Non-invasive adaptive speaker anonymity system and method based on adversarial samples

Abstract

The present invention discloses a non-invasive adaptive speaker anonymity system and method based on adversarial samples. The system includes a diverse target speaker generation module, an any-to-any adversarial perturbation construction module and an imperceptible adversarial perturbation optimization module. The diverse target speaker generation module generates target speaker embedding codes on demand according to input target labels, the any-to-any adversarial perturbation construction module constructs adversarial perturbations according to input target speaker embedding codes, and the imperceptible adversarial perturbation optimization module further optimizes the input adversarial perturbations to obtain adversarial perturbations that are imperceptible to human ears. The present invention can realize any-to-any speaker identity conversion, hide the original user's voiceprint information among a group of target speakers to adaptively avoid identity detection by an automatic speaker recognition system, and sample target embedding codes on demand through a pre-trained conditional variational autoencoder, which greatly releases the computing and storage resource requirements for actual deployment.

Description

Technical Field

[0001] The present invention relates to the field of (audio data identity privacy protection), and in particular to a non-invasive adaptive speaker anonymity system and method based on adversarial samples. Background Art

[0002] In recent years, voice input has gradually become popular and widely deployed in various service applications, supporting rich and powerful functions such as automatic voice transcription, efficient voice search and current language translation, thus providing a human-centered intelligent interactive experience. However, behind the powerful functions of voice services, the privacy risks of voice data disclosure have attracted widespread attention. Technology giants such as Microsoft and Google have long collected and stored user voices, and voice suppliers such as Apple and Amazon have been frequently exposed to eavesdropping on user conversations. Although these companies claim in their privacy terms that they will anonymize user data to eliminate account connections, users' identity privacy still faces various potential threats, especially many professional automatic speaker recognition tools can easily reveal users' voiceprint features from only tens of seconds of voice, and use them for malicious purposes such as accurate user portraits, targeted advertising, and even individual identity forgery. Faced with the dilemma between voice service functions and personal identity privacy, users urgently need a reliable voice service privacy protection solution.

[0003] Existing speaker anonymity research focuses on eliminating individual features in speech while retaining text content through the paradigm of speech conversion and speech synthesis. Among them, most of the work follows the paradigm of speech conversion to hide the user's real voiceprint by modifying low-level time-frequency-amplitude acoustic features such as fundamental frequency and rhythm or high-level speaker embedding code features, while some other studies propose to use text to re-synthesize speech without any effective voiceprint features to maximize identity privacy. Although existing work has effectively explored the protection of user identity privacy in speech, this direct modification and re-synthesis will produce serious signal distortion and artificial traces, which greatly affects the function of voice services, especially the auditory experience of human participants, resulting in perceptual inconsistency in application scenarios such as instant messaging and social media.

[0004] The present invention proposes a non-invasive, adaptive speaker anonymity system based on adversarial samples from a new perspective of balancing voice service functions and personal identity privacy. Taking advantage of its strong aggressiveness to neural network models and its concealment that is difficult for the human ear to perceive, the present invention uses adversarial samples as a virtual cloak in cyberspace to mask the user's identity while retaining text information and taking into account the human ear's hearing sense. Through the pre-trained embedded code-level conditional variational autoencoder, the system proposed in the present invention can sample a variety of target speaker samples on demand for the Triplet architecture to generate input-related adversarial perturbations, realize any-to-any speaker identity transformation, and thus adaptively avoid identity detection of uninformed, semi-informed, and informed attacks. At the same time, the system uses the acoustic masking effect to hide the perturbation in the inaudible domain to improve the sound quality of voice adversarial samples and provide a non-invasive user experience. Summary of the invention

[0005] The present invention improves upon the deficiencies of the prior art and provides a non-invasive adaptive speaker anonymity system and method based on adversarial samples. The present invention is implemented through the following technical solutions:

[0006] The present invention discloses a non-invasive adaptive speaker anonymity system based on adversarial samples. The system comprises a diverse target speaker generation module, an any-to-any adversarial perturbation construction module and an imperceptible adversarial perturbation optimization module. The diverse target speaker generation module generates target speaker embedding codes on demand according to input target labels, the any-to-any adversarial perturbation construction module constructs adversarial perturbations according to the input target speaker embedding codes, and the imperceptible adversarial perturbation optimization module further optimizes the input adversarial perturbations to obtain adversarial perturbations imperceptible to human ears. The adversarial perturbations imperceptible to human ears are superimposed on user source voices to generate final adversarial samples.

