PaperlayerView exact revision on arXiv

Source-linked AI summary

AegisVox: Factorized Privacy and Clinical Preservation for Long-Form Speech

Praphul Singh, Akshat Agarwal, Ratul Ghosh, Aashna Kanuga, Devashish Khatwani, Anurag Dwarakanath, Sri Gadde, Krishnaram Kenthapadi

arXiv:2610.14643v1cs.AI

TL;DR

Clinical speech exposes identity through both spoken identifiers and voice, while delivery and speaker roles can carry useful evidence. AegisVox factorizes consistent surrogate voices and document-consistent lexical edits; its evaluation finds that stronger replacement realization can coexist with differing clinical and speaker-linkage measurements.

  • Problem

    Clinical audio carries identity in both spoken identifiers and vocal characteristics, even though delivery and speaker roles may also matter as clinical evidence.

    Source: §1 · pp. 1–2

  • Method

    AegisVox assigns consistent surrogate voices and conversation-wide synthetic replacements, then edits only complete turns containing planned identifiers.

    Source: §1 · p. 2, §3.1 · p. 3

  • Results

    The renderer comparison shows that improved replacement realization can coexist with similar aggregate clinical preservation, differing contradiction labels, and greater edited-speech linkage under a score-direction sensitivity analysis.

    Source: §1 · p. 2, §5.4 · p. 8

  • Takeaways & Limitations

    Privacy tests answer different questions, so renderer choice depends on what recipients need to hear and what identifying evidence an attacker can access.

    Source: §6 · p. 9, §7 · p. 9

    The study uses public simulated or non-patient conversations and does not establish performance on real patients, clinical safety, regulatory compliance, or guaranteed identifier removal.

    Source: §6 · p. 9

Abstract

from arXiv · show

Clinical speech reveals identity through both spoken identifiers and voice, yet its pauses, delivery, and speaker roles can also carry useful clinical evidence. Protecting that speech therefore requires more than preserving its words. We present AegisVox, a factorized framework that assigns consistent surrogate voices and edits identifier-bearing turns using document-consistent replacements. Across 390 public simulated or non-patient conversations totaling 63.6 hours, a matched comparison of two speech renderers separates replacement realization from retained identifiers, speaker linkage, and clinical preservation. Text-to-speech rendering realizes 535/601 planned replacements versus 453/601 for the codec-based speech editor. However, similar aggregate clinical preservation conceals more model-labeled contradictions, and conversation-wide speaker scores conceal greater edited-speech linkage under a score-direction sensitivity analysis. Fresh transcription of original audio provides a reference for interpreting the clinical measurement chain; an independent judge tests sensitivity to model-based assessment. Better replacement realization can therefore coexist with worse clinical or speaker-linkage measurements. AegisVox supports use-specific evaluation of those tradeoffs, not a guarantee of identifier removal or clinical safety.

1. Introduction

Clinical audio carries identity in both words and voice, while delivery and speaker roles can also hold useful clinical evidence. AegisVox separates voice transformation from consistent lexical replacement and evaluates their privacy and preservation tradeoffs.

1. Introduction

  • Removing names from text leaves spoken identifiers and the original voice available, while muting or full resynthesis can disrupt utterances or fail to preserve observed delivery.Pauses, prosody, accent, and non-speech events may matter for studying communication or building speech-based clinical tools.Source: §1 · pp. 1–2
  • AegisVox assigns each speaker a consistent surrogate voice, reuses synthetic entity replacements across a conversation, and edits only affected complete turns.This factorization supports distinct tests of detection, replacement, linkage, and clinical preservation.Source: §1 · p. 2
  • Matched renderer comparisons show that better replacement realization can coexist with similar aggregate clinical preservation but different error profiles and edited-region linkage.Original-audio and independent-judge controls help interpret these measurements without treating model judgments as clinical truth.Source: §1 · pp. 2–3

2. Related Work

Prior work addresses clinical text de-identification, voice anonymization, and speech editing, but separate measures do not establish protection across both identity surfaces or clinical preservation.

2. Related Work

  • VoicePrivacy work pairs attacker-oriented speaker verification with intelligibility and quality measures, while clinical text systems target identity through detection, redaction, or consistent pseudonymization.Neither a text-detection score nor a speaker-verification score establishes both forms of protection.Source: §2 · p. 3
  • Speech editors replace selected speech using observed context, while general speech generation reconstructs interaction that must be rechecked; AegisVox applies joint transformation to long-form clinical assessment.Prior systems also combine speaker and localized identifier transformations, including Xiao et al. (2026).Source: §2 · p. 3
  • Clinical note quality depends on facts, roles, temporal relations, and supported decisions, which word error rate alone cannot distinguish from benign transcription variants.Model-based evaluation can test these distinctions at scale but depends on the judge; the renderer comparison is not a matched benchmark against another complete privacy pipeline.Source: §2 · p. 3

3. AegisVox

AegisVox applies fixed speaker and entity mappings to a conversation, converts every turn, and adds complete-turn lexical rendering only where a planned replacement occurs.

