Convolutional adversarial sample construction method and device for voice identity anonymity
By constructing convolutional adversarial examples and optimizing speech adversarial examples using real room impulse response and conditional variational autoencoders, the intrusiveness and robustness issues of existing speech identity anonymization systems are solved, achieving high-quality speech anonymization.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- ZHEJIANG UNIV
- Filing Date
- 2022-10-20
- Publication Date
- 2026-04-14
AI Technical Summary
Existing voice identity anonymization systems that utilize speech conversion, speech synthesis, or additive adversarial sample techniques are highly invasive and have low robustness. They are not suitable for voice interaction scenarios with human audiences present, such as instant messaging and social media, and are easily eliminated by carefully designed filters.
A convolutional adversarial example construction method is adopted. The convolutional adversarial perturbation is initialized with real room impulse response signals. Combined with the conditional variational autoencoder at the embedding code level and the gradient adversarial example construction method, the speech adversarial examples are optimized to achieve directional identity embedding code transformation. The natural reverberation effect is simulated by regularizing the difference in real room impulse response, thus preserving speech quality.
It achieves non-invasive voice identity anonymity, maintains the integrity of text content and voiceprint consistency, has good audio perception quality, and can resist the damage caused by common signal processing techniques, ensuring the robustness of voice identity anonymity.
Smart Images
Figure CN115631757B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of voice privacy protection, specifically to a method and apparatus for constructing convolutional adversarial examples for voice identity anonymity. Background Technology
[0002] In recent years, voice input has become the most popular human-computer interaction method and is widely used in various intelligent services, providing users with a wealth of powerful functions such as automatic speech transcription, efficient voice search, and real-time language translation. However, the release of voice data poses potential privacy risks, which have intensified with the popularization of voice services, thus attracting widespread public attention. Voice service providers' collection, storage, and even misuse of voice data expose users to various privacy and security threats, such as personal identity leaks based on automatic content recognition, targeted advertising based on user profiles, and even identity impersonation based on voiceprint cloning.
[0003] Faced with the dilemma of voice service functionality and personal identity privacy, existing research on voice anonymization mainly focuses on eliminating individual voiceprint features while preserving textual semantic information through speech conversion and speech synthesis, thereby supporting privacy-preserving voice services. Most of these works follow the speech conversion paradigm, hiding the user's real voiceprint by modifying acoustic features or transforming speaker embedding codes. Other studies propose resynthesizing speech without any effective voiceprint features based on text to maximize identity privacy. While these works have effectively explored user identity privacy protection in speech, this intrusive approach of direct modification and resynthesis produces inconsistent voiceprints and severe distortion, affecting the perceptual quality of anonymized speech and making it unsuitable for voice interaction scenarios with human audiences, such as instant messaging and social media. Other works utilize acoustic masking effects to inject imperceptible additive adversarial perturbations for voice anonymization, but these perturbations are easily eliminated by carefully designed filters, exhibiting low resistance to transformation.
[0004] Therefore, existing voice identity anonymization systems that use speech conversion, speech synthesis, or additive adversarial sample techniques to protect user identity information tend to be highly invasive and have low robustness. Summary of the Invention
[0005] This invention addresses the shortcomings of existing technologies by providing a method and apparatus for constructing convolutional adversarial examples for voice identity anonymization. This invention is implemented using the following technical solution:
[0006] A method for constructing convolutional adversarial examples for voice identity anonymization includes:
[0007] Obtain the user's original voice sample and at least one real room impulse response (RIR) signal;
[0008] Initialize convolutional adversarial properties using the obtained real room impulse response signal;
[0009] The obtained original user speech samples are convolved with convolutional adversarial perturbations to obtain the initial adversarial speech samples.
[0010] Randomly select labels of the target category and sample speaker embedding codes using a conditional variational autoencoder at the embedding code level;
[0011] Based on the initial adversarial speech samples, and with the sampled speaker embedding code as the target, the adversarial speech samples are iteratively optimized using a gradient-based adversarial sample construction method to achieve directional identity embedding code transformation.