[0007] The present invention discloses a non-invasive adaptive speaker anonymity method based on adversarial samples, characterized in that the method comprises the following steps:

[0008] 1) The diverse target speaker generation module uses the embedding code level conditional variational autoencoder to learn the distribution of speaker embedding codes, samples latent variables in the speaker latent space according to the target label of the target speaker, and generates the target speaker embedding code through a pre-trained decoder;

[0009] 2) The obtained target speaker embedding code is input into the any-to-any adversarial perturbation construction module. The any-to-any adversarial perturbation construction module constructs a triplet according to the target speaker embedding code and the user source speech embedding code input therein, and uses the Triplet architecture to iteratively construct adversarial perturbations so that the adversarial samples in the speaker latent space are biased toward the target speaker and away from the original user;

[0010] 3) The obtained adversarial disturbance is input into the perceived adversarial disturbance optimization module, which applies the acoustic masking effect to optimize the imperceptibility of the disturbance, reduces signal distortion and retains high speech quality by hiding the adversarial disturbance in the inaudible domain, and obtains adversarial disturbance that is imperceptible to the human ear;

[0011] Finally, the adversarial perturbations generated by the above steps are superimposed on the user's source speech to form an adversarial sample. The sample will be identified as a different target speaker through automatic speaker recognition, and will still output the correct transcription text when input into the automatic speech recognition system, while maintaining good consistency in voiceprint, text, and sound quality.

[0012] As a further improvement, in step 1) described in the present invention, the embedded code level conditional variational autoencoder is a deep neural network with an encoder-decoder architecture, including an extractor, an encoder and a decoder.

[0013] As a further improvement, the specific workflow of the embedded code level conditional variational autoencoder described in the present invention is divided into two stages: pre-training and generation:

[0014] Pre-training phase:

[0015] 1) The input is the speech data of multiple speakers. The extractor converts these speech into MFCC features in the frequency domain and learns the local local features and context information of the speech through the TDNN layer and the ResBlock layer. Then, the StatPooling layer is used to extract the fixed-length voiceprint embedding code and input it into the encoder;

[0016] 2) The encoder explicitly modulates the one-hot encoding y of the target speaker label into the voiceprint embedding code x, then reduces the dimension of the voiceprint embedding code x through multiple downsampling sub-blocks, and then uses two linear network layers to model its mean μ and standard deviation σ; according to the assumption of variational inference, the latent vector z learned by the encoder conforms to the Gaussian distribution: The latent vector z can be sampled from it by the re-parameterization technique: z = μ + σ⊙∈, where ∈ is a random variable that conforms to the standard Gaussian distribution;

[0017] 3) The sampled latent vector z is concatenated with the one-hot encoding y of the target speaker label and input into the decoder. After being transformed by the linear network layer, a new embedded code x' is reconstructed through multiple upsampling sub-blocks;

[0018] 4) Finally, the entire conditional variational autoencoder model is trained with a mean square error term and a KL divergence regularization term:

[0019]

[0020] The first term limits the reconstruction deviation of the output embedded code, the second term forces the latent space to be approximately Gaussian, and the parameter β is used to balance the reconstruction quality of the embedded code and the continuity of the latent space distribution.

[0021] Generation phase:

[0022] Through the pre-trained embedding code level conditional variational autoencoder, diverse target speaker embedding codes are generated through three methods: input reconstruction, latent space sampling and semantic interpolation.

[0023] As a further improvement, the specific process of step 2) of the present invention is: the user source speech embedding code is regarded as a negative sample n, the target speaker embedding code is regarded as a positive sample p, and the adversarial sample is regarded as the anchor sample a to be optimized, and the three form a triplet<a,p,n> , the distance between positive and negative samples and anchor samples in the latent space is quantified by the distance metric function D(·), and the anchor samples are forced to deviate from negative samples and bias towards positive samples by optimizing the following objective function:

[0024]

[0025] According to the objective function, the gradient descent method is used for iterative optimization to generate adversarial perturbations that are maximally close to the target speaker and far away from the source speaker.