3.1. Task and consistent mappings

  • Each source speaker maps to a public surrogate voice and each detected entity to a synthetic replacement, with both mappings fixed within the conversation.The output is a reconstructed waveform with transformed voices and planned lexical substitutions.Source: §3.1 · p. 3

3.2. Speaker transformation

  • Voice references are selected using acoustic distance and available trait metadata, then reused across turns to maintain an intended pseudo-identity.The assignment thresholds are untuned heuristics, not a learned global assignment or established privacy–utility frontier.Source: §3.2 · pp. 3–4

3.3. Lexical planning and complete-turn rendering

  • A speaker-attributed transcript guides a HIPAA Safe Harbor-based identifier plan, and each affected complete turn is rendered with either VoiceCraft or F5-TTS.The synthetic substitute is reused across coreferent mentions; the renderer receives converted audio, the original transcript, and its replacement-bearing version.Source: §3.3 · p. 4

3.4. Reconstruction and measurement boundaries

  • Rendered turns replace their converted counterparts while remaining converted turns, gaps, and speaker order supply reconstruction context.Generated-turn benchmark scores are distinct from reconstructed-conversation outcomes, and successful realization does not prove every identifier was removed.Source: §3.4 · p. 4

4. Evaluation Design

The evaluation compares shared-source renderer conditions on public simulated or non-patient conversations and separates replacement, linkage, clinical evidence, and uncertainty measurements.

4.1. Population and controlled comparisons

  • The evaluation uses public simulated or non-patient conversations, with transformation conditions sharing recordings and an original-audio control that changes no speech.The example of “Nina” replacing “Doris” while an earlier “Doris” remains illustrates why replacement and retention require separate outcomes.Source: §4.1 · pp. 4–5, Table 1 · p. 5

4.2. Separate privacy outcomes

  • The renderer benchmark evaluates each matched edit intention for both realized substitutes and retained originals, while speaker linkage is tested on final reconstructed waveforms.Speaker trials compare profiles with their own transformed speech and other speakers in the same conversation; an additional analysis samples planned inserted-turn intervals.Source: §4.2 · pp. 5–6

4.3. Clinical evidence and controls

  • Clinical preservation is judged against a frozen inventory of source evidence propositions, with strict preservation counted separately from contradiction.Fresh transcription of original audio supplies a combined transcription-and-adjudication reference, while an independent judge tests assessment sensitivity rather than clinical truth.Source: §4.3 · p. 6

4.4. Statistical units and uncertainty

  • Paired renderer effects use conversation-cluster bootstrap resamples, while uncertain judgments and failed lexical cases do not count as verified success or absence.Confidence intervals describe sampling uncertainty, unresolved outcomes are handled with bounds, and an interval crossing zero does not establish equivalence.Source: §4.4 · p. 6

5. Results

F5-TTS realizes more planned replacements than VoiceCraft, but similar aggregate clinical preservation masks more model-labeled contradictions, and conversation-wide linkage scores miss greater linkage in edited regions. Original-audio controls and independent assessments help interpret these outcomes without treating model judgments as clinical truth.

5.1. The original-audio control explains the reference scale

  • Fresh original-audio ASR preserved 24,998/25,778 CAPs (96.97%), versus 20,089/25,778 (77.93%) after SeedVC alone; the paired change was −19.04 percentage points.The control supplies a reference scale, not clinical ground truth, and does not establish that voice conversion audibly destroys clinical facts.Source: §5.1 · pp. 6–7, Figure 2 · p. 7

5.2. More replacements do not imply uniform gains

  • 535/601 (89.02%) versus 453/601 (75.37%) planned replacements were realized by F5-TTS and VoiceCraft, respectively, a 13.64-point gain for F5-TTS.Original identifiers were retained in 28/601 versus 21/601 edits; the difference was not statistically resolved, and original-term judgments remained uncertain in 40 and 92 cases, respectively.Source: §5.2 · p. 7
  • Aggregate CAP preservation differed by just −0.10 points, yet F5-TTS had 479/25,778 versus 391/25,778 model-labeled contradictions, a paired increase of 0.34 points.These labels are not clinician-confirmed harms; the outcome partition includes distinct failure types.Source: §5.2 · p. 7, Table 2 · p. 8
  • ASQ-PHI exact typed F1 was 94.4% under the frozen contract intersection and 79.9% under the full benchmark ontology; these text-detection results do not estimate recording-level identifier recall.Of 219 hard-negative queries, 48 elicited at least one prediction; multiplying detection and realization rates would not estimate end-to-end privacy.Source: §5.2 · p. 7

