VoiceMixer: Adversarial Voice Style Mixup

Abstract: Although recent advances in voice conversion have shown significant improvement, there still remains a gap between the converted voice and target voice. A key factor that maintains this gap is the insufficient decomposition of content and voice style from the source speech. This insufficiency leads to the converted speech containing source speech style or losing source speech content. In this paper, we present VoiceMixer which can effectively decompose and transfer voice style through a novel information bottleneck and adversarial feedback. With self-supervised representation learning, the proposed information bottleneck can decompose the content and style with only a small loss of content information. Also, for adversarial feedback of each information, the discriminator is decomposed into content and style discriminator with self-supervision, which enable our model to achieve better generalization to the voice style of the converted speech. The experimental results show the superiority of our model in disentanglement and transfer performance, and improve audio quality by preserving content information.


Reviews and author responses:

 We appreciate for your helpful comments and suggestions. We have provided responses to your questions below to address your concerns.
 
[About the Parrotron]
Thank you for your advice. We will include this paper [1] to explain the model using text transcriptions.

[About the proper bottleneck size]
We use “the proper bottleneck size” to refer to the bottleneck size that enables the model to reconstruct the content as well as to transfer the voice style. A trade-off exists between the speech quality (content information) and speaker similarity (style information). However, in practice, even the content embedding from AutoVC using a bottleneck size of 32 contains speaker information as indicated in Table 4. AutoVC using a bottleneck size of 32 also has a lower quality of naturalness. To avoid confusion regarding the proper bottleneck size for the content embedding to contain only content information, we will clarify this matter in the revised version.

[About the pitch contour]
Although the pitch contour can be extracted from the raw waveform, many f0-conditioned voice conversion models [2, 3] use quantized f0 to synthesize speech as supervised conditional information manually. Furthermore, prior to quantizing the f0 contour, the f0 sequences should be normalized by removing the outliers and using low/high-pass filters. This process should be conducted to optimize the model heuristically; therefore, we note that the pitch contour is a supervised feature.

[About the phoneme boundaries]
We assume that the content embeddings of similar phonemes are similar. Hence, when downsampling adjacent content embeddings with higher similarity, similar phonetic information may be mapped together. As you mentioned, this does not provide a perfect correspondence to the phoneme boundary, however, we use contrastive loss to increase the similarity between adjacent content embeddings that may have similar phonetic information.

[About the similarity-based duration]
The term $d_n$ is the cumulative sum of the frame number that is added until the similarity $q_t$ is under average similarity. The average similarity is the average over the utterance.

[About the importance of training in a non-autoregressive manner]
We adopt a non-autoregressive manner to design our positive and negative samples for our contrastive losses which are able to disentangle the content and style information. Furthermore, it offers the advantage of reducing the theoretical complexity from $\mathcal{O}(T \cdot d^2)$ to $\mathcal{O}(K \cdot d^2)$, where $T$ is the time length, $d$ is the representation dimension, and $K$ is the kernel size. We will add these details in the revised version.

[About the ethical concerns]
We acknowledge the potential harms, malicious use, and ethical concerns of voice conversion and our proposed approach. We will elaborate on the discussions of these risks and mitigation strategies in the revised version.
 
[1] F. Biadsy, et al., "Parrotron: An End-to-End Speech-to-Speech Conversion Model and its Applications to Hearing-Impaired Speech and Speech Separation," Proc. Interspeech, 2019.

[2] K. Qian, et al., "F0-consistent many-to-many non-parallel voice conversion via conditional autoencoder," In ICASSP 2020-2020 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), 2020.

[3] K. Qian, et al., "Unsupervised speech decomposition via triple information bottleneck," International Conference on Machine Learning, 2020.


 Thank you for this response. I appreciate the effort in addressing the comments raised in my and other reviews.

NeurIPS takes the ethical reviews (and associated ethical implications) very seriously.  The technical comments are clearly addressed, please make sure the ethical concerns receive similarly thorough treatment.

 Thanks for addressing my concerns. Part of my concerns has been resolved; however, some concerns remain.

