective techniques, revealing **the risk that existing defenses potentially fail to prevent voice cloning attacks**.\n\n>C2. Typos: In the caption of Figure 2, \"(b-c), Purified\" should be corrected to \"(b-c), purified.\"\n\nThank you for pointing out this typo. We will correct it in our revised paper.", "claims_and_evidence": "The claims made in this paper are verified by experimental results, which include both objective and subjective evaluations.", "methods_and_evaluation_criteria": "The issue highlighted in this paper is important. The systematic evaluation of protective perturbation-based VC defenses serves as a warning to the community that such perturbations can be mitigated by adversarial purification methods. The proposed two-stage adversarial purification method further emphasizes these risks. Experimental results support their claim.", "theoretical_claims": "The problem addressed in this paper is practical, and there are no theoretical claims made.", "experimental_designs_or_analyses": "- The selected voice cloning method, protection methods, and adversarial purification baselines are based on recent work.\n- The experimental designs in this paper are comprehensive, including both objective and subjective evaluations.", "relation_to_broader_scientific_literature": "- Voice Clone Attacks\n- Adversarial Examples\n- Adversarial Purfication Methods", "essential_references_not_discussed": "To my knowledge, important references are included in this paper.", "other_strengths_and_weaknesses": "Strength:\n1. The problem addressed in this paper is meaningful for society.\n2. The motivation behind the two-stage purification method is well articulated.\n3. The experiments are comprehensive, and the effectiveness of different components in their method is validated through an ablation study.\n4. The threat model is well considered, including adaptive attacks, and the experimental results demonstrate that their purification method is difficult to mitigate even in a white-box scenario.\n\nWeaknesses:\n\n1. The process of purification, specifically unconditional diffusion, requires further explanation. For instance, Equations (3) and (4) should explicitly include X_{adv}\n2. The training details are insufficiently clear. For example, the statement \"The Purification model is a pretrained unconditional DiffWave model\" contrasts with the context, which states, \"Our method trains two models separately.\" The authors should clarify the detailed settings.\n3. In Figure 11, the authors note that \"Existing purification methods tend to produce samples with similar patterns and blurred details,\" but the similar patterns are difficult to discern. This section also requires further clarification.", "other_comments_or_suggestions": "1. The description of the summarized contributions could be refined, for example, by directly highlighting the specific risks identified.\n2. Typos: In the caption of Figure 2, \"(b-c), Purified\" should be corrected to \"(b-c), purified.\"", "questions_for_authors": "Refer to Weakness.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "ilH0eAid6a", "reviewer": "Reviewer_bzRG", "summary": "The paper investigates the effectiveness of adversarial perturbations as a defense against voice cloning (VC) under threat models that specifically considering perturbation purification techniques used by attackers. The study finds that while existing purification methods can reduce the impact of protective perturbations, they still cause distortions in the feature space of VC models, leading to a decline in voice cloning performance. Therefore, the paper proposes a novel two-stage purification method that first purifies the perturbed speech and then refines it using phoneme guidance to better align it with clean speech. The experimental results demonstrate that this new method outperforms existing purification techniques in disrupting voice cloning defenses. Ablation experiments validate the effectiveness of each component. Adaptive protection experiments demonstrate that the proposed method exhibits a degree of robustness.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for the insightful and valuable comments. We respond to each comment as follows and sincerely hope that our rebuttal could properly address your concerns.