Redacting the transcript and anonymizing the speaker feels like the privacy work is done. It is not: the waveform is a biometric giving up age, accent, emotion, and clinical conditions from the signal — and it leaks hardest for the groups least seen in pretraining.
A team builds a product that records people talking. A medical-intake line, a support call, a research study, a voice agent that keeps audio to improve itself — the shape varies, the privacy reasoning does not. They know the audio is sensitive, so they do the work. The speech is transcribed; the transcript runs through a PII redactor that strikes the names, the dates of birth, the account numbers. For the retained audio they go one better and run a speaker-anonymization system — the kind the voice-privacy literature builds — that alters the voice so it no longer matches the speaker’s identity. The data-protection review looks at this and signs off. The words that named the person are gone. The voice that identified the person is disguised. The recording, the reasoning goes, has been de-identified.
It has not. What the team has done is scrub two channels — the lexical content and the speaker-identity fingerprint — out of a signal that carries a half-dozen more, and ship the rest. A party who obtains that “de-identified” audio, or in the worst case never needs the audio at all, can read the speaker’s age, their gender, their accent, their emotional state, and clinical conditions like a motor-speech disorder or Parkinson’s — directly from the waveform, after the transcript was redacted and the identity was anonymized, because none of those attributes was ever in the words or in the identity vector. And the cruelest part is structural: the attributes that leak the most reliably are the ones least represented in the model’s pretraining, which means the accents and conditions you would most want to protect are the easiest to profile.
This post is about why a voice recording is, for every purpose privacy cares about, a biometric that carries far more than its words — why content redaction and speaker anonymization both leave the paralinguistic channel fully intact, how far attribute inference now reaches, and what, short of not keeping the audio, actually narrows the exposure.
The mistake is a category error, and it is worth naming precisely, because it follows so naturally from how a voice pipeline is built.
Transcription is a projection. It is engineered to recover the lexical content — the words — and to throw away everything else: the pitch, the timing, the spectral texture, the breathiness, the tremor, the formant structure that encodes a vocal tract. Redacting a transcript operates on the output of that projection. It strikes the spans of text that name a person. By construction, the only thing a transcript redactor can touch is the thing transcription kept, which is the words. Everything transcription discarded — every acoustic property of the waveform — is untouched by anything you do to the transcript, because it was never in the transcript to begin with.
Now hold that next to what an end-to-end speech model consumes. It does not read the redacted transcript. It reads the audio — the waveform, or the self-supervised features derived from it — and those features preserve exactly the paralinguistic structure that transcription threw away. The conclusion is immediate. A redactor on the transcript removes the words that identify a person and leaves wholly intact a parallel set of channels that profile the person: how old they sound, what gender the voice projects, what accent shapes the vowels, what emotion colors the prosody, what a neurological condition does to their articulation. The redactor is not failing. It is doing precisely its job on the one channel it can see, and the attribute leak lives in the channels it cannot.
The disentanglement literature makes the multi-channel structure explicit rather than rhetorical. A general speaker-anonymization system, as described in Adapting General Disentanglement-Based Speaker Anonymization for Enhanced Emotion Preservation (arXiv 2408.05928), “typically separates speech into content, speaker, and prosody features using individual encoders” — three distinct streams, each its own encoder, and the method generalizes to “preserve other target paralinguistic attributes.” That is the architecture stating the premise out loud: the recording is not one signal but several independent attribute channels, and “redact the words” reaches exactly one of them.
The team’s second control was stronger than redaction, and it fails for a different reason worth isolating.
Speaker anonymization is built to defeat re-identification — to alter the voice so an adversary cannot match it back to a known speaker. That is a real and useful property. It is also a property about identity, and identity is not the same channel as attribute. VoxGuard: Evaluating User and Attribute Privacy in Speech via Membership Inference Attacks (arXiv 2509.18413) draws the line precisely, formalizing two distinct notions: User Privacy, “preventing speaker re-identification,” and Attribute Privacy, “protecting sensitive traits such as gender and accent.” They are different problems, and a system designed for the first does not deliver the second for free.