[About the evaluation]
It seems that the authors confuse conditional FDSD (cFDSD) and (unconditional) FDSD. In the former, it is assumed that the conditional texts are the same; therefore, the misalignment may affect the performance. However, in the latter (which the authors say to use), it is assumed that corresponding texts are different (or randomly selected); therefore, the misalignment will not be an important issue. Anyway, FDSD is a measurement that measures the distance between the distribution and is not a measurement that measures the distance between the individual samples directly. Therefore, it is not obvious whether the misalignment yields performance degradation.

[About the audio normalization]
By judging from the response, it seems that the normalization is not appropriately conducted for StarGAN-VC and blow. I think that applying normalization to the output waveform may be better when conversion data are different according to the method.

Some concerns, which I raised in the first review, are not addressed in the response. I expect that they also will be addressed here or in the revised paper if this paper is accepted.

 Thank you for your response to my questions and comments. It seems like the main concern at this point is the ethical concerns. Voice conversion is a legitimate problem and many papers on VC have appeared at top ML conferences, so I do not think that the paper should be rejected simply because it works on voice conversion. The authors plan to add a paragraph with details on the harmful applications of the project, and I think this is the most that is reasonably expected of someone working on voice conversion. I keep my recommendation that the paper should be accepted, especially on the basis of the strong technical contribution and the extensive experiments.

 Thank you for your sincere concerns and advice about the ethical issues. We all acknowledge the potential harms, malicious use, and ethical concerns of voice conversion technology. We will promise to elaborate on the discussions of these risks and mitigation strategies in the revised version. As you suggested, we will add a section for the potential negative societal impacts. We acknowledge that we should have stated the potential negative impact and the mitigation strategies in more thorough manner. We will discuss the social negative impacts on voice conversion and the mitigation strategies in the revised version, as below.
 
Recently, as speech-related AI systems such as voice conversion (VC) and text-to-speech (TTS) synthesize realistic audio, there is an increased risk of the potential harms, malicious use, and ethical concerns for TTS and VC systems. These systems can be used to deceive people in various ways; a usage in crime such a voice spoofing [1], fake news [2], and commercial use by cloning voice without consent [3]. It is necessary to consider a countermeasure for reducing these potential risks. The anti-spoofing techniques [4] such a fake audio detection [5-7] are developed to distinguish synthesized speech, and [8] demonstrated that the AI outperforms the human in fake audio attacks. Moreover, recently, there is an attack using a partially fake audio clip, where some small fake audio clips are hidden in real speech audio. As [9] indicated that partially fake audio detection is more challenging than fully fake audio, it is also important to develop a partially fake audio detection model. The explainable AI (XAI) techniques [10, 11] are adopted to detect the deepfake image and to visualize their representations for the explainability of deepfake detection [12], and it can be extended to an explainable model for fake audio detection.
 
Additionally, as mentioned by the ethics reviewers, we will open a discussion section in the revised version of the paper to discuss potential ways to mitigate risks involved with our method. As suggested, we agree that discussions of detailed potential mitigation approaches for our research is a step in the right direction. Our approach on the usage of self-supervised method for voice style transfer coincides with the suggestion that both source and target voice parties must give written consent. Furthermore, if a party is dead, we either believe that this voice conversion technology should not be used or used conditionally with the consent from a family member. However, there is much to be discussed on this matter in detail, which we will re-emphasize that a whole new section will be dedicated for. 
  
[1] Kinnunen, Tomi, et al. "Vulnerability of speaker verification systems against voice conversion spoofing attacks: The case of telephone speech." 2012 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). IEEE, 2012.

[2] Singhal, Shivangi, et al. "Spotfake: A multi-modal framework for fake news detection." 2019 IEEE fifth international conference on multimedia big data (BigMM). IEEE, 2019.

[3] Wang, Run, et al. "Deepsonar: Towards effective and robust detection of ai-synthesized fake voices." Proceedings of the 28th ACM International Conference on Multimedia. 2020.