\n# Weaknesses\n>W1. The proposed method increases time cost due to the introduction of the Refinement stage.\n\nWe agree that the Refinement stage increases computational time compared to single-stage purification. However, voice cloning attacks are fundamentally offline processes. Attackers typically have **hours/days** to prepare critical audio samples (e.g., CEO's voice for fraud), making increased computation, which is **seconds-level** as shown in Table 8 still acceptable for these scenarios. For instance, an audio sample of 15 seconds only needs 13 seconds for our method to process.\n>W2. The terms \"force alignment\" and \"force aligner\" may require clarification.\n\n- The Force Aligner mentioned in our paper refers to the Montreal Forced Aligner (https://github.com/MontrealCorpusTools/Montreal-Forced-Aligner), which is a **tool** used for aligning text with audio. Specifically, it works by first converting the text into a sequence of phonemes. Then, using a pre-trained speech recognition model, it aligns the start and end times of each phoneme to precise timestamps within the corresponding audio.\n\n- Force alignment, on the other hand, refers to the **process** of performing this audio and text alignment using the Montreal Forced Aligner.\n\nTo prevent any confusion, we will provide explicit definitions for both \"force aligner\" and \"force alignment\" in Section 4.3 of the revised paper.\n# Questions (& Weakness 3)\n>Q1. Please analyze why DiffSpec and DualPure perform unexpectedly worse than DiffWave and WavePurifier in your task compared to other purification tasks.\n\nThe relatively poorer performance of DiffSpec [2] and DualPure [4] can be attributed to their mel-spectrogram processing parameters. These methods operate on **spectrograms with 32 mel-bins**, which were initially designed for classification tasks. While 32 mel bins are sufficient for classification (for the classification models are trained on inputs of the same dimensionality), reconstructing waveforms from such a low-resolution spectrogram can lead to significant distortion.\n\nHowever, existing voice cloning models [7, 8] typically utilize **mel-spectrograms with 80 mel bins or more** as input, relying on high-fidelity spectral features. In contrast, WavePurifier [3] employs a higher resolution (256x256) spectral representation, which preserves the essential details for voice cloning, thereby performing significantly better than DiffSpec [2] and DualPure [4] in our experiments. DiffWave, operating directly in the waveform domain, avoids this type of distortion, similarly leading to better results.\n\nWe will include this analysis in Section 5.2 or the Appendix of the revised paper.\n>Q2. Omitted comparisons with the \"Filter Power\" and \"LPC\" methods.\n\nFilter Power and LPC from [1] were omitted in our initial experiments due to: \n- Filter Power functionality overlaps with BPF in [5] (both are band pass filter methods),  \n- LPC functionality overlaps with MP3 in [5] (both are compression methods). \n\nWe acknowledge the importance of direct comparison and conducted new experiments. As shown below, **both methods underperform our proposed approach** (results to be added to Table 5):\n\nMethod|xSVA|dSVA\n-|-|-\nFilter Power| 0.222|0.133\nLPC|0.121|0.026\nOurs|0.711|0.818\n\n>Q3. The \"Parameter Value\" for Downsampling (1600Hz) needs explaination.\n\nThe \"1600Hz\" entry in Table 4 is a typo. The correct downsampling rate is **8000Hz**, aligning with common practices in prior voice cloning defenses and adversarial purification [2, 5, 6]. For completeness, we also evaluated [1]'s default parameter (6000Hz), achieving:\n\nMethod|Downsampling rate|xSVA|dSVA\n-|-|-|-\nDown-Up Sampling|6000Hz|0.204|0.140\nDown-Up Sampling|8000Hz|0.168|0.139\nOurs|N/A|0.711|0.818\n\n**both of them underperform our proposed approach**. We will correct this typo in Table 4.\n# Other Comments or Suggestions\n>Open-sourcing the code would greatly enhance the reproducibility of this work and facilitate further research in this area.\n\nYes, we will make our code publicly available once our paper is accepted.\n\n[1] WaveGuard: Understanding and Mitigating Audio Adversarial Examples. USENIX21. \n\n[2] Defending against adversarial audio via diffusion model. ICLR23.\n\n[3] WavePurifier: purifying audio adversarial examples via hierarchical diffusion models. MobiCom24.