[0026] As a further improvement, the specific steps of step 3) of the present invention are:

[0027] 1) Perform short-time Fourier transform on the user source speech x and calculate its logarithmic amplitude spectrum S x ;

[0028] 2) For each frame in the logarithmic magnitude spectrum, find the frequency band with the local maximum sound pressure level as the masking sound and calculate the local masking threshold according to the propagation function;

[0029] 3) All local masking thresholds are spliced ​​frame by frame to obtain the global masking threshold spectrum H x ;

[0030] 4) The auditory sense is restricted by introducing the following difference constraint regularization in the objective function:

[0031]

[0032] Where S δ is the logarithmic amplitude spectrum of the adversarial disturbance, k limits the maximum difference between the disturbance spectrum and the global masking threshold, and the parameter γ is used to adjust the weight of the hearing threshold limit. The adversarial disturbance optimized by this module is difficult to be perceived by the human ear and is superimposed on the user source voice to generate the final adversarial sample.

[0033] The beneficial effects of the present invention are as follows:

[0034] The present invention constructs a non-invasive adaptive speaker anonymity system based on adversarial samples, which can achieve:

[0035] 1) Any-to-any speaker identity conversion: The present invention hides the original user's voiceprint information among a group of target speakers to adaptively avoid identity detection by the automatic speaker recognition system.

[0036] 2) Lightweight speaker anonymity scheme. The present invention greatly releases the computing and storage resource requirements for actual deployment by sampling the target embedding code on demand through a pre-trained conditional variational autoencoder, and is suitable for mobile and IoT voice devices.

[0037] 3) Non-intrusive speaker anonymity user experience. The present invention optimizes inaudible adversarial disturbances through acoustic masking effects, which can effectively reduce signal distortion caused by speaker anonymity, ensure the integrity of text content and consistency of voiceprints, and good audio quality, achieve non-intrusive speaker anonymity, and further achieve a balance between privacy and functionality of voice services. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 It is a system framework diagram of the present invention;

[0039] Figure 2 This is the network structure diagram of the conditional variational autoencoder at the embedding code level;

[0040] Figure 3 Optimize the schematic for Triplet;

[0041] Figure 4 This is a schematic diagram of the acoustic masking effect;

[0042] Figure 5 Comparison chart of subjective and objective evaluation quality of adversarial samples of different speakers;

[0043] Figure 6 This is a comparison chart of the protection success rate under different attack settings;

[0044] Figure 7 A comparison chart of transferability on different speaker recognition models. DETAILED DESCRIPTION

[0045] The technical solution of the present invention is further described below by means of specific embodiments:

[0046] Figure 1This is the system framework diagram of the present invention; the whole system involves three major modules. First, the target label of the target speaker is input into the diverse target speaker generation module. The method of pre-collecting the speaker data pool is abandoned, and a conditional variational autoencoder at the embedding code level is designed to learn the distribution of the target sample, and the embedding code of the target speaker of interest is sampled on demand to weaken the resource dependence, and even generate virtual pseudo speaker samples for perturbation construction. Secondly, the user source voice is input into the any-to-any adversarial perturbation construction module, and the Triplet architecture is used to iteratively construct the perturbation, forcing the adversarial sample to deviate from the original voice and lean towards different target samples in the speaker latent space, thereby disguising any source speaker as any different target speaker, increasing the difficulty of automatic speaker recognition identity detection. Then, in the imperceptible adversarial perturbation optimization module, the acoustic masking effect is applied to optimize the imperceptibility of the perturbation, and the simple infinite norm regularization in the loss function is replaced by the hearing threshold regularization, so that the adversarial perturbation is hidden in the inaudible domain to retain higher speech quality. Ultimately, the speech adversarial samples generated by the above modules will be identified as different target speakers through automatic speaker recognition, and will still output correct transcription text when input into the automatic speech recognition system, while maintaining good consistency in voiceprint, text, and sound quality.