[0012] Speech adversarial samples are optimized by regularizing the difference between convolutional adversarial perturbations and real room impulse responses to simulate natural reverberation effects and preserve high speech quality.
[0013] The resulting anonymized adversarial speech sample contains the target speaker's identity embedding code while preserving the original voiceprint, text, and sound quality.
[0014] As a further improvement, the method of performing a convolution operation between the obtained original user speech samples and the convolutional adversarial perturbation to obtain initial adversarial speech samples specifically includes:
[0015] The convolutional adversarial perturbation δ′ is initialized using the real room impulse response signal δ, and then the user's original voice x is used. s Convolution with convolutional adversarial perturbation δ′ yields adversarial speech samples:
[0016] x s ′=x s *δ′
[0017] Based on the properties of convolution operations, we have:
[0018] FFT(x s ′)=FFT(x s )×FFT(δ′)
[0019] Therefore, temporal convolution is equivalent to frequency domain multiplication. This convolutional property, which is adversarial to perturbation, is essentially a filter that can determine the importance of different frequency components. Thus, it can modify the voiceprint features and achieve the function of speech anonymity.
[0020] As a further improvement, the conditional variational autoencoder (CVAE) at the embedding code level of this invention samples the speaker embedding code, specifically as follows:
[0021] The embedded code-level conditional variational autoencoder adopts an encoder-decoder architecture;
[0022] The encoder receives the one-hot encoding of the target category label. t and the original speaker embedding code v s As input, it is then dimensionality reduced through multiple downsampling network layers, and its mean μ and standard deviation σ are modeled using two parallel linear network layers;
[0023] Construct a latent vector z using the reparameter technique: z = μ + σ⊙∈, where ∈ is a random variable that conforms to a standard Gaussian distribution;
[0024] The constructed latent vector z and the one-hot encoding y of the speaker label t After being concatenated, the code is input into the decoder, transformed by a linear network layer, and then reconstructed through multiple upsampling network layers to obtain a new embedding code v. s ′;
[0025] This conditional variational autoencoder is trained using the following objective function:
[0026]
[0027] Where β is the weighting parameter, and KL(·) is the Kullback-Leibler divergence;
[0028] By using a pre-trained decoder, diverse speaker embedding codes that match the target identity can be generated.
[0029] As a further improvement, the gradient-based adversarial example construction method of this invention is used to iteratively optimize speech adversarial examples to achieve targeted identity embedding code transformation, specifically including:
[0030] The gradient-based adversarial sample construction method aims at the sampled speaker embedding code and iteratively optimizes the speech adversarial sample so that it tends to the target speaker embedding code in the latent space.
[0031] Inputting the adversarial speech sample into the speaker recognition system f(·) yields the adversarial speech sample embedding code f(x). s ′);
[0032] Based on the randomly selected target category label y t The target speaker embedding code d(y) is sampled by the decoder d(·) of the conditional variational autoencoder. t );
[0033] The speech adversarial sample embedding code f(x) is quantized using the distance function D(·). s ′) and target speaker embedding code d(yt The distance in the latent space is used to force the speech adversarial example embedding code to be biased towards the target speaker's embedding code, thereby generating adversarial examples that are as close as possible to the target's identity:
[0034]
[0035] The objective function is iteratively optimized using the gradient descent method. By constructing relevant inputs, it enables arbitrary identity transformation, allowing any original user to impersonate a different set of target identities, further increasing the difficulty of identity detection in the automatic speaker recognition system.
[0036] As a further improvement, the regularized penalty for the difference between the adversarial room impulse response and the real room impulse response optimizes the adversarial speech samples, simulating a natural reverberation effect to preserve high speech quality. Specifically, this includes:
[0037] To ensure that the convolutional adversarial perturbation approximates the real room impulse response signal, regularization is used to penalize the difference between the convolutional adversarial perturbation and the real room impulse response, ||δ′-δ||.
[0038] The optimized convolutional adversarial perturbation approximates the real room impulse response and is perceived as reverberation by the human ear, thus achieving the stealth of the speech anonymity system.