5.3. Final-output averages can hide edited-speech linkage

  • The all-turn F5-TTS-minus-VoiceCraft EER contrast was 0.22 points with no detectable difference, while planned-edit regions showed 11.34-point lower EER for F5-TTS.The edited-region contrast covers 291 matched eligible profiles from 204 conversations; six additional VoiceCraft profiles were excluded rather than scored as successful privacy.Source: §5.3 · pp. 7–8, Figure 3 · p. 8

5.4. Clinical conclusions depend on the measurement protocol

  • Qwen3-32B corroborated the lexical ordering, but its clinical labels agreed with GPT-5.4 only modestly (Cohen’s κ 0.253–0.340), so independent judging tests sensitivity rather than clinical truth.The Qwen weighted clinical contrast crossed zero, while absolute rates and low-importance fact contrasts differed from GPT-5.4.Source: §5.4 · p. 8
  • Without the source-fact inventory, strict note preservation differed by −0.37 points, while model-labeled contradictions increased by 0.48 points in valid matched cases.Only 1,440/1,560 note generations and 999/1,170 judgments were valid; the limited blinded panel supports descriptive listening, not renderer superiority or CAP-level validation.Source: §5.4 · pp. 8–9

5.5. Frontend and recording conditions constrain use

  • Across frontend combinations, strict CAP preservation ranged from 0.771 to 0.807 without one backend leading all measures; 12-dB room noise reduced chronology by 12.1 points.Canary’s interface lacked links needed to localize edits, and English–French differences remained confounded with dataset, duration, and interaction setting.Source: §5.5 · p. 9

6. Discussion

The discussion frames speech de-identification as a joint preservation and privacy problem: complete-turn rendering retains context but does not preserve all acoustic properties. Measurement must span the pipeline, and release decisions remain bounded by attacker assumptions and unvalidated settings.

6. Discussion

  • Complete-turn rendering supplies context without rerendering every converted turn, but limits lexical resynthesis rather than all acoustic change.Original-audio controls and frontend sensitivity motivate checking facts, speaker attribution, timing, and delivery across the measurement chain.Source: §6 · p. 9
  • Consistent pseudo-speakers can preserve conversational roles, yet matching language and voice traits may narrow an attacker’s search; restricted access and residual-risk review remain possible safeguards, not validated deployments.Voice-pool knowledge, auxiliary recordings, and repeated releases could strengthen the attacker; measured EER or replacement rates establish neither HIPAA compliance nor a universal release threshold.Source: §6 · p. 9
  • The study lacks an exhaustive independently annotated identifier inventory, proposition-level clinician truth, a learned conversion-adapted attacker, and a matched external complete pipeline.Its non-patient population, partial notes, and limited listening evidence leave transfer to real care untested.Source: §6 · p. 9

7. Conclusion

AegisVox treats long-form speech privacy as joint voice and lexical transformation, and its evaluation shows that better replacement realization can coexist with retained identifiers, clinical contradictions, and edited-region linkage. The study’s public non-patient scope and evaluated attackers do not establish anonymity, clinical safety, or compliance.

7. Conclusion

  • AegisVox combines consistent voice assignments with document-level lexical replacements, and its evaluation keeps replacement, identifier retention, linkage, and clinical evidence as separate outcomes.The results show more planned replacements can coexist with retained identifiers, more model-labeled contradictions, and easier edited-region linkage under the evaluated score direction.Source: §7 · p. 9

Appendix A. Reporting

  • The evaluation covers public simulated or non-patient conversations and reports privacy only against evaluated ASV attackers; it does not establish real-patient performance, anonymity, guaranteed PHI removal, or regulatory compliance.Model-adjudicated clinical endpoints are not presented as human ground truth.Source: Appendix A · p. 14
  • Transformation is one layer in controlled release; source access control, purpose limitation, provenance, residual-risk review, restricted release, and monitoring remain necessary.An adversary may have auxiliary voice recordings, metadata, or repeated access to transformed outputs.Source: Appendix A · p. 14

Appendix B. Evaluation

The evaluation uses 390 conversations totaling 63.6 hours, with stage-specific registries and denominators for speaker profiles, edit intentions, and clinical propositions. The evidence artifact provides manifests and aggregate evidence, while audio remains subject to source-specific access and redistribution terms.

