PaperlayerView exact revision on arXiv

Source-linked AI summary

Hearing the Whispers: Black-Box Membership Inference Attacks on Finetuned TTS Models

Kunlin Cai, Kaiyuan Zhang, Zihang Xiang, Jinghuai Zhang, Abeer Alwan, Fnu Suya, Yuan Tian

arXiv:2609.01723v1cs.CRcs.LGcs.SDeess.AS

TL;DR

Private-data fine-tuning in TTS creates membership-inference risks, while existing black-box attacks lack methods suited to dual-conditioned, multi-level, variable-length speech. The paper develops a speaker- and record-level attack using principled query criteria, multi-level representations, and temporal alignment, finding substantial leakage across models and datasets.

  • Problem

    Modern generative TTS lacks a tailored black-box MIA despite risks of exposing biometric identity and sensitive linguistic content through private-data fine-tuning.

    Source: §I · pp. 1–2

  • Method

    The framework evaluates dual-conditioned queries with scorable extent and memorization elicitation, selects recitation, and compares aligned multi-level speech representations at speaker and record levels.

    Source: §I · p. 2, B. Membership Inference Attacks · p. 3, 2) Which Query Design Is Most… · pp. 4–5

  • Results

    Speaker-level AUC remains above 0.80 and approaches 1.0 in strongest settings, while record-level AUC ranges from 0.80 to 0.90 across evaluated TTS models and datasets.

    Source: §I · p. 2

  • Takeaways & Limitations

    Fine-tuned TTS models exhibit substantial privacy leakage, with vulnerability associated with low silence ratio, dense phoneme structure, and rich high-frequency content.

    Source: §I · p. 2, §VII · p. 13

    The discussion presents early stopping as a training-stage mitigation but indicates that potential defenses have limitations.

    Source: §V · p. 13

Abstract

from arXiv · show

Text-to-Speech (TTS) foundation models are increasingly fine-tuned on private datasets to synthesize highly personalized voices, introducing severe privacy risks by exposing both biometric identities and sensitive speech content. Existing black-box membership inference attacks (MIAs) follow a two-stage pipeline of query generation and representation engineering, both of which face unique challenges when adapted to TTS. For query generation, dual conditioning on synthesis text and reference speech creates a large and underexplored query design space with no established criterion for identifying an effective query. For representation engineering, the multi-level speech characteristics and temporal variability of speech make low-level representations and direct comparisons inadequate for capturing membership signals. To address these challenges, we present the first black-box MIA framework explicitly tailored to TTS models at both the speaker and record levels. For query generation, we characterize the feasible query space and establish two criteria, scorable extent and memorization elicitation, for evaluating five representative queries, identifying recitation as the strongest. For representation engineering, we obtain multi-level speech representations from embedding models and temporally align the generated and target audio for fine-grained comparison. Evaluations across three state-of-the-art TTS models (CosyVoice2, F5-TTS, and XTTS-v2) fine-tuned on two benchmark datasets (VCTK and British Dialect) reveal severe privacy leakage: speaker-level AUC remains above 0.80 and approaches 1.0 in the strongest settings, while record-level AUC ranges from 0.80 to 0.90 and remains effective even in challenging scenarios where both members and non-members are of the same speakers. We further identify speech characteristics associated with disproportionate vulnerability to memorization.

I. INTRODUCTION

Fine-tuning TTS foundation models on private speech can expose speaker identity and sensitive linguistic content, yet black-box MIAs had not been developed for modern generative TTS. This work introduces a speaker- and record-level framework that addresses TTS-specific query and representation challenges.

Motivation

  • Private-data fine-tuning can expose biometric identity and sensitive speech content, making membership leakage auditing an important privacy problem.The motivation includes risks of deepfakes, identity spoofing, and disclosure of private conversations or medical consultations.Source: §I · p. 1

Research gap

  • No prior work had built a black-box MIA for modern generative TTS, despite fine-tuning embedding targeted identity and linguistic traces in model parameters.Source: §I · p. 1

Challenges

  • Dual conditioning on synthesis text and reference speech creates an underexplored query space without a criterion for identifying effective queries.The paper evaluates candidate queries using scorable extent and memorization elicitation.Source: §I · p. 1
  • Multi-level speech characteristics and temporal variability make single low-level representations and direct fixed-grid comparisons inadequate for membership signals.Membership traces may span local spectral patterns through global speaking style, while generated speech can vary in duration and pacing.Source: §I · p. 1