[0039] This invention also discloses a convolutional adversarial example construction device for voice identity anonymization, comprising:
[0040] Convolutional perturbation initialization module: Initializes convolutional adversarial perturbation by obtaining the real room impulse response signal, and performs convolution operation between the obtained original user speech sample and the adversarial room impulse response to obtain the initial adversarial speech sample;
[0041] Diverse Embedded Code Generation Module: Randomly selects labels of the target category and samples speaker embedded codes through a conditional variational autoencoder at the embedded code level;
[0042] Arbitrary to arbitrary identity transformation module: Based on the initial adversarial speech samples, and with the sampled speaker embedding code as the target, the module iteratively optimizes the adversarial speech samples using a gradient-based adversarial sample construction method to achieve directional identity embedding code transformation.
[0043] Perturbation concealment optimization module: Optimizes adversarial speech samples by regularizing the difference between convolutional adversarial perturbations and the real room impulse response, simulating natural reverberation effects to preserve high speech quality.
[0044] The beneficial effects of this invention are as follows:
[0045] 1) Non-intrusive voice identity anonymity. This invention designs convolutional adversarial perturbations to approximate realistic and natural room impulse responses, which can effectively reduce signal distortion caused by perturbation injection, ensure the integrity of text content and the consistency of voiceprints, as well as good audio perception quality, and achieve a balance between privacy and functionality in voice services.
[0046] 2) Robust voice identity anonymity. The convolutional adversarial perturbation proposed in this invention can effectively resist common adversarial perturbation and destruction methods based on signal processing techniques, ensuring that voice identity anonymity remains effective under audio distortion conditions or perturbation and destruction effects. Attached Figure Description
[0047] Figure 1 This is a system framework diagram of the present invention;
[0048] Figure 2 Example diagram of room impulse response;
[0049] Figure 3 A comparison of objective metrics for different voice identity anonymization methods;
[0050] Figure 4 A comparison of subjective metrics for different voice identity anonymization methods;
[0051] Figure 5 Examples include the original audio, audio with normal RIR, and audio with adversarial RIR. Detailed Implementation
[0052] The technical solution of the present invention will be further described below with reference to the accompanying drawings and specific embodiments:
[0053] The purpose of this invention is to address the security problem of voice data identity privacy leakage. It proposes a method for constructing convolutional adversarial examples for voice identity anonymity. The device for implementing this method includes a microphone and a processor. Figure 1 This is a data flow diagram of the present invention;
[0054] The specific implementation method of the present invention is as follows:
[0055] Step 1: When the microphone receives the user's raw voice, it transmits the raw voice to the processor, and simultaneously transmits at least one Real Room Impulse Response (RIR) signal to the processor. In this embodiment, it is one RIR signal. Figure 2 The room impulse response example diagram is shown. The room impulse response signal was obtained through ESS (Exponential Sweep Sine) measurement.
[0056] Step 2: The processor initializes the convolutional adversarial perturbation using the obtained real room impulse response signal. The obtained original user speech sample is convolved with the convolutional adversarial perturbation to obtain the initial adversarial speech sample. Specifically, the convolutional adversarial perturbation δ′ is initialized using the real room impulse response signal δ, and then the original user speech sample x is... s Convolution with convolutional adversarial perturbation δ′ yields adversarial speech samples:
[0057] x s ′=x s *δ′
[0058] Based on the properties of convolution operations, we have:
[0059] FFT(x s ′)=FFT(x s )×FFT(δ′)
[0060] Therefore, temporal convolution is equivalent to frequency domain multiplication. This convolutional property, which is adversarial to perturbation, is essentially a filter that can determine the importance of different frequency components. Thus, it can modify the voiceprint features and achieve the function of speech anonymity.
