PaperlayerView exact revision on arXiv

Source-linked AI summary

Hearing the Whispers: Black-Box Membership Inference Attacks on Finetuned TTS Models

Kunlin Cai, Kaiyuan Zhang, Zihang Xiang, Jinghuai Zhang, Abeer Alwan, Fnu Suya, Yuan Tian

arXiv:2609.01723v1cs.CRcs.LGcs.SDeess.AS

TL;DR

Private-data fine-tuning in TTS creates membership-inference risks, while existing black-box attacks lack methods suited to dual-conditioned, multi-level, variable-length speech. The paper develops a speaker- and record-level attack using principled query criteria, multi-level representations, and temporal alignment, finding substantial leakage across models and datasets.

  • Problem

    Modern generative TTS lacks a tailored black-box MIA despite risks of exposing biometric identity and sensitive linguistic content through private-data fine-tuning.

  • Method

    The framework evaluates dual-conditioned queries with scorable extent and memorization elicitation, selects recitation, and compares aligned multi-level speech representations at speaker and record levels.

  • Results

    Speaker-level AUC remains above 0.80 and approaches 1.0 in strongest settings, while record-level AUC ranges from 0.80 to 0.90 across evaluated TTS models and datasets.

  • Takeaways & Limitations

    Fine-tuned TTS models exhibit substantial privacy leakage, with vulnerability associated with low silence ratio, dense phoneme structure, and rich high-frequency content.

  • Takeaways & Limitations

    The discussion presents early stopping as a training-stage mitigation but indicates that potential defenses have limitations.

Abstract

from arXiv · show

Text-to-Speech (TTS) foundation models are increasingly fine-tuned on private datasets to synthesize highly personalized voices, introducing severe privacy risks by exposing both biometric identities and sensitive speech content. Existing black-box membership inference attacks (MIAs) follow a two-stage pipeline of query generation and representation engineering, both of which face unique challenges when adapted to TTS. For query generation, dual conditioning on synthesis text and reference speech creates a large and underexplored query design space with no established criterion for identifying an effective query. For representation engineering, the multi-level speech characteristics and temporal variability of speech make low-level representations and direct comparisons inadequate for capturing membership signals. To address these challenges, we present the first black-box MIA framework explicitly tailored to TTS models at both the speaker and record levels. For query generation, we characterize the feasible query space and establish two criteria, scorable extent and memorization elicitation, for evaluating five representative queries, identifying recitation as the strongest. For representation engineering, we obtain multi-level speech representations from embedding models and temporally align the generated and target audio for fine-grained comparison. Evaluations across three state-of-the-art TTS models (CosyVoice2, F5-TTS, and XTTS-v2) fine-tuned on two benchmark datasets (VCTK and British Dialect) reveal severe privacy leakage: speaker-level AUC remains above 0.80 and approaches 1.0 in the strongest settings, while record-level AUC ranges from 0.80 to 0.90 and remains effective even in challenging scenarios where both members and non-members are of the same speakers. We further identify speech characteristics associated with disproportionate vulnerability to memorization.

I. INTRODUCTION

Fine-tuning TTS foundation models on private speech can expose speaker identity and sensitive linguistic content, yet black-box MIAs had not been developed for modern generative TTS. This work introduces a speaker- and record-level framework that addresses TTS-specific query and representation challenges.