[0047] The first step is to generate a diverse target speaker module. Due to the limited computing and storage resources of mobile and IoT devices, the existing method of pre-collecting the target speaker speech data pool is not feasible in actual deployment. Considering its powerful continuous distribution modeling ability and speech representation learning ability, a conditional variational autoencoder (CVAE) at the embedding code level is designed as a diverse target speaker generator. Figure 2 The network structure diagram of the conditional variational autoencoder at the embedding code level is shown below. First, a large number of speaker embedding codes are extracted from an open source multi-speaker corpus through a pre-trained voiceprint extractor as a dataset for training the conditional variational autoencoder. In the encoder-decoder architecture, the one-hot encoding y of the speaker label is explicitly modulated into the encoder input, and then the original voiceprint embedding code x is reduced in dimension through multiple downsampling sub-blocks, and then its mean μ and standard deviation σ are modeled using two linear network layers. According to variational reasoning, it is assumed that the latent vector z conforms to the Gaussian distribution: The latent vector z is sampled from it by re-parameterization technique: z = μ + σ⊙∈, where ∈ is a variable that conforms to the standard Gaussian distribution. After that, the latent vector z is concatenated with the one-hot encoding y of the speaker label and input into the decoder. After the linear network layer transformation, the embedded code x' is reconstructed through multiple up-sampling sub-blocks. Finally, the entire generative model is trained by a mean square error term and a KL divergence regularization term:

[0048]

[0049] The first term limits the reconstruction bias of the output embedding code, and the second term forces the latent space to approximate a Gaussian distribution. Through this pre-trained CVAE, a variety of target speaker embedding codes can be generated on demand through a variety of methods such as input reconstruction, latent space sampling, and even semantic interpolation.

[0050] The second step is to construct a module for any-to-any adversarial perturbations. Due to the inertia of model gradient optimization, traditional non-directional and directional adversarial perturbation construction methods are prone to produce highly similar adversarial samples. In order to generate diverse adversarial samples, the Triplet architecture of metric learning is used for iterative adversarial perturbation construction. Figure 3 This is a schematic diagram of Triplet optimization. The original speech is regarded as a negative sample n, the target speech is regarded as a positive sample p, and the adversarial sample is regarded as the anchor sample a to be optimized to form a triplet.<a,p,n> By quantifying the distance between positive and negative samples and anchor samples in the latent space through D(·), and forcing the anchor samples to deviate from negative samples and lean towards positive samples, adversarial samples that are maximally close to the target speaker and far away from the source speaker can be generated:

[0051]

[0052] According to the objective function, the gradient descent method is used for iterative optimization to obtain adversarial samples similar to the target speaker's embedding code. On the one hand, this input-dependent construction process can achieve any-to-any identity conversion, allowing any original user to disguise as a group of different target speakers, further increasing the difficulty of identity detection in the automatic speaker recognition system. On the other hand, different users can directly use this system to anonymize their identities without the need for additional registration and entry, thus providing a user-friendly experience.

[0053] The third step is to optimize the module for imperceptible adversarial perturbations. Simple infinity norm regularization only constrains the amplitude of the adversarial perturbation, which easily produces obvious high-frequency components. In order to further reduce the intrusiveness to human hearing, the acoustic masking effect is introduced to optimize the inaudible adversarial perturbation. Figure 4 This is a schematic diagram of the acoustic masking effect. A single tone signal in a quiet environment can only be perceived by the human ear if its sound pressure level is higher than the absolute hearing threshold curve. At this time, the hearing threshold curve around the single tone (masking sound) will expand to a larger frequency band coverage range, resulting in other low sound pressure level signals (masked sounds) in adjacent frequency bands being submerged in the inaudible domain and cannot be perceived by the human ear. Based on this principle, the counter-perturbation is regarded as a masked sound below the hearing threshold curve of the original speech to achieve the imperceptibility of the counter-perturbation. First, the original speech x is short-time Fourier transformed and its logarithmic amplitude spectrum S is calculated. xFor each frame in the spectrum, find the frequency band with the local maximum sound pressure level as the masking sound and calculate the local masking threshold according to the propagation function. These local masking thresholds are spliced ​​frame by frame to obtain the global masking threshold spectrum H x , and then use a difference constraint to limit the hearing sense:

[0054]

[0055] Where S δ is the logarithmic amplitude spectrum of the adversarial perturbation, and k limits the maximum difference between the perturbation spectrum and the global masking threshold. Through this constraint, the adversarial perturbation can be forced to fall below the masking threshold during the optimization process and thus become inaudible to the human ear.