[4] Wu, Zhizheng, et al. "Detecting converted speech and natural speech for anti-spoofing attack in speaker recognition." Thirteenth Annual Conference of the International Speech Communication Association. 2012.

[5] Tak, Hemlata, et al. "End-to-end anti-spoofing with RawNet2." ICASSP 2021-2021 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). IEEE, 2021.

[6] Mittal, Trisha, et al. "Emotions Don't Lie: An Audio-Visual Deepfake Detection Method using Affective Cues." Proceedings of the 28th ACM international conference on multimedia. 2020.

[7] Ma, Youxuan, et al. "RW-Resnet: A Novel Speech Anti-Spoofing Model Using Raw Waveform." arXiv preprint arXiv:2108.05684 (2021).

[8] Müller, Nicolas M., Karla Markert, and Konstantin Böttinger. "Human perception of audio deepfakes." arXiv preprint arXiv:2107.09667 (2021).

[9] Yi, Jiangyan, et al. "Half-Truth: A Partially Fake Audio Detection Dataset." arXiv preprint arXiv:2104.03617 (2021).

[10] Gunning, David, et al. "XAI—Explainable artificial intelligence." Science Robotics 4.37 (2019).

[11] Bach, Sebastian, et al. "On pixel-wise explanations for non-linear classifier decisions by layer-wise relevance propagation." PloS one 10.7 (2015): e0130140.

[12] Malolan, Badhrinarayan, Ankit Parekh, and Faruk Kazi. "Explainable deep-fake detection using visual interpretability methods." 2020 3rd International Conference on Information and Computer Technologies (ICICT). IEEE, 2020.


 VoiceMixer targets improved voice style transfer, using contrastive self-supervision and adversarial learning. The learning target is to improve an end-user's ability to make a speaker sound like another, and this paper demonstrates how to make that easier, i.e., with less supervision needed. 

This paper has the ability to negatively impact on society, with few positive imaginable uses. As other reviewers have noted, such technology is **already used** to facilitate deceptive interactions that would cause harms such as theft, fraud, or harassment (https://neurips.cc/public/EthicsGuidelines) via phishing attacks or by copying voices without the targeted individuals' consent. The fact that VoiceMixer reduces the supervision burden just makes the potential damage worse - there are few plausible reasons that this ``improved'' model would be needed, other than for deceptive interactions.

 Given this loaded setting, it is surprising that the paper does not contain the required broader impact statement, and the societal impact is only addressed in a few sentences in the introduction. Further, there is no discussion of mitigation strategies for these risks in methods, methodology, application, data collection and data usage. The authors either are completely unaware of the dangers that even non-expert use of VoiceMixer poses, or do not care.  I do not think that the authors can address these concerns sufficiently in the current version of the paper, and recommend that the paper be rejected. I am unsure why the authors ignored the requirement for a broader impact statement, given the space they are choosing to work in. 

 The task of voice style transfer carries with it significant ethical risks, much like related risks for video-based deepfake technology, including for fraud, phishing, disinformation, among other risks [1, 2]. The potential for harm from this class of technology is substantial and wide-ranging, with potential harms to individuals whose voices may be used as the target for voice style transfer, to those interacting with the synthesized voices, to society more generally (in the case of audio disinformation used as part of fake political ads or misinformation [3]). 

The authors motivate their work by arguing for potential applications in entertainment, yet recent examples of synthetic audio trained on a recently deceased celebrity (despite their clear lack of consent) represent one potential harm of this application used in entertainment [4], with other potential risks including the use of voice actors' pre-recorded audio to generate new synthetic audio without compensation (e.g., similar to TikTok's use of a text-to-speech voice from a woman who did not consent to its use [5]), in addition to the larger representational harms [6] of producing speech using someone's potentially recognizable voice that may be at odds with their beliefs and values (in addition to being done without their consent).

In addition, while this general class of approaches to voice conversion or voice style transfer is problematic, this paper is particularly egregious because the contribution is intended to make it more effective to disentangle the style of the source speech from the final output. Given that subtle vocal style cues may be one key way for anti-spoofing approaches to detect audio style transfer (e.g., [1, 7]), this paper may make this detection more difficult.