Approach

  • The framework combines a speaker-verification encoder, multi-level WavLM embeddings, temporal alignment, and an LSTM scorer for speaker- and record-level audits.The speaker encoder targets global identity voiceprints, while WavLM features preserve frame-level memorization artifacts.Source: §I · pp. 1–2

Results

  • Speaker-level AUC stays above 0.80 and approaches 1.0 in strongest settings, while record-level AUC ranges from 0.80 to 0.90 across three TTS models and two datasets.The analysis also identifies low silence ratio, dense phoneme structure, and rich high-frequency content as associated with disproportionate vulnerability.Source: §I · p. 2

B. Membership Inference Attacks

Black-box MIA treats membership auditing as score-based inference from observable model outputs, but TTS requires specialized handling of dual-modality queries, entangled speech signals, and variable-length waveforms. The framework formalizes speaker- and record-level threat models and adapts both query generation and representation engineering.

MIA background

  • A black-box MIA determines whether a target record was included in training using only observable model outputs, without access to parameters or gradients.Source: B. Membership Inference Attacks · p. 2
  • The standard generative-model pipeline crafts a query, extracts features from the response, and converts them into a scalar membership score.The score compares target and generated outputs through a feature extraction function.Source: B. Membership Inference Attacks · pp. 2–3

TTS challenges

Threat model

  • The threat model casts the adversary as an external auditor with no access to model weights, gradients, or fine-tuning data, operating through multiple queries.Source: C. Threat Model · p. 3
  • Speaker-level auditing tests whether any data from a target speaker entered training, whereas record-level auditing tests membership of an exact text-audio record.The record-level task assumes access to the exact target record and is described as more challenging and fine-grained.Source: C. Threat Model · p. 3

Framework

  • The proposed pipeline characterizes feasible dual-conditioned queries, selects recitation using two criteria, and extracts, aligns, and scores generated speech representations.Source: §III · pp. 3–4

A. Query Generation (GQ)

TTS query generation must choose both synthesis text and reference speech, so the paper characterizes candidate queries using scorable extent and memorization elicitation. Their combination predicts recitation as strongest because it preserves complete text and clean reference speech.

Query space

Candidate queries

Evaluation criteria

  • Reconstruction similarity serves as an observable proxy for model fit, but a useful query must widen the member–non-member reconstruction-score gap.Source: 2) Which Query Design Is Most… · p. 4
  • Scorable extent measures comparable membership evidence, while memorization elicitation measures how strongly the query expresses target-specific information learned during fine-tuning.Scorable extent is primarily determined by synthesis text; memorization elicitation is primarily determined by reference speech.Source: 2) Which Query Design Is Most… · p. 5

Query comparison

  • For record-level MIA, recitation and audio perturbation preserve full scorable extent, while continuation, partial reference, and text perturbation lose some target-content correspondence.Source: 2) Which Query Design Is Most… · p. 5
  • Recitation is predicted strongest because it uniquely combines the complete target transcript with the complete, clean target reference.Text perturbation remains competitive for speaker-level MIA, while audio perturbation weakens elicitation and the other partial queries restrict both criteria.Source: 2) Which Query Design Is Most… · p. 5

B. Representation Engineering (ϕ)

The framework uses attack-specific representations to capture speaker identity and record-level memorization signals across global and fine-grained speech characteristics.

B. Representation Engineering (ϕ)

Representation Extraction for Speaker-Level MIA

  • Speaker-level MIA extracts stable global identity voiceprints with a speaker verification encoder.Concatenating multiple target samples helps the encoder overcome poor performance on short audio segments.Source: 1) Representation Extraction · p. 6

Representation Extraction for Record-Level MIA

  • Record-level MIA uses self-supervised WavLM embeddings to preserve sequence-specific phonetic and micro-prosodic memorization artifacts.WavLM models local frame-level dependencies and provides a structured hierarchy of speech features.Source: 1) Representation Extraction · p. 6
  • WavLM feature sequences are constructed over selected layers and temporal frames, retaining multi-level information with hidden dimensionality d = 1024.For each selected layer, the method extracts an embedding vector at each temporal frame.Source: 1) Representation Extraction · p. 6

2) Representation Temporal Alignment:

The record-level attack aligns variable-length generated and target speech before scoring their fine-grained similarity, enabling comparison along the target utterance’s time axis.