[0056] In order to verify the effectiveness of the present invention, experiments were conducted on the large-scale corpus LibriSpeech, which contains 100 hours of English speech from 251 speakers, covering different accents, occupations and ages. Among them, the length of each speech is from several seconds to tens of seconds, and the sampling rate is 16kHz. 50 speakers (25 males and 25 females) were randomly selected as users, and 3 sentences of each person were registered to the automatic speaker recognition system, while the remaining 5413 sentences were used to test the recognition performance of the automatic speaker recognition system and construct adversarial samples. In addition, the other 201 speakers were used to pre-train the conditional variational autoencoder at the embedding code level to generate target speaker samples. Multiple mainstream speaker recognition models were implemented as target systems, including D-Vector, DeepSpeaker, X-Vector and Ecapa-TDNN, which have different feature extractors, network structures and parameter settings. After testing the sentences of 50 speakers, the equal error rates of the four speaker recognition systems were 8.05%, 7.11%, 5.42% and 1.25%, respectively, reflecting excellent recognition performance. According to the triplet loss function and acoustic masking constraints, the gradient descent method is used to optimize the adversarial perturbation, with the default settings of γ = 0.1, k = 0, α = 0.1, and the learning rate η = 0.001. The following indicators are used to evaluate the performance of the present invention:

[0057] 1) Decryption success rate (DSR): X and Y are the number of samples with successful anonymization and the total number of test samples, respectively. The higher the DSR, the better the anonymity performance.

[0058] 2) Word Error Rate (WER): Where N is the number of words in the sentence, S, D and I are the number of replaced, deleted and inserted words in the transcribed text compared to the real text, respectively. The lower the WER, the more accurate the speech recognition result.

[0059] 3) Mean Opinion Score (MOS): A quantitative indicator of human subjective judgment of sound quality, with a value range of 1 to 5. The higher the MOS, the better the sound quality.

[0060] 4) Perceptual Evaluation of Sound Quality (PESQ): An objective sound quality evaluation indicator specified by the ITU-T standard, which uses PESQMOS-LQO to map to scores between 1.02 and 4.56.

[0061] 5) Real-time ratio (RTR): Where T p and T d The RTR is the processing time and length of a speech segment respectively. An RTR below 1 is considered real time.

[0062] The effectiveness of speaker anonymity and the usability evaluation of voice services. We randomly sampled different target speaker embedding codes, generated 5413 adversarial samples for each speaker recognition system on the corpus of 50 speakers, and then input them into these speaker recognition systems and an end-to-end speech recognition system for testing. Table 1 shows the protection success rate and word error rate of the present invention on the latest speaker recognition model:

[0063] Table 1 Protection success rate and word error rate of the present invention on the latest speaker recognition model

[0064]

[0065] It can be seen that the present invention achieves a DSR of 96% to 100% on four speaker recognition systems, and a WER of less than 7.5%, which proves the effectiveness of the present invention in deceiving the speaker recognition system for identity anonymization and has little impact on the text content.

[0066] Non-intrusiveness evaluation. Subjective and objective experiments were conducted to evaluate the non-intrusiveness of the present invention. In the objective experiment, 1126 adversarial samples from 10 users (4 males and 6 females) were randomly selected for PESQ testing. In the subjective experiment, 30 volunteers (16 males and 14 females, aged 18 to 35) were recruited to participate in the MOS test. Each volunteer listened to 200 pairs of original speech and adversarial samples and then recorded the similarity scores of the two in terms of text, voiceprint and sound quality. Figure 5 The figure is a comparison of subjective and objective evaluation quality of different speaker adversarial samples. It can be seen that the present invention has achieved a PESQ score of more than 4.0 on the voices of all users, indicating that the speaker anonymity operation of the present invention produces less signal distortion. In addition, the average MOS scores of text, voiceprint and sound quality are 4.69, 4.67 and 4.34 respectively, proving that the present invention retains text integrity, voiceprint consistency and good perceived sound quality.

[0067] Adaptive evaluation. The adaptability of the present invention is verified on three different types of attacks, which have different degrees of prior knowledge about the anonymity mechanism of the present invention: 1) Uninformed attack: The attacker is unaware of the anonymity mechanism of the present invention and directly performs speaker recognition on the anonymized speech. 2) Semi-informed attack: The attacker knows the anonymity mechanism of the present invention but is not clear about the specific parameter configuration and implementation details, so he attempts to destroy the adversarial perturbation through some signal processing means (such as bandpass filtering, re-quantization, and re-Mel transform). 3) Informed attack: The attacker is fully aware of the anonymity mechanism and specific implementation of the present invention, so the same anonymization processing is performed on the registered set speech to achieve de-anonymization. Figure 6 The following is a comparison chart of the protection success rate under different attack settings. Compared with the DSR of more than 95% under uninformed attacks, the DSR of the present invention on the four speaker recognition systems under semi-informed attacks only decreased by 7.42% on average, while under the most difficult informed attacks, the present invention still maintained DSRs of 87.58%, 91.66%, 82.93% and 86.38 on the four speaker recognition systems, respectively, reflecting the excellent adaptability of the present invention to semi-informed and informed attacks.