Finally, and perhaps most crucially, this paper represents one of the primary categories of harm described in the NeurIPS ethics guidelines [8], and the potential for deception should be acknowledged and meaningfully grappled with, particularly in the face of proposed regulation in the US [9].


[1] Müller, N. M., Markert, K., & Böttinger, K. (2021). Human perception of audio deepfakes. arXiv preprint arXiv:2107.09667.

[2] https://techmonitor.ai/techonology/cybersecurity/growing-threat-audio-deepfake-scams

[3] https://www.sfchronicle.com/politics/article/Nancy-Pelosi-Facebook-lying-to-the-public-13904867.php?psid=mekxo

[4] https://www.newyorker.com/culture/annals-of-gastronomy/the-ethics-of-a-deepfake-anthony-bourdain-voice

[5] https://www.theverge.com/2021/5/13/22435058/tiktok-voice-sues-unauthorized-usage-text-to-speech

[6] Blodgett, S. L., Barocas, S., Daumé III, H., & Wallach, H. (2020). Language (technology) is power: A critical survey of" bias" in nlp. arXiv preprint arXiv:2005.14050.

[7] Mittal, T., Bhattacharya, U., Chandra, R., Bera, A., & Manocha, D. (2020, October). Emotions Don't Lie: An Audio-Visual Deepfake Detection Method using Affective Cues. In Proceedings of the 28th ACM international conference on multimedia (pp. 2823-2832).

[8] https://neurips.cc/public/EthicsGuidelines

[9] https://www.congress.gov/bill/116th-congress/house-bill/3230/text The authors include one sentence in their motivation that states the "potential risk of usage in crime such as voice spoofing", but they include this in a sentence along with what appears to be positive motivations for its use, in applications such as education and voice restoring. This makes it entirely unclear what the potential risks are, nor how their work may contribute to exacerbating these risks, or how readers of this paper should interpret the contribution of the paper with respect for the potential to compound existing risks.  This paper may contribute to making voice style transfer more difficult to detect, potentially enabling audio deepfakes and further contributing to the potential risks to privacy, security, and disinformation (among others). At the absolute minimum, the authors should engage meaningfully with these risks, explicate the potential harms and how they address them, and leave the readers with a sober understanding of how this approach could contribute to potential harm. 

However, even with such an acknowledgment, it is not clear to me that the potential benefits of publishing the approach in this paper outweigh the risks, and I cannot in good conscience recommend this paper for acceptance. 

 We appreciate for your helpful comments and suggestions. We have provided responses to your questions below to address your concerns.

[About the notations]
Thank you for your advice. The notations $X_{1,A}$ and $X_{1 \rightarrow 1,A}$ are defined in Section 2. However, we will clarify these definitions further in revised the paper.

[About the Style_- loss]
This is not the difference between the final output of the discriminator. Instead, it measures the feature difference between each block of the discriminator. The feature matching loss is a learned similarity metric between the features. The repulsive style loss measures the style-conditioned feature difference between each block of the discriminator from the source and converted speech. Maximizing the style feature distance between the source and converted speech prevents the converted speech from containing the style of the source speech.

[About the ablation study]
We conducted the ablation study with different combinations of each loss term and module. Our results demonstrated that it is preferable for the similarity-based information bottleneck to use the contrastive loss and adversarial speaker loss together. Moreover, using only the positive contrastive loss causes the model to reconstruct only the source speech. Therefore, it is important to use the negative contrastive loss and adversarial speaker classification loss together.

[About the ethical concerns]
We will add more discussion about potential negative societal impact of voice conversion.


 We appreciate for your helpful comments and suggestions. We have provided responses to your questions below to address your concerns.

[About the equation 7]
Yes, your observation is correct. In certain cases, the (i+k) content may be similar to the ith content. However, although they have almost the same phonetic information, the content embedding may differ according to the adjacent content information as illustrated in Figure 8 of the Appendix. Furthermore, as the loss is also averaged according to the batch and time frame, it does not seem to be a problem in practice.