[0061] Step 3: The processor randomly selects labels for the target category and samples a diverse batch of speaker embedding codes using an embedding code-level conditional variational autoencoder. This embedding code-level conditional variational autoencoder employs an encoder-decoder architecture: the encoder receives the one-hot encoded y of the target category label. t and the original speaker embedding code v s As input, the data is then reduced in dimensionality through multiple downsampling network layers, and its mean μ and standard deviation σ are modeled using two parallel linear network layers. A latent vector z is constructed using the reparameter technique: z = μ + σ⊙∈, where ∈ is a random variable conforming to a standard Gaussian distribution. The constructed latent vector z is then compared with the one-hot encoding y of the speaker label. t After being concatenated, the code is input into the decoder, transformed by a linear network layer, and then reconstructed through multiple upsampling network layers to obtain a new embedding code v. s The conditional variational autoencoder is trained using the following objective function:
[0062]
[0063] Where β is the weight parameter and KL(·) is the Kullback-Leibler divergence; through the pre-trained decoder, diverse speaker embedding codes that conform to the target identity can be generated;
[0064] Step 4: Based on the initial adversarial speech samples, and using the sampled speaker embedding code as the target, iteratively optimize the adversarial speech samples using a gradient-based adversarial sample construction method. This optimizes the samples to converge towards the target speaker embedding code in the latent space, achieving a directional identity embedding code transformation. Specifically, the adversarial speech samples are input into the voiceprint recognition system f(·) to obtain the adversarial speech sample embedding code f(x). s ′); based on the label y of the randomly selected target category t The target speaker embedding code d(y) is sampled by the decoder d(·) of the conditional variational autoencoder. t ); The speech adversarial sample embedding code f(x) is quantized using the distance function D(·). s ′) and target speaker embedding code d(y t The distance in the latent space is used to force the speech adversarial example embedding code to be biased towards the target speaker's embedding code, thereby generating adversarial examples that are as close as possible to the target's identity:
[0065]
[0066] The objective function is iteratively optimized using the gradient descent method. By constructing the relevant input, it achieves arbitrary identity transformation, allowing any original user to disguise themselves as a set of different target identities, further increasing the identity detection difficulty of the automatic speaker recognition system.
[0067] Step 5: Optimize the adversarial speech examples by regularizing the difference between the convolutional adversarial perturbation and the real room impulse response to simulate a natural reverberation effect and preserve high speech quality. To ensure that the convolutional adversarial perturbation approximates the real room impulse response signal, regularization is used to penalize the difference ||δ′-δ|| between the convolutional adversarial perturbation and the real room impulse response. This regularization term is added to the objective function of the speech adversarial example optimization for multi-task training. The optimized convolutional adversarial perturbation approximates the real room impulse response and is perceived as reverberation by the human ear, thereby achieving the stealth of the speech anonymization system.
[0068] The resulting anonymized adversarial speech sample contains the target speaker's identity embedding code while preserving the original voiceprint, text, and sound quality.
[0069] This invention also discloses a convolutional adversarial example construction device for voice identity anonymization, comprising:
[0070] Convolutional perturbation initialization module: Initializes convolutional adversarial perturbation by obtaining the real room impulse response signal, and performs convolution operation between the obtained original user speech sample and the adversarial room impulse response to obtain the initial adversarial speech sample;
[0071] Diverse Embedded Code Generation Module: Randomly selects labels of the target category and samples speaker embedded codes through a conditional variational autoencoder at the embedded code level;
[0072] Arbitrary to arbitrary identity transformation module: Based on the initial adversarial speech samples, and with the sampled speaker embedding code as the target, the module iteratively optimizes the adversarial speech samples using a gradient-based adversarial sample construction method to achieve directional identity embedding code transformation.
[0073] Perturbation concealment optimization module: Optimizes adversarial speech samples by regularizing the difference between convolutional adversarial perturbations and the real room impulse response, simulating natural reverberation effects to preserve high speech quality.
[0074] This invention discloses a method and apparatus for constructing convolutional adversarial examples for voice identity anonymization. The anonymized adversarial speech examples generated through the above four modules will be identified as different target speakers by an automatic speaker recognition system, while still outputting the correct transcribed text when input into the automatic speech recognition system, maintaining good consistency in terms of voiceprint, text, and sound quality.