[0068] Transferability evaluation. The transferability of the present invention is verified on an unknown black box model. In each experiment, one of the four speaker recognition systems is selected as a replacement model, and the remaining three are used as target models for transfer experiments, and so on to obtain 12 independent transfer experiments. Figure 7 The figure is a comparison of transferability on different speaker recognition models. It can be seen that the DSR of the present invention on different substitute models and target models is between 48.07% and 85.03%. This is because a single substitute model can only provide limited knowledge for model migration. Therefore, ensemble learning is further applied to enhance the generalization ability of adversarial samples, that is, multiple speaker recognition systems are integrated as substitute models and one is reserved as the target model for migration experiments. Table 2 shows the protection success rate and word error rate of the present invention on the latest speaker recognition model after ensemble learning:

[0069] Table 2 Protection success rate and word error rate of the present invention on the latest speaker recognition model after ensemble learning

[0070]

[0071] It can be seen that the DSR of the present invention in the four integrated learning transfer experiments increased to 83.42%, 79.75%, 85.67% and 92.43% respectively, showing good migration performance. In addition, the speaker anonymity performance of the present invention was verified on the commercial systems iFLYTEK and Microsoft Azure, and these commercial systems were accessed through the HTTP API for user registration and speaker recognition testing. In each experiment, 3 sentences from 10 speakers (5 men and 5 women) were registered to the system, and the remaining more than 1,100 sentences were used to generate adversarial samples. All four speaker recognition systems were used as alternative models for integrated learning, and then the generated adversarial samples were directly migrated to the commercial system for testing. Table 3 shows the protection success rate of the present invention on different commercial systems after integrated learning:

[0072] Table 3 Protection success rate of the present invention on different commercial systems after integrated learning

[0073]

[0074] It can be seen that iFLYTEK and Microsoft Azure achieved 2.16% and 0% equal error rates on normal speech, showing strong speaker recognition performance. After anonymization, the present invention achieved 71.02% and 64.35% DSR on these two commercial systems, respectively, proving the effectiveness of the present invention for commercial systems.

[0075] Finally, it should be noted that the above examples are only specific embodiments of the present invention. Obviously, the present invention is not limited to the above examples, and there are many variations. All variations that can be directly derived or associated with the content disclosed by ordinary technicians in this field should be considered as the protection scope of the present invention.

Claims

1. A non-invasive adaptive speaker anonymity system based on adversarial samples, characterized in that: The system includes a diverse target speaker generation module, an any-to-any adversarial perturbation construction module and an imperceptible adversarial perturbation optimization module. The diverse target speaker generation module generates a target speaker embedding code on demand according to an input target tag. The any-to-any adversarial perturbation construction module constructs an adversarial perturbation according to the input target speaker embedding code, constructs a triplet according to the target speaker embedding code and the user source voice embedding code input therein, and uses a Triplet architecture to iteratively construct an adversarial perturbation so that the adversarial sample in the speaker latent space is biased toward the target speaker and away from the original user; the imperceptible adversarial perturbation optimization module further optimizes the input adversarial perturbation to obtain an adversarial perturbation that is imperceptible to the human ear, and the adversarial perturbation that is imperceptible to the human ear is superimposed on the user source voice to generate a final adversarial sample.

2. A non-invasive adaptive speaker anonymity method based on adversarial samples, characterized in that: The method comprises the following steps: 1) The diverse target speaker generation module uses the embedding code level conditional variational autoencoder to learn the distribution of speaker embedding codes, samples latent variables in the speaker latent space according to the target label of the target speaker, and generates the target speaker embedding code through a pre-trained decoder; 2) The obtained target speaker embedding code is input into an arbitrary-to-arbitrary adversarial perturbation construction module, wherein the arbitrary-to-arbitrary adversarial perturbation construction module constructs a triplet according to the target speaker embedding code and the user source speech embedding code input therein, and uses the Triplet architecture to iteratively construct adversarial perturbations so that the adversarial samples in the speaker latent space are biased toward the target speaker and away from the original user; 3) The obtained adversarial disturbance is input into the imperceptible adversarial disturbance optimization module, and the acoustic masking effect is applied to optimize the imperceptibility of the disturbance. By hiding the adversarial disturbance in the inaudible domain, signal distortion is reduced and high speech quality is retained, thereby obtaining an adversarial disturbance that is imperceptible to the human ear; Finally, the adversarial perturbations generated by the above steps are superimposed on the user's source speech to form an adversarial sample. The sample will be identified as a different target speaker through automatic speaker recognition, and will still output the correct transcription text when input into the automatic speech recognition system, while maintaining good consistency in voiceprint, text, and sound quality.