VoxGuard then measures the gap, and the measurement is blunt: “simple transparent attacks recover gender and accent with near-perfect accuracy even after anonymization.” Concretely, “pretrained embeddings combined with logistic regression achieve near-perfect separation of accent and gender on anonymized speech.” The voice has been disguised so it no longer matches the speaker — and a linear classifier on off-the-shelf embeddings still reads off the gender and the accent. Anonymization moved the identity and left the attributes sitting in plain view.
VoxGuard’s second contribution is methodological, and it matters for anyone who trusts a privacy metric. The field’s standard number is Equal Error Rate, and VoxGuard’s finding is that “EER substantially underestimates leakage.” A precision-oriented adversary — one operating in the low false-positive regime where real attacks live — is far stronger than the headline EER suggests. At enrollment length L = 200 a fine-tuned max-similarity attack reached a true-positive rate of 58.7% at a false-positive rate of 10⁻⁴, against an averaging baseline of only 1.2% at the same false-positive rate — more than an order of magnitude stronger at the operating point that counts. A reassuring EER is not evidence the recording is safe; it is evidence the wrong question was asked.
Emotion behaves the same way, and the anonymization literature concedes it directly. EASY: Emotion-aware Speaker Anonymization via Factorized Distillation (arXiv 2505.15004) observes that “most existing speaker anonymization systems employ parallel disentanglement methods, which only separate speech into linguistic content and speaker identity, often neglecting the preservation of the original emotional state.” Read that from the privacy side rather than the utility side: standard anonymization leaves the emotional state riding along untouched. Stripping affect is not something de-identification does as a side effect — EASY has to model emotion as a deliberate, distinct subspace, “modeling each speech attribute in distinct subspaces through a factorized distillation approach,” to handle it at all. Affect is its own biometric channel, separable from both the words and the identity, and the default pipeline leaves it on.
Everything above assumes an adversary holding the recording. The most uncomfortable result in this literature removes even that assumption.
Personal Attribute Leakage in Federated Speech Models (arXiv 2510.13357) studies the federated-learning setting, where the whole point is that raw speech never leaves the device — only model updates are shared. The paper mounts a white-box attribute-inference attack under a passive threat model in which “the attacker has no access to raw audio, transcripts, or metadata.” The attack “operates solely on weight differentials without access to raw speech from target speakers” — it reads sensitive attributes from nothing more than the difference between the global model and a speaker’s locally fine-tuned model. And it works: the authors “demonstrate attack feasibility on sensitive demographic and clinical attributes: gender, age, accent, emotion, and dysarthria.” The architecture that was supposed to keep the audio private leaks the speaker’s profile through the gradients.
The accuracies are not marginal. Tested across Wav2Vec2, HuBERT, and Whisper, inference from weight differentials alone runs high to near-total for several attributes. Age reaches 100% on Wav2Vec2 (97% on HuBERT, 94% on Whisper). Accent reaches 100% on Wav2Vec2 (80% on HuBERT, 93% on Whisper). Dysarthria — a clinical motor-speech condition — reaches 81% on Whisper (76% on HuBERT, 59% on Wav2Vec2). Emotion (calm versus angry) reaches 83% on Whisper. These are not “better than chance” curiosities; for age and accent on Wav2Vec2 the attack is reading the attribute off perfectly, from weights, with no audio in hand.
If the post had one number to carry, it would be this one, because it inverts the intuition that obscure data is safe data.
The same federated-leakage paper states the effect plainly: “attributes that are underrepresented or absent in the pre-training data are more vulnerable to such inference attacks. In particular, information about accents can be reliably inferred from all models.” The mechanism is not stated as folklore — it is measured. For fine-grained accent classification across ten accents on Wav2Vec2, the attack reached at least 90% accuracy for every tested accent. And for accents the model never saw in training, the leak is, if anything, sharper: Japanese, Polish, and Macedonian accents were recovered at an F1 of 1.00 — perfect — with Italian at 0.87 and German at 0.82.