  • Motivation: Private-data fine-tuning can expose biometric identity and sensitive speech content, making membership leakage auditing an important privacy problem.The motivation includes risks of deepfakes, identity spoofing, and disclosure of private conversations or medical consultations.
  • Research gap: No prior work had built a black-box MIA for modern generative TTS, despite fine-tuning embedding targeted identity and linguistic traces in model parameters.
  • Challenges: Dual conditioning on synthesis text and reference speech creates an underexplored query space without a criterion for identifying effective queries.The paper evaluates candidate queries using scorable extent and memorization elicitation.
  • Challenges: Multi-level speech characteristics and temporal variability make single low-level representations and direct fixed-grid comparisons inadequate for membership signals.Membership traces may span local spectral patterns through global speaking style, while generated speech can vary in duration and pacing.
  • Approach: The framework combines a speaker-verification encoder, multi-level WavLM embeddings, temporal alignment, and an LSTM scorer for speaker- and record-level audits.The speaker encoder targets global identity voiceprints, while WavLM features preserve frame-level memorization artifacts.
  • Results: Speaker-level AUC stays above 0.80 and approaches 1.0 in strongest settings, while record-level AUC ranges from 0.80 to 0.90 across three TTS models and two datasets.The analysis also identifies low silence ratio, dense phoneme structure, and rich high-frequency content as associated with disproportionate vulnerability.

B. Membership Inference Attacks

Black-box MIA treats membership auditing as score-based inference from observable model outputs, but TTS requires specialized handling of dual-modality queries, entangled speech signals, and variable-length waveforms. The framework formalizes speaker- and record-level threat models and adapts both query generation and representation engineering.

  • MIA background: A black-box MIA determines whether a target record was included in training using only observable model outputs, without access to parameters or gradients.
  • MIA background: The standard generative-model pipeline crafts a query, extracts features from the response, and converts them into a scalar membership score.The score compares target and generated outputs through a feature extraction function.
  • TTS challenges: TTS complicates query construction because each query combines synthesis text and reference audio, leaving the strongest memorization-triggering combination unclear.
  • TTS challenges: TTS representation engineering must handle entangled content, speaker identity, and prosody alongside continuous, variable-length waveforms that defeat point-to-point distance metrics.
  • Threat model: The threat model casts the adversary as an external auditor with no access to model weights, gradients, or fine-tuning data, operating through multiple queries.
  • Threat model: Speaker-level auditing tests whether any data from a target speaker entered training, whereas record-level auditing tests membership of an exact text-audio record.The record-level task assumes access to the exact target record and is described as more challenging and fine-grained.
  • Framework: The proposed pipeline characterizes feasible dual-conditioned queries, selects recitation using two criteria, and extracts, aligns, and scores generated speech representations.

A. Query Generation (GQ)

TTS query generation must choose both synthesis text and reference speech, so the paper characterizes candidate queries using scorable extent and memorization elicitation. Their combination predicts recitation as strongest because it preserves complete text and clean reference speech.

  • Query space: A TTS query consists of coupled synthesis-text and reference-speech conditions, producing a broader design space than single-condition generative-model attacks.
  • Candidate queries: Continuation withholds a target suffix and asks the model to complete it from a speech prefix, while partial reference supplies only a target-speech window.
  • Candidate queries: Audio perturbation degrades the target reference, whereas text perturbation replaces a fraction of transcript words with near-homophonic alternatives.
  • Evaluation criteria: Reconstruction similarity serves as an observable proxy for model fit, but a useful query must widen the member–non-member reconstruction-score gap.
  • Evaluation criteria: Scorable extent measures comparable membership evidence, while memorization elicitation measures how strongly the query expresses target-specific information learned during fine-tuning.Scorable extent is primarily determined by synthesis text; memorization elicitation is primarily determined by reference speech.
  • Query comparison: For record-level MIA, recitation and audio perturbation preserve full scorable extent, while continuation, partial reference, and text perturbation lose some target-content correspondence.
  • Query comparison: Recitation is predicted strongest because it uniquely combines the complete target transcript with the complete, clean target reference.Text perturbation remains competitive for speaker-level MIA, while audio perturbation weakens elicitation and the other partial queries restrict both criteria.

B. Representation Engineering (ϕ)

The framework uses attack-specific representations to capture speaker identity and record-level memorization signals across global and fine-grained speech characteristics.