[About adding the related work]
Thanks for your advice. We also think that it is important to convert the pitch or rhythm of speech. We will add this paper [1] for related work in the revised version.

[About the ethical concerns]
We will add more discussion about potential negative societal impact of voice conversion.

[1] K. Qian, et al., "Unsupervised speech decomposition via triple information bottleneck," International Conference on Machine Learning, 2020.


 We appreciate for your helpful comments and suggestions. We have provided responses to your questions below to address your concerns.

[About the evaluation]
In our work, we conducted FDSD between the source and converted speech. Although the target speech is uttered with the same sentence as the source speech, the two speeches have different phonetic alignment. If the FDSD between converted and target speech is measured as you suggested, the misaligned distance between the converted and target speech is calculated. To address your concern, we conducted two additional experiments. First, we conducted the FDSD evaluation between source and reconstructed speech. The measurements demonstrated consistent results (VoiceMixer: 1.261, AutoVC ($\tau$ = 16): 4.806, AutoVC ($\tau$ = 32): 10.604). Second, we conducted the automatic speech recognition (ASR) test for the converted speech. The results revealed that VoiceMixer had a lower word error rate (WER) of 20.92% (GT: 8.18%, Vocoder: 10.12% AutoVC ($\tau$ = 16): 39.27%, AutoVC ($\tau$ = 32): 61.99%). VoiceMixer also had a lower character error rate (CER) of 22.13% (GT: 8.612%, Vocoder: 10.19%, AutoVC ($\tau$ = 16): 41.52%, AutoVC ($\tau$ = 32): 65.40%. We used the Google Speech-to-Text API for the ASR model. We will add these results in the revised version. Furthermore, we will add the descriptions of the $MCD$ and $RMSE_{f0}$ results in the revised version.
We used StarGAN-VC as baseline modes. However, as you mentioned, we also think the recommended models with HiFi-GAN are more appropriate as a baseline. Unfortunately, there is no official source code for MaskCycleGAN-VC.

[About the audio normalization]
During inference, we normalized the amplitude of the source audio by 1/max(abs(signal)) * 32768, and transformed the mel-spectrogram from the normalized audio. Each model without StarGAN-VC and blow used the same source mel-spectrogram as an input.
 
[About the Section 4.2]
Thanks for your advice. We will revise Section 4.2 to improve the readability in the revised version.

[About the ethical concerns]
We will add more discussion about potential negative societal impact of voice conversion.

[About converting rhythm and prosody]
We agree that it is important to convert the rhythm and prosody in the voice conversion domain. We believe that our method can be extended to models for converting the rhythm or other speaker characteristics. Following the submission, [1] was introduced, which is a similar method to ours adopted for rhythm conversion. We think that our self-supervised learning method can be used to improve this method. We will add this limitation and related work in the revised version.
 
[About the training data]
We have not yet trained our model with only a small amount of data. We used the easily available public multi-speaker dataset to train our model, In terms of using small amount of data, our model offers the advantage of acceptable zero-shot and few-shot speaker transfer. However, StarGAN-VC does not transfer unseen speakers during training.

[1] K. Qian, et al., "Global Prosody Style Transfer Without Text Transcriptions," International Conference on Machine Learning, 2021.


This paper describes a few new additions to voice conversion. These include the 1) use of contrastive self-supervision and 2) and adversarial training component to disentangle content and style.  The impact of these modifications are verified on VCTK demonstrating improvements over AUTOVC -- a reasonable comparison.  Overall this paper is well motivated and the contributions are mostly well described.  Comments below mostly aim to improve the presentation of the work, but in some cases look for clarity in the presentation.

Lines 45-48: Also "Parrotron: An End-to-End Speech-to-Speech Conversion Model and its Applications to Hearing-Impaired Speech and Speech Separation" Biadsy et al 2019

Line 89: "...some content information is lost even with proper bottleneck size. Therefore, missing some content information in converted voice is inevitable." Why is this loss inevitable? Certainly there is some bottleneck size that does not lose content information.