Representation Temporal Alignment

  • TTS waveforms vary in duration and speaking rate, making naive frame-by-frame comparisons invalid.Even matched transcriptions can produce different phoneme durations and prosodic timing.Source: 2) Representation Temporal Alignment · p. 6, Figure 1 · p. 7
  • Modified DTW warps generated WavLM features onto the target time axis using per-layer optimal monotonic paths.The method averages generated frames mapped to each target frame and computes layer-wise cosine similarities.Source: 2) Representation Temporal Alignment · pp. 6–7
  • The resulting multivariate similarity sequence has target-utterance length, eliminating variable-length outputs across queries.This fixed-length sequence remains aligned with the target acoustic trajectory for downstream scoring.Source: 2) Representation Temporal Alignment · p. 7

Record-Level Score Aggregation

  • An LSTM aggregates temporal dependencies across the aligned similarity sequence and WavLM layers into a record-level membership score.The classifier is trained using similarity sequences generated from a shadow model with known membership labels.Source: 2) Representation Temporal Alignment · p. 7

IV. EXPERIMENT

The experiments evaluate speaker- and record-level membership inference across three TTS architectures and two datasets, finding strong leakage at both granularities.

Models

  • Three TTS models—F5-TTS, XTTS-v2, and CosyVoice2—are evaluated using official implementations and fine-tuning protocols.The models span flow-matching-based, autoregressive, and hybrid architectural paradigms.Source: A. Experiment Setup · p. 7

Dataset Split

  • The evaluation uses disjoint victim and shadow speaker sets, with N = 5000 utterances for VCTK and N = 3000 for British Dialect.Speaker- and record-level membership and non-membership samples are constructed from separate utterance and speaker partitions.Source: A. Experiment Setup · p. 8

TTS Models Are Vulnerable at Both Speaker and Record Levels

  • Record-level MIA remains effective when members and non-members are records from the same speakers, indicating distinct memorization signals.The result extends beyond easier comparisons between different speakers.Source: B. Attack Performance · p. 8
  • Speaker-level AUC values remain above 0.80 across models and datasets, approaching perfection for CosyVoice2 and F5-TTS on British Dialect.Performance also remains substantially above chance in the low-FPR region.Source: 1) TTS Models Are Vulnerable at Both… · p. 8, B. Attack Performance · p. 8

Dataset Effects

  • British Dialect generally produces stronger attack results than VCTK at both speaker and record levels.The gap is especially clear for speaker-level AUC and TPR@1%FPR, while record-level differences are smaller.Source: 1) TTS Models Are Vulnerable at Both… · p. 8

Model Effects

  • XTTS-v2 is least vulnerable to speaker-level MIA, with AUC of 0.841 on VCTK and 0.949 on British Dialect.The paper attributes this pattern to fine-tuning that does not directly adapt the acoustic decoder.Source: 1) TTS Models Are Vulnerable at Both… · p. 8

2) Record-Level MIA Captures Record-Specific Memorization Beyond Speaker Identity.:

Record-level MIA remains effective when non-members share speakers with members, indicating record-specific memorization beyond speaker identity. Its performance depends on query completeness, fine-grained representations, temporal alignment, and multi-level features.

Record-Specific Memorization

Query Design

Representation Engineering

Temporal Representation

4) Record-Level MIA Requires Multi-Level WavLM Features.:

Record-level MIA benefits from combining WavLM layers and explicitly aligning generated and target speech. Leakage also varies with model component, attacker query budget, and speech characteristics.

Multi-Level WavLM Features

  • 0.896 AUC is reached by aggregating all 24 WavLM layers, rising from roughly 0.857 for the best single layer.The first twelve layers generally outperform higher layers individually, while aggregation improves discrimination.Source: 4) Record-Level MIA Requires… · p. 10

Temporal Alignment

Model Components

Attack Parameters

8) Effect of Query Budget:

Repeated queries improve membership inference, with speaker-level performance saturating early while record-level performance improves more slowly. Vulnerability also varies with speaker and utterance characteristics, including silence ratio and phoneme density.

8) Effect of Query Budget:

  • 0.968 to 0.980: speaker-level AUC improves from one to five repeated-query seeds, then plateaus.TPR@1%FPR increases from 0.823 to 0.871 by nine seeds.Source: 8) Effect of Query Budget · p. 11
  • 0.863 to 0.896: record-level AUC improves from one seed to ten or more seeds, with slower saturation.TPR@1%FPR increases from about 0.23 to 0.30 by twenty seeds.Source: 8) Effect of Query Budget · p. 11

Speaker vulnerability

Record vulnerability

4) Richer High-Frequency Content Increases Record-Level Vulnerability:

Richer high-frequency content is associated with greater record-level vulnerability, while longer utterances also show stronger attack performance. The discussion frames these findings alongside attack robustness and privacy defenses.