  • B. Representation Engineering (ϕ): The representation module addresses TTS-specific challenges through tailored extractors and alignment techniques for speaker- and record-level attacks.The design targets both heterogeneous speech characteristics and continuous audio variability.
  • Representation Extraction for Speaker-Level MIA: Speaker-level MIA extracts stable global identity voiceprints with a speaker verification encoder.Concatenating multiple target samples helps the encoder overcome poor performance on short audio segments.
  • Representation Extraction for Record-Level MIA: Record-level MIA uses self-supervised WavLM embeddings to preserve sequence-specific phonetic and micro-prosodic memorization artifacts.WavLM models local frame-level dependencies and provides a structured hierarchy of speech features.
  • Representation Extraction for Record-Level MIA: WavLM feature sequences are constructed over selected layers and temporal frames, retaining multi-level information with hidden dimensionality d = 1024.For each selected layer, the method extracts an embedding vector at each temporal frame.

2) Representation Temporal Alignment:

The record-level attack aligns variable-length generated and target speech before scoring their fine-grained similarity, enabling comparison along the target utterance’s time axis.

  • Representation Temporal Alignment: TTS waveforms vary in duration and speaking rate, making naive frame-by-frame comparisons invalid.Even matched transcriptions can produce different phoneme durations and prosodic timing.
  • Representation Temporal Alignment: Modified DTW warps generated WavLM features onto the target time axis using per-layer optimal monotonic paths.The method averages generated frames mapped to each target frame and computes layer-wise cosine similarities.
  • Representation Temporal Alignment: The resulting multivariate similarity sequence has target-utterance length, eliminating variable-length outputs across queries.This fixed-length sequence remains aligned with the target acoustic trajectory for downstream scoring.
  • Record-Level Score Aggregation: An LSTM aggregates temporal dependencies across the aligned similarity sequence and WavLM layers into a record-level membership score.The classifier is trained using similarity sequences generated from a shadow model with known membership labels.

IV. EXPERIMENT

The experiments evaluate speaker- and record-level membership inference across three TTS architectures and two datasets, finding strong leakage at both granularities.

  • Models: Three TTS models—F5-TTS, XTTS-v2, and CosyVoice2—are evaluated using official implementations and fine-tuning protocols.The models span flow-matching-based, autoregressive, and hybrid architectural paradigms.
  • Dataset Split: The evaluation uses disjoint victim and shadow speaker sets, with N = 5000 utterances for VCTK and N = 3000 for British Dialect.Speaker- and record-level membership and non-membership samples are constructed from separate utterance and speaker partitions.
  • TTS Models Are Vulnerable at Both Speaker and Record Levels: Record-level MIA remains effective when members and non-members are records from the same speakers, indicating distinct memorization signals.The result extends beyond easier comparisons between different speakers.
  • TTS Models Are Vulnerable at Both Speaker and Record Levels: Speaker-level AUC values remain above 0.80 across models and datasets, approaching perfection for CosyVoice2 and F5-TTS on British Dialect.Performance also remains substantially above chance in the low-FPR region.
  • Dataset Effects: British Dialect generally produces stronger attack results than VCTK at both speaker and record levels.The gap is especially clear for speaker-level AUC and TPR@1%FPR, while record-level differences are smaller.
  • Model Effects: XTTS-v2 is least vulnerable to speaker-level MIA, with AUC of 0.841 on VCTK and 0.949 on British Dialect.The paper attributes this pattern to fine-tuning that does not directly adapt the acoustic decoder.

2) Record-Level MIA Captures Record-Specific Memorization Beyond Speaker Identity.:

Record-level MIA remains effective when non-members share speakers with members, indicating record-specific memorization beyond speaker identity. Its performance depends on query completeness, fine-grained representations, temporal alignment, and multi-level features.