Sit with the direction of that result. The conventional privacy intuition is that a common, well-represented attribute is easy to read and a rare one is protected by its rarity. Here it is reversed. The under-represented accent is not hidden by being rare; it is exposed by it, because the model carries less of a smoothing prior over it and the fine-tuning signal stands out more cleanly against the pretrained baseline. The speaker with the accent the training data barely contained — often precisely the speaker from an under-served language community — is the one whose accent the attack recovers at F1 = 1.00. A privacy property that gets worse exactly for the people least represented in the data is not a neutral technical artifact; it is a fairness problem wearing a measurement.
The attributes leaked so far were demographic and affective. The clinical channel deserves its own section, because it is the one most people do not know is in the signal at all.
Health researchers have stopped treating this as speculative. HPP-Voice: A Large-Scale Evaluation of Speech Embeddings for Multi-Phenotypic Classification (arXiv 2505.16490) opens from the premise that “human speech contains paralinguistic cues that reflect a speaker’s physiological and neurological state, potentially enabling non-invasive detection of various medical phenotypes” — and then tests it at scale, evaluating 14 modern speech-embedding models across 15 voice-related phenotypes spanning respiratory, sleep, mental-health, metabolic, immune, and neurological conditions. The demographic signal is near-ceiling: every embedding model predicted gender at AUCs ranging from 0.92 (MFCC) to 0.98 (WavLM). More to the point, generic off-the-shelf speech embeddings beat the demographic-only baseline on clinical conditions — sleep apnea in males at AUC 0.64 ± 0.03 versus a demographic baseline of 0.57 ± 0.02, insomnia in males at 0.65 ± 0.04 versus 0.59 ± 0.05, smoking status in females at 0.61 ± 0.02 versus 0.55 ± 0.02. The margins are modest, but the point is categorical: the embedding carries health signal that demographics alone do not explain.
For a specific neurological condition the accuracy stops being modest. Speech-Based Parkinson’s Detection Using Pre-Trained Self-Supervised ASR Models and Supervised Contrastive Learning detects Parkinson’s disease from a raw voice recording using the same self-supervised encoders that power transcription. Wav2Vec 2.0 with supervised contrastive learning reached an F1 of 90.0%, an AUC of 0.92, sensitivity of 95.43%, and accuracy of 89.43%; HuBERT reached an F1 of 88.99% and an AUC of 0.93. The authors frame the recording as the instrument, calling these models “scalable, non-invasive tools for diagnosing and monitoring PD.” Notice what this means for the de-identification story: the transcript layer is entirely irrelevant to this signal. Parkinson’s is not detected from what the speaker said. It is detected from how the waveform was shaped by their motor control — a property that survives any redaction of the words, because it was never in the words.
A post that builds this much momentum toward “the recording leaks everything” owes a precise accounting of where the evidence is softer, because overstating it loses the reader who knows the literature.
Several of these signals are noisy. The HPP-Voice clinical margins are real but small — an AUC of 0.64 for sleep apnea is well above the demographic baseline and well below a usable screening test, and the paper is an evaluation of what embeddings carry, not a claim that any of these makes a deployable diagnostic. The gender result there tops out at AUC 0.98, near-ceiling, but several health phenotypes hover only a few points over baseline. The federated-leakage accuracies, by contrast, are high — but they are best-per-attribute figures across three specific models (Wav2Vec2, HuBERT, Whisper) under a white-box passive attack, not a constant to quote across every speech system, and gender in that study tops out at a relatively modest 64%. The Parkinson’s numbers are strong but come from a clinical detection study on its own cohort, with the sensitivity-versus-specificity trade-off (95.43% sensitivity at 83.43% specificity) that any screening result carries. None of these is “the recording is a perfect oracle for your health.”
Two structural caveats matter more than the per-number ones. First, the federated attack is white-box and passive — it assumes the adversary sees the weight differentials, which is the threat model of an honest-but-curious aggregator, not an arbitrary outsider. That is a real and common setting, but it is a setting, and a black-box attacker with neither the audio nor the weights is outside it. Second, attribute inference is a probabilistic read, not a confession: a 93% accent classifier is wrong 7% of the time, and a profile assembled from several such reads compounds those errors. The leak is real; it is not infallible, and a system that treats an inferred clinical attribute as ground truth has added a second harm on top of the privacy one.