Line 95: why is "pitch contour" considered to be a "supervised feature"? F0 is a quality of the acoustic signal that can be extracted without human supervision.

Line 106: without phoneme information, how do you know that this is corresponding to phoneme boundaries?

Line 111: "cumulative sum" -> cumulative sum of what?  
Line 111: is N the same as D?
Line 112: "average similarity" -> over what unit? average over the utterance? average over the batch? average over the whole dataset?

Section 3.3 Why is it important to train in a non-autoregressive manner? Voice conversion -- making one speaker sound like another -- with minimal supervision has privacy and disinformation implications.  These are not addressed in the paper or mitigated by the approach.  

This paper is concerned with many-to-many and zero-shot voice conversion. In particular, this paper focuses on the learning of disentangled representation learning to improve the conversion quality. To address this, this paper proposes a framework called VoiceMixer, which can efficiently separate the content and speaker style by using an information bottleneck and adversarial feedback. For the information bottleneck, self-supervised learning is used to find and bundle similar content frames in a data-driven manner. For adversarial feedback, two discriminators, i.e., content- and style-conditional discriminators, are used to learn content- and style-specific representations, respectively. The experimental results on the VCTK dataset demonstrate that the proposed method outperforms some baselines in terms of objective and subjective evaluations.  Originality:

The main technical contributions of this paper are twofold:
1. A similarity-based information bottleneck. As described in Figure 2, this information bottleneck is different from that of the previous study (i.e., AutoVC). The previous one chunks frames in a fixed length, whereas the proposed one chunks frames based on the similarity. In particular, this similarity is learned in a data-driven manner in a self-supervised way; therefore, no supervision is required.
2. Adversarial voice style mixup. To learn the disentangled representations, content- and style-conditional discriminators are introduced. In addition, the feature matching loss is used to make the same contents close. The attractive and repulsive adversarial losses are used to encourage the same speakers and different speakers to approach and leave, respectively. All losses are designed in a self-supervised learning framework; therefore, no supervision is required.

To the best of my knowledge, these two techniques are new, and I consider that this work has sufficient originality.

Quality:

In the experiments, the proposed method is evaluated using multiple metrics, including subjection evaluation on naturalness and similarity, and objective evaluation on ASV EER, MCD, RMSEf0, and FDSD. The proposed method is compared to multiple baselines, including StarGAN-VC, AGAIN-VC, AUTOVC, and Blow. In addition, the ground-truth and synthesized-and-analyzed speeches are provided; hence, we can know the anchor performance. Ablation studies are also provided. From the results, we can understand the effectiveness of each component. Information bottleneck alignment is visualized in Figure 4. Although it would be better to provide more samples in the supplementary material, the presented results are helpful for understanding how a similarity-based information bottleneck works.

Overall, I think that the authors evaluate the proposed method comprehensively. However, I have some concerns.
- In the discussion of the results (Section 4.4), the authors pick up the metrics (i.e., naturalness, similarity, ASV EER, and FDSD) that are favorable for the proposed method and ignore the metrics (i.e., MCD and RMSEf0) that are favorable for some baselines. I think the description is unfair and the authors should describe both merits and demerits clearly.
- I am not sure whether calculating FDSD between source and converted speeches is reasonable. Another possible calculation method is to calculate FDSD between converted and target speeches. When cFDSD (conditional FDSD) is used, the first calculation method is relatively reasonable because it is possible to calculate the distance conditioned on the linguistic features. In contrast, FDSD (unconditional FDSD) is used, it is required to handle speaker difference and linguistic difference simultaneously. I suspect that when FDSD is used, the latter calculation method (i.e., FDSD between converted and target speeches) is an available alternative metric.
- In the experiments, StarGAN-VC (version 1) is applied to mel-cepstrum conversion, and the WORLD vocoder is used to synthesize waveform. However, the improved variant called StarGAN-VC2 [A] has been proposed. In addition, the techniques to apply CycleGAN-VC to mel-spectrogram conversion have been also presented [Kaneko et al., 2020][B]. As the same neural vocoder (i.e., HiFi-GAN) is used except for StarGAN-VC, the combination of StarGAN-VC2-based mel-spectrogram conversion and HiFi-GAN is more appropriate as a baseline.
  - [A] Kaneko et al., “StarGAN-VC2: Rethinking conditional methods for StarGAN-based voice conversion,” Interspeech 2019.
  - [B] Kaneko et al., “MaskCycleGAN-VC: Learning Non-Parallel Voice Conversion with Filling in Frames,” ICASSP 2021.
- On the demo page, the volumes of audio samples sound different. However, it is known that the volume difference influences scoring. The authors should normalize the audio clips before subjective evaluation.