\n\n[4] DualPure: An Efficient Adversarial Purification Method for Speech Command Recognition. Interspeech24.\n\n[5] Towards Understanding and Mitigating Audio  Adversarial Examples for Speaker Recognition. TDSC22.\n\n[6] AntiFake: Using adversarial audio to prevent unauthorized speech synthesis. CCS23.\n\n[7] Yourtts: Towards zero-shot multi-speaker tts and zero-shot voice conversion for everyone. ICML22.\n\n[8] Better speech synthesis through scaling. arXiv preprint 23.", "claims_and_evidence": "The main claims of the paper include: (1) existing adversarial perturbations as a defense against voice cloning are vulnerable to existing adversarial purification; (2) the proposed new purification method outperforms existing methods in disrupting voice cloning defenses. Claims (1) and (2) are supported by subjective and objective experiments in Section 5.2, and the ablation study in Section 5.3 verifies the effectiveness of each component of the method in claim (2). In summary, the main claims of the paper are supported by clear and convincing evidence.", "methods_and_evaluation_criteria": "The proposed methods are make sense for addressing the problem.  The evaluation criteria, including the chosen metrics and baselines (defense methods and purification baselines), are in line with established practices and influential prior work in the field, making the evaluation robust and relevant.", "theoretical_claims": "This paper is primarily focused on empirical evaluation and algorithmic innovation in the domain of voice cloning defense.  It does not present formal theoretical claims or mathematical proofs in the traditional sense. Therefore, there were no proofs to check for correctness, and consequently, there are no issues related to proof validity to discuss.", "experimental_designs_or_analyses": "The experimental designs were checked for soundness and validity. Specifically, the designs in Sections 5.2 (main results), 5.3 (ablation study), and 5.4 (adaptive protection experiments) were checked. The designs are appropriate for testing the paper's claims, employing suitable datasets, metrics, and comparisons to relevant baselines.  No issues were found regarding the soundness or validity of the experimental designs or analyses.", "relation_to_broader_scientific_literature": "The paper relates to the broader literature of using adversarial perturbations for voice cloning defense, as seen in works like [1-3].  The key contribution is in empirically investigating the impact of adversarial purification on these defenses in the voice cloning domain, providing valuable practical insights. While the proposed two-stage purification method combines existing techniques such as [4-6], the proposed method represents a useful improvement. The paper contributes to the field by providing a more nuanced understanding of the interplay between adversarial perturbations and purification in voice cloning, and suggests a direction for enhancing purification methods in this specific context.\n\n[1] Yu, Z., Zhai, S., and Zhang, N. AntiFake: Using Adversarial Audio to Prevent Unauthorized Speech Synthesis. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, pp. 460-474, Copenhagen Denmark, November 2023.\n[2] Huang, C.-y., Lin, Y. Y., Lee, H.-y., and Lee, L.-s. Defending Your Voice: Adversarial Attack on Voice Conversion. In 2021 IEEE Spoken Language Technology Workshop (SLT), pp. 552-559, Shenzhen, China, January 2021.\n[3] Li, J., Ye, D., Tang, L., Chen, C., and Hu, S. Voice Guard: Protecting Voice Privacy with Strong and Imperceptible Adversarial Perturbation in the Time Domain. In Proceedings of the Thirty-Second International Joint Conference on Artificial Intelligence, pp. 4812-4820, Macau, SAR China, August 2023b. \n[4] Wu, S., Wang, J., Ping, W., Nie, W., and Xiao, C. Defending against adversarial audio via diffusion model. In The Eleventh International Conference on Learning Representations, 2023.\n[5] Song, Y., Sohl-Dickstein, J., Kingma, D. P., Kumar, A., Ermon, S., and Poole, B. Score-based generative modeling through stochastic differential equations. In International Conference on Learning Representations, 2021.