[0075] To verify the effectiveness of this invention, experiments were conducted on the test set of the large-scale corpus LibriSpeech. This dataset contains 2189 English speech recordings from 40 speakers (20 men and 20 women), covering different accents, occupations, and ages. Each speech recording ranges in length from several seconds to tens of seconds, with a sampling rate of 16kHz. Several mainstream speaker recognition models were implemented as the target system, including D-Vector, DeepSpeaker, X-Vector, and Ecapa-TDNN, which have different feature extractors, network structures, and parameter settings. Based on the adversarial example loss function and room impulse response constraints, a gradient descent method was used to optimize the convolutional adversarial perturbation, with a default learning rate η = 0.001. The performance of this invention was evaluated using the following metrics:
[0076] 1) Anonymity Success Rate (DSR): Where X and Y are the number of samples that were successfully anonymized and the total number of test samples, respectively. The higher the DSR, the better the anonymization performance.
[0077] 2) Word accuracy (WA): Where N is the number of words in the sentence, C is the number of correct words in the transcribed text, I is the number of inserted words in the transcribed text compared to the original text, and the higher WA is, the more accurate the speech recognition result.
[0078] 3) Mel reciprocal distortion (MCD): Where mc r and mc tThese are the Mel-frequency cepstral coefficients (MCDs) of the reference speech and the speech to be tested, respectively. The smaller the MCD, the less distortion of the audio signal.
[0079] 4) Mean Opinion Score (MOS): A quantitative indicator of human subjective judgment of sound quality, with a value range between 1 and 5. The higher the MOS, the better the sound quality.
[0080] Anonymity effectiveness and speech usability were objectively evaluated. Different target speaker embedding codes were randomly sampled, and 2819 adversarial examples were generated for each speaker recognition system on a corpus of 40 speakers. These examples were then input into these speaker recognition systems and an end-to-end speech recognition system for testing. Table 1 shows the anonymity success rate, word accuracy, and Mel-Cepstral distortion of this invention on state-of-the-art speaker recognition models.
[0081] Table 1. Anonymity success rate, word accuracy, and Mel-Cepstral distortion of this invention on the latest speaker recognition model.
[0082]
[0083] It can be seen that the DSR of the four speaker recognition systems on the original speech is only 1% to 8%, demonstrating excellent recognition performance. However, after the speech anonymization of this invention, the DSR of all systems reaches over 98.5%, indicating the effectiveness of the anonymization of this invention. Compared to the WA of 97% on the original speech, the WA of the anonymized speech remains between 93% and 96%, proving that the anonymization operation of this invention has little impact on the text content of the speech. In addition, the MCD of the anonymized speech is between 3.8dB and 5.5dB, which also proves that the audio distortion introduced by the convolutional perturbation is small.
[0084] Furthermore, this invention is compared with cutting-edge voice identity anonymization methods in the field. For example... Figure 3 This paper compares the objective metrics of different voice anonymization methods, where VoiceMask is a signal processing-based speech conversion method, Disentangle-VC is a deep learning-based speech conversion method, and PGD is an additive adversarial example method. It can be seen that VoiceMask and Disentangle-VC exhibit significantly greater word accuracy degradation and Mel-Cepstral distortion than the other two adversarial example methods. This is because they use highly intrusive speech conversion methods, resulting in severe signal distortion. PGD shows the smallest word accuracy degradation but produces unacceptable Mel-Cepstral distortion, which is a result of high-frequency and high-energy additive noise. In contrast, this invention can simultaneously achieve a smaller word accuracy degradation and Mel-Cepstral distortion, effectively preserving the speech text content and perceptual quality.