3. The non-invasive adaptive speaker anonymity method based on adversarial samples according to claim 2, characterized in that: In the step 1), the embedded code level conditional variational autoencoder is a deep neural network with an encoder-decoder architecture, including an extractor, an encoder and a decoder.

4. The non-invasive adaptive speaker anonymity method based on adversarial samples according to claim 3, characterized in that: The specific workflow of the embedding code level conditional variational autoencoder is divided into two stages: pre-training and generation: The pre-training phase described: 1) The input is the speech data of multiple speakers. The extractor converts these speech into MFCC features in the frequency domain and learns the local local features and context information of the speech through the TDNN layer and the ResBlock layer. Then, the StatPooling layer is used to extract the fixed-length voiceprint embedding code and input it into the encoder; 2) The encoder explicitly modulates the one-hot encoding y of the target speaker label into the voiceprint embedding code x, then reduces the dimension of the voiceprint embedding code x through multiple downsampling sub-blocks, and then uses two linear network layers to model its mean μ and standard deviation σ; according to the assumption of variational inference, the latent vector z learned by the encoder conforms to the Gaussian distribution: The latent vector z is sampled from it by the re-parameterization technique: z = μ + σ⊙∈, where ∈ is a random variable that conforms to the standard Gaussian distribution; 3) The sampled latent vector z is concatenated with the one-hot encoding y of the target speaker label and input into the decoder. After being transformed by the linear network layer, a new embedded code x' is reconstructed through multiple upsampling sub-blocks; 4) Finally, the entire conditional variational autoencoder model is trained with a mean square error term and a KL divergence regularization term: The first term limits the reconstruction deviation of the output embedded code, the second term forces the latent space to be approximately Gaussian, and the parameter β is used to balance the reconstruction quality of the embedded code and the continuity of the latent space distribution. The generation phases described are: Through the pre-trained embedding code level conditional variational autoencoder, diverse target speaker embedding codes are generated through three methods: input reconstruction, latent space sampling and semantic interpolation.

5. The non-invasive adaptive speaker anonymity method based on adversarial samples according to claim 2, characterized in that: The specific process of step 2) is as follows: the user source speech embedding code is regarded as a negative sample n, the target speaker embedding code is regarded as a positive sample p, and the adversarial sample is regarded as the anchor sample a to be optimized, and the three form a triplet<a,p,n> , the distance between positive and negative samples and anchor samples in the latent space is quantified by the distance metric function D(·), and the anchor samples are forced to deviate from negative samples and bias towards positive samples by optimizing the following objective function: According to the objective function, the gradient descent method is used for iterative optimization to generate adversarial perturbations that are maximally close to the target speaker and far away from the source speaker.

6. The non-invasive adaptive speaker anonymity method based on adversarial samples according to claim 2, 4 or 5, characterized in that: The specific steps of step 3) are: 1) Perform short-time Fourier transform on the user source speech x and calculate its logarithmic amplitude spectrum S x ; 2) For each frame in the logarithmic magnitude spectrum, find the frequency band with the local maximum sound pressure level as the masking sound and calculate the local masking threshold according to the propagation function; 3) All local masking thresholds are spliced ​​frame by frame to obtain the global masking threshold spectrum H x ; 4) The auditory sense is restricted by introducing the following difference constraint regularization in the objective function: Where S δ is the logarithmic amplitude spectrum of the adversarial disturbance, k limits the maximum difference between the disturbance spectrum and the global masking threshold, and the parameter γ is used to adjust the weight of the hearing threshold limit. The adversarial disturbance optimized by this module is difficult to be perceived by the human ear and is superimposed on the user source voice to generate the final adversarial sample.

Images