ASR Encoder Canary Auditing for Unintended Memorization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Automated speech recognition (ASR) models unintentionally memorize sensitive training data, leading to privacy leaks and vulnerabilities to privacy attacks, which existing techniques like differential privacy and gradient clipping fail to adequately address without compromising model performance.
Innovation Solution
Pre-train audio encoders on un-transcribed speech utterances and synthetic training canary speech utterances using a text-to-speech system, applying sensitivity-bounded training with per-example gradient clipping and a novel loss function that uses word-level masks, and audit unintended memorization through contrastive learning.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If ASR models are trained on large datasets to improve accuracy, then transcription accuracy improves, but unintended memorization of sensitive data increases
Solution Approach 1:
The patent applies sensitivity-bounded training with per-example gradient clipping during the pre-training phase to proactively prevent memorization before it occurs. By bounding the gradient norm for each training example during backpropagation, the model learns general speech patterns without memorizing specific sensitive utterances, thus preventing privacy leaks before deployment
Solution Approach 2:
The patent introduces synthetic canary speech utterances as an intermediary mechanism to detect and measure unintended memorization. These canary utterances, which are out-of-distribution from the main training data, serve as probes to audit whether the model has memorized sensitive information, allowing developers to identify and mitigate privacy risks
2Object-affected harmful factors
If differential privacy techniques are applied to prevent memorization, then privacy protection improves, but model performance deteriorates
Solution Approach 1:
The patent changes the training parameter regime by applying per-example gradient clipping with a bounded gradient norm rather than using traditional differential privacy noise injection. This parameter change allows the model to maintain better convergence and performance while still providing privacy guarantees through the gradient bounding mechanism, avoiding the severe performance degradation associated with DP-SGD
3Object-affected harmful factors
If gradient clipping is applied to reduce memorization, then privacy protection improves, but training stability worsens
Solution Approach 1:
The patent applies gradient clipping as a preliminary action during the pre-training phase before the model is deployed. By bounding gradients early in the training process, the model learns robust features without memorizing sensitive data, and this preventive measure stabilizes training by preventing gradient explosion while maintaining privacy protection
Solution Approach 2:
The patent maintains continuous useful action by ensuring that gradient clipping operates consistently throughout training without disrupting the learning process. The bounded gradient norm allows training to proceed smoothly with stable convergence, preventing both memorization and training instability
Data Source
AI summary
A method includes receiving a training data set including un-transcribed speech utterances that each include audio-only data not paired with any corresponding transcription, and obtaining a plurality of training canary transcriptions each including a predetermined number of words that are out-of-distribution from words of the un-transcribed speech utterances. For each training canary transcription, the method also includes generating, using TTS system, a corresponding synthetic training canary speech utterance that recites the predetermined number of words of the training canary transcription and pre-training an audio encoder on a combination of the un-transcribed speech utterances and the synthetic training canary speech utterances. The method also includes measuring an un-intended memorization of the pre-trained audio encoder based on encoder labels predicted by the pre-trained encoder for the synthetic training canary speech utterances.