  • Record-Specific Memorization: Record-level MIA remains clearly above the random baseline when non-members are drawn from speakers seen during fine-tuning.Low-FPR performance is comparable to that on the full evaluation set, indicating record-specific cues beyond speaker identity.
  • Query Design: 0.896 AUC is achieved by recitation for record-level MIA, exceeding the second-best query by 0.059 AUC.Recitation also nearly doubles the second-best query’s TPR@1%FPR, 0.281 versus 0.154.
  • Representation Engineering: 0.896 AUC is achieved by multi-level WavLM features, compared with 0.808 for speaker-verification features in record-level MIA.Mel and MFCC achieve 0.672 and 0.696 AUC, respectively.
  • Temporal Representation: Temporal concatenation outperforms embedding averaging for speaker-level MIA, with the largest reported gain on XTTS-v2.On XTTS-v2, AUC is 0.841 versus 0.772; on CosyVoice2, it is 0.980 versus 0.974.

4) Record-Level MIA Requires Multi-Level WavLM Features.:

Record-level MIA benefits from combining WavLM layers and explicitly aligning generated and target speech. Leakage also varies with model component, attacker query budget, and speech characteristics.

  • Multi-Level WavLM Features: 0.896 AUC is reached by aggregating all 24 WavLM layers, rising from roughly 0.857 for the best single layer.The first twelve layers generally outperform higher layers individually, while aggregation improves discrimination.
  • Temporal Alignment: 0.896 AUC and 0.809 ACC are achieved by DTW, whereas naive padding or truncation yields near-random performance.The result supports fine-grained temporal alignment for record-level comparison.
  • Model Components: 0.818 AUC is retained under LLM-only fine-tuning for record-level MIA, compared with 0.685 under flow-only fine-tuning.This pattern differs from speaker-level MIA, where flow-only fine-tuning nearly matches full fine-tuning.
  • Attack Parameters: Approximately 7–9 attacker recordings are sufficient for speaker-level MIA performance to converge near AUC 1.0 and TPR@1%FPR near 0.95.Increasing recordings from 1 to 3 raises AUC from approximately 0.87 to 0.96.

8) Effect of Query Budget:

Repeated queries improve membership inference, with speaker-level performance saturating early while record-level performance improves more slowly. Vulnerability also varies with speaker and utterance characteristics, including silence ratio and phoneme density.

  • 8) Effect of Query Budget:: 0.968 to 0.980: speaker-level AUC improves from one to five repeated-query seeds, then plateaus.TPR@1%FPR increases from 0.823 to 0.871 by nine seeds.
  • 8) Effect of Query Budget:: 0.863 to 0.896: record-level AUC improves from one seed to ten or more seeds, with slower saturation.TPR@1%FPR increases from about 0.23 to 0.30 by twenty seeds.
  • Speaker vulnerability: ∆=0.041 versus ∆=0.034: male speakers show larger member/non-member score separation than female speakers.TPR@1%FPR reaches 0.881 for male speakers and 0.833 for female speakers.
  • Record vulnerability: 0.943 to 0.748: record-level AUC declines as silence ratio increases from 0–20% to >60%.TPR@1%FPR decreases from 0.406 to 0.129; the paper attributes the trend to silence providing little discriminative acoustic information.
  • Record vulnerability: 0.852 to 0.927: record-level AUC rises with phoneme density from the <3 bin to the 4–4.5 bin, then declines slightly to 0.912 above 4.5.TPR@1%FPR increases from 0.184 to 0.372 before decreasing to 0.340 in the highest-density bin.

4) Richer High-Frequency Content Increases Record-Level Vulnerability:

Richer high-frequency content is associated with greater record-level vulnerability, while longer utterances also show stronger attack performance. The discussion frames these findings alongside attack robustness and privacy defenses.