[0085] Subjective evaluation of anonymity effectiveness and voice usability. In addition to objective metrics, subjective experiments were conducted to evaluate the anonymity effectiveness and voice usability of the invention. In the subjective experiments, 50 volunteers (28 men and 22 women, aged 18 to 53) were recruited to participate in the MOS test. Each volunteer listened to 10 pairs of original speech and anonymized speech using four different voice identity anonymization methods, and then the similarity between the two in terms of voiceprint, text, and sound quality was recorded. Figure 4 A comparison of subjective metrics for different voice identity anonymization methods reveals that all four methods exhibit high text MOS (Mutually Spoken Morphology), while VoiceMask and Disentangle-VC methods perform poorly in terms of voiceprint and sound quality due to deficiencies in speech conversion. On the other hand, PGD and the present invention perform well in terms of voiceprint and text, but the present invention significantly outperforms the PGD method in sound quality, demonstrating the superiority of convolutional adversarial perturbations over additive adversarial perturbations. These results collectively demonstrate that the present invention can effectively preserve text integrity, voiceprint consistency, and good perceived sound quality.
[0086] like Figure 5 Examples of the original audio, audio with normal RIR, and audio with adversarial RIR are provided to visually demonstrate the non-invasive anonymization effect of this invention. Compared to the waveform of the original audio, the waveform of the audio with normal RIR after air propagation shows a significant change; however, in terms of the spectrum, the spectrum of the audio with normal RIR after air propagation remains similar to the original speech, with only some frequency band drift caused by multipath effects. Similar results can be observed in the waveform and spectrum of the audio with adversarial RIR. The finding that the waveforms and spectra of the audio with normal RIR and adversarial RIR are very similar indicates that the convolutional adversarial perturbation of this invention successfully approximates the real-world room impulse response.
[0087] Robustness Assessment. To verify the robustness of the present invention, experiments were conducted on four signal processing-based adversarial perturbation techniques (bandpass filtering, weighting, Mel transform, and acoustic filtering). The parameters of these signal processing techniques were configured to minimize the impact of the automatic speaker recognition system and maximize the degree of adversarial perturbation: (1) Bandpass filtering: filtering out speech signals below 200Hz and above 7kHz; (2) Weighting: quantizing the 16-bit speech signal to 8-bit and then restoring it to 16-bit; (3) Mel transform: extracting 80-bin Mel cepstral coefficients from the speech signal and then restoring it to an audio signal using the Griffin-Lim algorithm; (4) Acoustic filtering: calculating the hearing range curve of the speech signal and filtering out the portion of the hearing range curve below 0dB. Table 2 shows the anonymization success rate of the present invention on normal speech and anonymized speech under signal processing-based adversarial perturbation techniques. It can be seen that the four signal processing methods can only affect part of the anonymity performance and sacrifice part of the performance of the automatic speaker recognition system. In particular, the anonymity success rate is still high on adversarial examples generated under stronger speaker recognition systems, which proves the robustness of the convolutional adversarial perturbation of the present invention.
[0088] Table 2. Anonymity success rate of the present invention under signal processing-based adversarial perturbation and disruption methods (no perturbation / with perturbation)
[0089]
[0090] The above are merely preferred embodiments of the present invention and are not intended to limit the present invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.
Claims
1. A method for constructing convolutional adversarial examples for voice identity anonymity, characterized in that, include: Obtain the user's original voice sample and at least one true room impulse response (RIR) signal; Initialize convolutional adversarial properties using the obtained real room impulse response signal; The obtained original user speech samples are convolved with convolutional adversarial perturbations to obtain the initial adversarial speech samples. The target category label is randomly selected, and the speaker embedding code is sampled by a conditional variational autoencoder (CVAE) at the embedding code level; Based on the initial adversarial speech samples, and with the sampled speaker embedding code as the target, the adversarial speech samples are iteratively optimized using a gradient-based adversarial sample construction method to achieve directional identity embedding code transformation. Speech adversarial samples are optimized by regularizing the difference between convolutional adversarial perturbations and real room impulse responses to simulate natural reverberation effects and preserve high speech quality. The resulting anonymized adversarial speech sample contains the target speaker's identity embedding code while preserving the original voiceprint, text, and sound quality.
2. The method for constructing convolutional adversarial examples for voice identity anonymization according to claim 1, characterized in that, The process of convolving the obtained original user speech samples with convolutional adversarial perturbations to obtain initial adversarial speech samples specifically includes: Through real room impulse response signals Initialize convolutional adversarial perturbation Then, the user's original voice Adversarial perturbation against convolution Convolution yields adversarial speech examples: ； Based on the properties of convolution operations, we have: ； Temporal convolution is equivalent to frequency domain multiplication. This convolutional property, which is adversarial to perturbation, is essentially a filter that determines the importance of different frequency components. It can modify voiceprint features and thus achieve the function of speech anonymity.