4) Richer High-Frequency Content Increases Record-Level Vulnerability:

  • Higher high-frequency energy ratios consistently correspond to greater record-level vulnerability.High-frequency energy ratio captures spectral energy above 4 kHz, including fricatives, sibilants, and other fine acoustic details.Source: 4) Richer High-Frequency Content… · p. 12

Longer recordings

  • 0.857 to 0.916: record-level AUC rises as utterance duration increases from under 2 seconds to over 5 seconds.TPR@1%FPR increases from 0.282 to 0.395; longer utterances provide more acoustic content for DTW-based scoring.Source: 5) Longer Recordings Are More Vulnerable · pp. 12–13

Defense implications

  • Early stopping reduces attack success to some extent but remains far from a perfect defense.The model still memorizes sufficient identity and content traces before convergence.Source: §V · p. 13
  • AUC ≈0.52–0.54: DP-SGD with ε = 4 and ε = 10 reduces speaker-level and record-level MIA to near-random performance.TPR@1%FPR remains below 0.02, with a non-trivial trade-off in generation quality.Source: §V · p. 13

APPENDIX

The appendix presents the generalized TTS membership-inference auditing pipeline, from recitation-query formulation through representation extraction, temporal alignment, scoring, and decision thresholding.

APPENDIX

  • The audit takes a target generative model, target data, query count, and decision threshold as inputs, and outputs a membership decision.The algorithm denotes the decision as y-hat ∈ {0, 1}.Source: APPENDIX · p. 16
  • Recitation query formulation generates model responses repeatedly before representation engineering.The algorithm initializes generated outputs and executes the recitation query in Phase 1.Source: APPENDIX · p. 16
  • Speaker and record audits use tailored representations, followed by temporal alignment for variable-length waveforms.The representation phase distinguishes speaker and record extractors before alignment.Source: APPENDIX · p. 16
  • The pipeline aggregates aligned representations into a score and compares that score with a predefined threshold.Higher-level speech energy is associated with stronger record-level attack performance.Source: APPENDIX · p. 16, A. Other Speech Characteristics… · p. 16, Table VII · p. 16

B. Effect of Multi-Query Statistics on Record-Level MIA

Record-level MIA benefits from combining mean and variance across repeated-query scores, while recitation and complete references strengthen comparable reconstruction signals. Attack success also increases with fine-tuning.

B. Effect of Multi-Query Statistics on Record-Level MIA

  • 0.896 AUC: combining mean and variance reaches the best record-level MIA performance, exceeding mean-only and variance-only aggregation.Mean alone reaches AUC 0.869, while variance alone reaches 0.690.Source: B. Effect of Multi-Query Statistics on… · p. 16

Query design

Reference completeness

  • ∆=0.019 versus ∆=0.010: full reference speech roughly doubles the member/non-member mean score gap relative to a half-recording reference.Both populations become more similar to the target, but members shift farther.Source: E. Effect of Reference Completeness on… · p. 17

Fine-tuning steps

G. Defense

The defenses reduce membership-inference performance to varying degrees: early stopping mainly weakens record-level leakage, perturbations preserve above-random signals, and DP-SGD brings both attack levels near random.

Early stopping

  • AUC 0.748 and TPR@1%FPR 0.036 under early stopping show substantially reduced record-level MIA.Speaker-level MIA remains strong at AUC 0.900 and TPR@1%FPR 0.543, indicating identity memorization persists.Source: 1) Early Stop · p. 17

Reconstruction signal

  • The recitation-query member reconstruction closely reproduces harmonic and formant structure, unlike the smoother, less detailed non-member reconstruction.The spectrogram comparison illustrates the membership-dependent reconstruction signal targeted by the attack.Source: Figure 13 · p. 18

Input perturbation

  • Reference-audio perturbations reduce attack performance, but record-level MIA remains well above random under substantial additive noise.The defense experiment evaluates white noise at 40 dB and 25 dB SNR; 25 dB causes audible degradation while remaining intelligible.Source: 2) Input Perturbation · p. 18
  • 50% and 20% temporal truncation weaken attacks more than additive noise, yet membership signals remain largely above random with shortened references.Aggressive truncation substantially removes reference speech and would likely reduce normal-user utility.Source: 2) Input Perturbation · p. 18

Differential privacy

  • AUC ≈0.52–0.54 and TPR@1%FPR < 0.02 under DP-SGD reduce both speaker-level and record-level MIA to near-random performance.This result is reported for CosyVoice2 on VCTK at privacy budgets ε = 4 and ε = 10.Source: 3) DP-SGD · p. 18, Table XI · p. 18

Related papers

Loading 2609.01723v1…