\n[6] Tian, Y., Liu, W., and Lee, T. Diffusion-Based Mel-Spectrogram Enhancement for Personalized Speech Synthesis with Found Data. In 2023 IEEE Automatic Speech Recognition and Understanding Workshop (ASRU), pp. 1-7, December 2023.", "essential_references_not_discussed": "No.", "other_strengths_and_weaknesses": "Strengths:\n1. The paper highlights the vulnerability of existing perturbation-based voice cloning defenses in the presence of adversarial purification. This is a critical security concern for current voice cloning defenses.\n2. The proposed new purification method is a creative combination of existing techniques and demonstrates some originality. Experimental results demonstrate its effectiveness.\n3. The paper is well-organized, and the figures and tables are clear and informative.\n\nWeaknesses: \n1. The proposed method increases time cost due to the introduction of the refinement stage.\n2. In Section 4.3, \"Phoneme Representation,\" the terms \"force alignment\" and \"force aligner\" may require clarification. This lack of clarity makes it slightly challenging for readers unfamiliar with this content to fully grasp the method's implementation.\n3. Some experimental results and settings require explanation (see the \"Questions For Authors\" section).", "other_comments_or_suggestions": "While not strictly necessary for publication, open-sourcing the code would greatly enhance the reproducibility of this work and facilitate further research in this area.", "questions_for_authors": "1. The paper analyzes the limitations of existing purification methods, such as DiffWave from [2] and WavePurifier[3]. However, the paper does not analyze why DiffSpec from [2] or DualPure[4] performs worse than DiffWave or WavePurifier[3] in this task (as shown in Table 4). This is somewhat counterintuitive, as in other adversarial purification tasks, their performance difference compared to DiffWave is much smaller [2, 4].  A reasonable analysis of these results could significantly strengthen the paper. Could the authors provide an analysis of these seemingly unexpected results?\n2. The paper compares the proposed method with \"DS,\" \"QT,\" and \"Mel\" methods from [1]. However, it does not include comparisons with the \"Filter Power\" and \"LPC\" methods also presented in [1]. Could the authors please either supplement the experiments to include these comparisons or provide a justification for why \"Filter Power\" and \"LPC\" methods were not included in the comparative evaluation?\n3. In Table 4 (Appendix B.4), the \"Parameter Value\" for \"DS\" (Downsampling) is 1600Hz. For original audio with a sampling rate of 16000Hz, this parameter choice seems unusual for downsampling as it would lead to a significant loss of high-frequency components. The parameter also deviates from the default settings in Paper [1].  Could the authors please explain the rationale behind selecting this specific parameter value for downsampling?\n\n\n\n[1] Hussain, S., Neekhara, P., Dubnov, S., McAuley, J., and Koushanfar, F. WaveGuard: Understanding and Mitigating Audio Adversarial Examples. USENIX, 2021.\n[2] Wu, S., Wang, J., Ping, W., Nie, W., and Xiao, C. Defending against adversarial audio via diffusion model. In The Eleventh International Conference on Learning Representations, 2023.\n[3] Guo, H., Wang, G., Chen, B., Wang, Y., Zhang, X., Chen, X., Yan, Q., and Xiao, L. WavePurifier: purifying audio adversarial examples via hierarchical diffusion models. In Proceedings of the 30th Annual International Conference on Mobile Computing and Networking, pp. 1268–1282, 2024.\n[4] Tan, H., Liu, X., Zhang, H., Zhang, J., Qian, Y., and Gu, Z. DualPure: An Efficient Adversarial Purification Method for Speech Command Recognition. In Interspeech 2024, pp. 1280–1284. ISCA, September 2024.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Meta-review: Thank you for submitting your work to ICML 2025, and for your efforts in the rebuttal phase to clarify the reviewers' concerns. The authors should clarify the motivation behind the refinement stage, as it serves as a key assumption in the paper. Additionally, evaluating the proposed method across different languages would further support its effectiveness. I believe these issues can be effectively addressed in the camera-ready version. Since all the reviewers affirmed the novelty of the authors' work, I recommend accepting the paper.
Decision: Accept (poster)