Clarity:

Overall, this paper is well written and easy to follow. An exception is Section 4.2, where the network architectures are explained with just words over two-thirds of a page. Although the detailed figures are provided in the appendix, it would be better to devise this part to improve the readability.

Significance:

The significance of the proposed method is demonstrated through the comparative study and ablation study. The visualized results in Figure 4 demonstrate the effectiveness of the similarity-based information bottleneck well. - Voice conversion technique can be used for creating deepfakes. This is a potential negative social impact of this study.
- As I mentioned above, the proposed method deteriorates MCD and RMSEf0 compared with some baselines. This is a clear demerit of the proposed method.
- This paper focuses on converting speeches in a frame-by-frame manner, and the proposed method cannot be used to convert global speaker characteristics, such as rhythm and prosody. This is also a limitation of the proposed method.
- I suspect that the proposed method requires larger-scale training data to learn sufficiently disentangled representations, comparing with StarGAN-VC that can learn using a relatively small amount of data (e.g., five min. utterances multiplied by four persons). I suspect that the proposed method cannot learn using such a small amount of data.

This paper adds many new loss terms to the AutoVC voice conversion algorithm, resulting in improved performance.  Strengths

VoiceMixer achieves better perceptual results than four state of the art voice conversion algorithms.

The comparison of MCD, RMSEF0, and FDSD is enlightening: AutoVC is better on the former two measures, but VoiceMixer is better on the latter measure.  This result suggests that VoiceMixer's similarity-based bottleneck layer, and its masked-reconstruction hidden layer, are better than AutoVC's regularly-spaced bottleneck at maintaining phoneme identity through the conversion, possibly at the expense of some of the non-phonemic spectral detail.  Perceptual results suggest that the phonemic detials maintained by VoiceMixer are of more importance to human listeners than the non-phonemic details  that it loses.

Weaknesses

The notations X1, X1->1, and so on are introduced without definition.  I imagine that this paper would be impossible to follow if one did  not already know the voice conversion literature quite well.

There are a very large number of loss functions, presented with only brief justification.  One  has  the sense that these loss terms are collected from every previous publication on voice conversion, without separate theoretical justification.  The masked convolutions are from (Liu et al., 2020); adversarial speaker classification is from (Hsu et al., 2019); the GAN parts are from (Mao et al., 2017).   Only the similarity-based bottleneck and the voice style mixup are apparently new to this paper.

The style- loss seems theoretically incorrect.  I understand that you want X1 and X1->2 to sound like different people, but Eq. (18) doesn't measuring the difference between the two voices -- it measures the difference between their discriminator outputs.  Since both discriminators should output 1, the difference between them should be 0.  

Ablation studies are very hard to follow; it seems that each one of the loss terms has an impact on all of the different performance metrics.  Does that  mean that  the loss terms work together in some way?





 Voice conversion is an extremely active research field, with significant potential societal impacts, both good and ill.  Authors have listed some of the potential impacts in the paper, both good and ill.

This paper presents a new method for voice conversion. In particular, it overcomes limitations in previous methods by focusing on the disentanglement of content and style information through several new losses and similarity measures.  Overall the ideas in the paper were quite good, and the results reflect that. I was impressed with the quality of the voice conversion results in the supplementary results, which are largely artifact free and better than the baselines.