3. The method for constructing convolutional adversarial examples for voice identity anonymity according to claim 1, characterized in that, The aforementioned conditional variational autoencoder (CVAE) at the embedding code level samples the speaker embedding code, specifically as follows: The embedded code-level conditional variational autoencoder adopts an encoder-decoder architecture; The encoder receives the one-hot encoding of the target category label. and the original speaker embedding code As input, it is then passed through multiple downsampling network layers for dimensionality reduction, and its mean is modeled using two parallel linear network layers. and standard deviation ; Constructing latent vectors using reparameter remapping techniques in Let be a random variable that follows a standard Gaussian distribution; Constructed latent vectors One-hot encoding of speaker labels After being concatenated, the code is input into the decoder, transformed by a linear network layer, and then reconstructed through multiple upsampling network layers to obtain a new embedding code. ; This conditional variational autoencoder is trained using the following objective function: ； in, For weight parameters, The Kullback-Leibler divergence; A pre-trained decoder is used to generate diverse speaker embedding codes that match the target identity.
4. The method for constructing convolutional adversarial examples for voice identity anonymization according to claim 1, 2, or 3, characterized in that, The gradient-based adversarial example construction method is used to iteratively optimize speech adversarial examples to achieve targeted identity embedding code transformation, specifically including: The gradient-based adversarial sample construction method aims at the sampled speaker embedding code and iteratively optimizes the speech adversarial sample so that it tends to the target speaker embedding code in the latent space. Input adversarial speech examples into the voiceprint recognition system Obtain the speech adversarial sample embedding code ; Based on the randomly selected target category label Decoder via conditional variational autoencoder Sampling target speaker embedding code ; Through distance function Quantization of speech adversarial sample embedding codes Embedded code of the target speaker The distance in the latent space forces the speech adversarial sample embedding code to be biased towards the target speaker's embedding code, thereby generating adversarial samples that are as close as possible to the target identity. The adversarial samples are generated through the following objective function: ； The objective function is iteratively optimized using the gradient descent method. By constructing relevant inputs, it enables arbitrary identity transformation, allowing any original user to impersonate a different set of target identities, further increasing the difficulty of identity detection in the automatic speaker recognition system.
5. The method for constructing convolutional adversarial examples for voice identity anonymity according to claim 4, characterized in that, The regularized penalty convolutional adversarial perturbation is used to optimize the difference between the real room impulse response and the speech adversarial samples, simulating natural reverberation effects to preserve high speech quality. Specifically, this includes: To ensure that the convolutional adversarial perturbation approximates the real room impulse response signal, regularization is used to penalize the difference between the convolutional adversarial perturbation and the real room impulse response. ; The optimized convolutional adversarial perturbation approximates the real room impulse response and is perceived as reverberation by the human ear, thus achieving the stealth of the speech anonymity system.
6. A convolutional adversarial example construction device for voice identity anonymity, characterized in that, include: Convolutional perturbation initialization module: Initializes convolutional adversarial perturbation by obtaining real room impulse response signals, and performs convolution operation between the obtained original user speech samples and adversarial room impulse responses to obtain initial adversarial speech samples; Diverse Embedded Code Generation Module: Randomly selects labels of the target category and samples speaker embedded codes through a conditional variational autoencoder at the embedded code level; Arbitrary to arbitrary identity transformation module: Based on the initial adversarial speech samples, and with the sampled speaker embedding code as the target, the module iteratively optimizes the adversarial speech samples using a gradient-based adversarial sample construction method to achieve directional identity embedding code transformation. Perturbation concealment optimization module: Optimizes adversarial speech samples by regularizing the difference between convolutional adversarial perturbations and the real room impulse response, simulating natural reverberation effects to preserve high speech quality.