None of that rescues the de-identification claim, and it is important to be exact about why. The team’s claim was not “we built a perfect diagnostic.” Their claim was “this recording is de-identified” — that the sensitive, person-specific information has been removed. The evidence above refutes that claim at the level it was made. Gender and accent come back at near-perfect accuracy after anonymization. Age and accent come back at 100% from weights alone on one encoder. A motor-speech disorder comes back at 81%. Whether a noisy sleep-apnea signal is individually actionable is beside the point: the recording demonstrably still carries demographic, affective, and clinical attributes of the speaker after both controls the team applied, and “de-identified” was a statement that it would not. The honest limits narrow how much is leaked. They do not move the leak back to zero, and zero is what the sign-off assumed.
You cannot make a useful voice recording stop being a biometric — the same acoustic richness that makes speech worth keeping is the richness that profiles the speaker. You can stop treating a redacted transcript as a de-identified recording, and close the specific gaps that make the audio an easy profile.
Classify retained audio as biometric data, not as a transcript with a waveform attached. This is the decision everything else follows from. If the transcript was sensitive enough to redact, the audio is more sensitive, not less — it carries the speaker’s age, gender, accent, affect, and clinical state on channels the redaction never touched. Same access controls, same retention limits, same blast-radius accounting in an incident. “We redacted the transcript” is not a basis for a lighter touch on the audio.
Do not assume speaker anonymization removed the attributes. Anonymization defends identity, a different channel from attribute. Gender and accent survive it at near-perfect accuracy, and emotion survives it unless a system explicitly models affect as a separate subspace to strip. If attribute privacy is the goal, it is a separate requirement with separate evidence — name it, and verify it, rather than folding it into the identity claim.
Stop trusting EER as the privacy number. A reassuring Equal Error Rate is the wrong question; it underestimates what a precision-oriented adversary recovers, by more than an order of magnitude at the low false-positive operating point real attacks use. Evaluate attribute leakage in the low-FPR regime — what an attacker recovers when they only act on high-confidence reads — and report that, not the headline EER.
Account for the weight-differential channel if you train on this data. Federated or collaborative training was supposed to keep the audio on-device, but the gradients leak the speaker’s profile — age and accent at up to 100%, dysarthria at up to 81% — with no audio in hand. If model updates derived from user speech leave the device, the threat model has to include attribute inference from those updates, not only from raw recordings.
Weight the protection toward under-represented speakers, because the leak is. The standard intuition that rare attributes are safe is backwards here: under-represented accents leak hardest, recovered at F1 = 1.00 in cases the model never trained on. A privacy control validated only on the well-represented majority measures the system where it leaks least. Evaluate attribute leakage per-subgroup, including the accents and conditions thinnest in the training data, and read the worst case — those are the speakers the system fails first.
Put attribute inference in the security test suite. Run the attacks — a logistic-regression probe on embeddings of your anonymized audio, an accent and gender classifier, a weight-differential probe if you train federated — against your own pipeline and measure what comes back. An untested recording has an unknown attribute-leakage rate, and the unknown rate is not zero. The same discipline that puts embedding inversion in the test suite for a vector store applies to the waveform: measure what the representation gives back before you call it safe.
Before a “de-identified” voice recording is allowed to be treated as de-identified:
A redacted transcript reads like a de-identified recording, because to a person scanning it the names are gone and the voice is disguised, and that is what de-identification is supposed to look like. But the threat model is not scanning the transcript. It has the waveform, or in the federated case only the weights, and a linear probe — and to it the recording is the speaker’s age, gender, accent, affect, and clinical state, written on channels the redaction was never able to reach. The signal you most wanted to protect, for the person you most wanted to protect, is the one it reads off most cleanly. Treat the audio as the biometric it is, or do not keep it.
A membership-inference attack that separates your book from a held-out one is usually reading the calendar, not the weights. A successful attack is not a sound proof — and the null it would need to test against cannot be sampled.
17 min →
Unlearning promises a model can forget specific data without a full retrain. What it delivers is output suppression: a small benign relearning set — or simply quantizing the model — brings the 'forgotten' knowledge back.
14 min →
The EU AI Act requires AI output to be marked in a robust, reliable way. A formal impossibility theorem says strong watermarking cannot exist. Five words in the statute carry the collision.
13 min →