  • 4) Richer High-Frequency Content Increases Record-Level Vulnerability:: Higher high-frequency energy ratios consistently correspond to greater record-level vulnerability.High-frequency energy ratio captures spectral energy above 4 kHz, including fricatives, sibilants, and other fine acoustic details.
  • Longer recordings: 0.857 to 0.916: record-level AUC rises as utterance duration increases from under 2 seconds to over 5 seconds.TPR@1%FPR increases from 0.282 to 0.395; longer utterances provide more acoustic content for DTW-based scoring.
  • Defense implications: Early stopping reduces attack success to some extent but remains far from a perfect defense.The model still memorizes sufficient identity and content traces before convergence.
  • Defense implications: AUC ≈0.52–0.54: DP-SGD with ε = 4 and ε = 10 reduces speaker-level and record-level MIA to near-random performance.TPR@1%FPR remains below 0.02, with a non-trivial trade-off in generation quality.

APPENDIX

The appendix presents the generalized TTS membership-inference auditing pipeline, from recitation-query formulation through representation extraction, temporal alignment, scoring, and decision thresholding.

  • APPENDIX: The audit takes a target generative model, target data, query count, and decision threshold as inputs, and outputs a membership decision.The algorithm denotes the decision as y-hat ∈ {0, 1}.
  • APPENDIX: Recitation query formulation generates model responses repeatedly before representation engineering.The algorithm initializes generated outputs and executes the recitation query in Phase 1.
  • APPENDIX: Speaker and record audits use tailored representations, followed by temporal alignment for variable-length waveforms.The representation phase distinguishes speaker and record extractors before alignment.
  • APPENDIX: The pipeline aggregates aligned representations into a score and compares that score with a predefined threshold.Higher-level speech energy is associated with stronger record-level attack performance.

B. Effect of Multi-Query Statistics on Record-Level MIA

Record-level MIA benefits from combining mean and variance across repeated-query scores, while recitation and complete references strengthen comparable reconstruction signals. Attack success also increases with fine-tuning.

  • B. Effect of Multi-Query Statistics on Record-Level MIA: 0.896 AUC: combining mean and variance reaches the best record-level MIA performance, exceeding mean-only and variance-only aggregation.Mean alone reaches AUC 0.869, while variance alone reaches 0.690.
  • Query design: Recitation asks the model to reproduce a clip using its complete record and a matching transcript window.The appendix also compares audio and text perturbation queries.
  • Reference completeness: ∆=0.019 versus ∆=0.010: full reference speech roughly doubles the member/non-member mean score gap relative to a half-recording reference.Both populations become more similar to the target, but members shift farther.
  • Fine-tuning steps: 0.980 AUC at around 50k fine-tuning steps: speaker-level MIA saturates while further training yields only marginal gains.At 50k steps, TPR@1%FPR is 0.853; AUC reaches 0.984 at 100k steps.

G. Defense

The defenses reduce membership-inference performance to varying degrees: early stopping mainly weakens record-level leakage, perturbations preserve above-random signals, and DP-SGD brings both attack levels near random.

  • Early stopping: AUC 0.748 and TPR@1%FPR 0.036 under early stopping show substantially reduced record-level MIA.Speaker-level MIA remains strong at AUC 0.900 and TPR@1%FPR 0.543, indicating identity memorization persists.
  • Reconstruction signal: The recitation-query member reconstruction closely reproduces harmonic and formant structure, unlike the smoother, less detailed non-member reconstruction.The spectrogram comparison illustrates the membership-dependent reconstruction signal targeted by the attack.
  • Input perturbation: Reference-audio perturbations reduce attack performance, but record-level MIA remains well above random under substantial additive noise.The defense experiment evaluates white noise at 40 dB and 25 dB SNR; 25 dB causes audible degradation while remaining intelligible.
  • Input perturbation: 50% and 20% temporal truncation weaken attacks more than additive noise, yet membership signals remain largely above random with shortened references.Aggressive truncation substantially removes reference speech and would likely reduce normal-user utility.
  • Differential privacy: AUC ≈0.52–0.54 and TPR@1%FPR < 0.02 under DP-SGD reduce both speaker-level and record-level MIA to near-random performance.This result is reported for CosyVoice2 on VCTK at privacy budgets ε = 4 and ε = 10.
Loading 2609.01723v1…