I particularly liked the idea of replacing the fixed-length bottleneck found in AutoVC and other methods with a learned similarity based bottleneck. Finding the right bottleneck can be a big pain point when working with those systems, so this is a welcome contribution. With that in mind, Section 3.2 reasonably describes the similarity based bottleneck given the assumptions that content embeddings are similar to those around them and that the most important part of an utterance is generally in the middle. 

The contrastive losses in section 3.3 are also reasonable. A question for the authors, for the negative loss in eq 7, is it possible that the (i+k) content is similar to the ith content (for example a word could be repeated)? In that case this loss would be maximizing the distance between two embeddings that should actually be similar.

The use of the style and content discriminators further improves the performance of the generator and make it more aware of the disentanglement between the two pieces of information.

The experiment section is particularly thorough, with a wide variety of qualitative and quantitative comparisons including content alignment, mean opinion scores, and ablation studies. The classification experiment in section 4.6 is particularly compelling to show that the style-content disentanglement of the proposed method is better than the baselines.

The downsides of the paper: Firstly, the work is largely based on AutoVC which is acknowledged in the introduction. The high level formulation of a content and style encoder with a generator (left two panels of figure 1) follow directly from AutoVC. Additionally, one of the main benefits of AutoVC was how simple the training objectives and losses were, whereas VoiceMixer has far more objectives and heuristics built into the training. However, the strong experimental section seem to show that the additional loss functions are justified and provide sufficient novelty.

One more note, the paper "Unsupervised Speech Decomposition via Triple Information Bottleneck" by Qian et al. also shows improvement on AutoVC with carefully crafted information bottlenecks for pitch and rhythm. It would be useful to mention this in the related works.  The societal impact is not sufficiently addressed, except for a short paragraph in the introduction. The paper does not contain a broader impact statement even though it is required, and this work in particular has many potential negative applications such as phishing attacks or cloning voices without individuals' consent.

Meta-review: UPDATE: The revision was reviewed and paper accepted.

----

This paper was discussed at length between the SACs, ACs, ethics reviewers, ethics review chairs, and program chairs.  In the end, a decision was made to conditionally accept the paper.  The list of conditions for acceptance is as follows:

1. Meaningful broader impacts statement. Moving beyond superficial discussion of obvious harms into a more detailed and thorough reflection on ethical issues, especially possible broader impact and potential for misuse. 

2. Restricted release of model through some type of licensing or form-restricted access (ie. private repo accessed via request, model code and data use restricted by licenses, etc.)

3. Discussion of possible theoretical and practical mitigation strategies for minimizing harm of such technologies in the future. If this is not possible to discuss, include a clear articulation of the limits of such models in the absence of mitigation approaches. It is not necessary to implement the mitigation strategies discussed though some current work in this area should be highlighted by authors in the main text. 

The original meta-review from the AC follows.

---

The reviewers have found this work technically sound overall, with a solid experimental section and thorough evaluation. The proposed approach is quite complex relative to the natural baseline (AutoVC), but the convincing experimental results adequately justify this additional complexity.

With regards to ethics however, there were some major concerns. I personally believe voice conversion has legitimate applications, and I do not think this work should be rejected simply because it genuinely improves on the state of the art in an area that is unfortunately fraught with potential misuse. It is imperative, however, that the authors appreciate the ethical implications of their work, and that it is correctly framed in this light in the manuscript.

The authors have responded to the ethics reviewers' concerns with a draft paragraph to include in the revised manuscript. The proposed changes include an overview of various potential nefarious uses, as well as a discussion of some potential countermeasures. Nevertheless, this has left some reviewers unconvinced. 

After giving this a lot of thought however, I think this should be an opportunity for the authors to genuinely engage with the potential impact of their work, and therefore I prefer a positive approach. I would like to recommend acceptance, but this will be conditional on a further expansion of this section of the manuscript, demonstrating an exploration of the larger ethical concerns and implications of inappropriate use, as well as a clear, objective and exhaustive analysis showing that the benefits of publishing this work outweigh the risks. Please refer to the ethics reviewers' comments for further details on what should be included.

Decision: accept