Appendix B. Evaluation

  • The evaluation includes 390 conversations and 63.6 hours of audio: 272 Fareez interviews, 57 PriMock57 consultations, and 61 SIMSAMU emergency calls.The recordings comprise 329 English and 61 French conversations, with dataset, language, interaction setting, and sample size confounded.Source: Appendix B · p. 14
  • The 809 ASV conversation-speaker profiles, 611 diagnostic edit intentions, 601 matched edits, and 25,778 CAPs are distinct stage-specific counts, not interchangeable speaker or item totals.The matched editor comparison uses 601 intentions; recording-level clinical analyses use all 390 conversations.Source: Appendix B · p. 14
  • The OpenSwara pool assigns each source speaker a fixed target voice within a recording, supporting role continuity without implying protection against arbitrary auxiliary-data attacks.The evidence artifact distributes manifests, identifiers, revisions, code, hashes, and aggregate evidence, but no source, reference, transformed, or listener audio; corpus access remains governed by its listed terms.Source: Appendix B · p. 14, §B.1 · p. 15, Figure 4 · p. 15

Appendix C. Implementation Details

The appendix specifies AegisVox’s transformation pipeline, controlled comparisons, statistical units, and judge qualification. Threshold sensitivity and controlled validation bound how its results should be interpreted.

Appendix C. Implementation Details

  • The pipeline transcribes and diarizes turns, assigns each source speaker a consistent target voice, and applies SeedVC conversion before planning consistent synthetic replacements.The replacement instructions exclude changes to clinical facts, chronology, roles, actions, or decisions; F5-TTS and VoiceCraft edit complete converted turns.Source: Appendix C · pp. 15–16

Appendix D. Retrieval-Threshold Sensitivity

  • 14–23 of 809 source assignments changed across operating settings, with no detectable downstream contrasts; the tested thresholds do not establish a privacy–utility frontier.All 16 threshold combinations assigned 809/809 profiles; the balanced setting was retained for continuity, not statistical dominance.Source: Appendix D · pp. 16–17

Appendix E. Controlled Conditions

  • The four reportable conditions share 390 conversations and a frontend; the renderer comparison changes only the lexical renderer, while localized redaction removes the planned region.The original-audio condition is an additional clinical measurement control; localized redaction has no separate final-waveform ASV result.Source: Appendix E · p. 17

Statistical Protocol

  • Endpoints retain distinct populations and units, while paired clinical and lexical effects use conversation-cluster resampling and separate statistical families.Uncertain labels and generation failures remain in the intention denominator; invalid note outputs are unobserved rather than zero, and identification bounds are not confidence intervals.Source: Statistical Protocol · pp. 17–18

Appendix G. Model-Adjudication Qualification

  • 360/360 qualification judgments passed the prespecified gates, supporting a controlled adjudication protocol but not equivalence to clinical experts or ground truth.The 45 cases covered 15 corruption families and protocol variants.Source: Appendix G · p. 18

G.1. Independent open-model sensitivity

An independently qualified open model tests whether the clinical and lexical findings persist across judges. It corroborates the renderer ordering, while absolute clinical and lexical estimates remain judge-dependent.

G.1. Independent open-model sensitivity

  • Both judges assign higher replacement realization to F5-TTS than VoiceCraft, but their clinical preservation estimates differ and case-level agreement is not a calibrated substitute.Figure 7 separates weighted preservation, case agreement, and lexical ordering; Table 4 reports strict raw counts and weighted rates separately from unweighted agreement.Source: §G.1 · p. 18, Table 4 · p. 19
  • −0.0305 was the Qwen F5-TTS-minus-VoiceCraft strict-preservation effect across 600 CAPs (95% CI −0.0773 to 0.0112), with the overall contrast crossing zero under both judges.The Qwen minor stratum was −0.0739 (n = 198; CI −0.1483 to −0.0080), and systematically higher absolute Qwen rates make judge dependence part of the result.Source: §G.1 · pp. 18–19
  • 486/601 F5-TTS replacements versus 421/601 VoiceCraft replacements were judged realized by Qwen, corroborating the direction while showing judge-dependent magnitude.Both analyses use transcript evidence, not direct listening or clinician ground truth.Source: §G.1 · p. 19

Appendix H. Independent PHI-Detector Evaluation

The detector evaluation measures typed exact matching against a frozen contract and separately examines broader ontology scoring and hard negatives. The results bound what this benchmark supports rather than establishing exhaustive identifier detection.

Appendix H. Independent PHI-Detector Evaluation

  • Under typed exact matching between the frozen AegisVox contract and benchmark ontology, the detector evaluated on 1,051 ASQ-PHI queries yielded 2,043 true positives, 137 false positives, and 104 false negatives against 2,147 gold elements.Source: Appendix H · pp. 19–20
  • 0.799 full-ontology exact F1 and 0.873 boundary-tolerant F1 reflect a benchmark-contract mismatch as well as detector performance; 48/219 hard-negative queries contained predicted entities.Most false-positive predictions were dates treated as non-PHI by the benchmark, although the frozen Safe Harbor contract treats them as dates.Source: Appendix H · p. 20
  • Unique identifiers were the weakest-supported category, with only 14 gold elements; these results do not establish exhaustive detection of arbitrary speech identifiers.Boundary-tolerant scoring improved names and medical-record numbers, indicating many exact errors were span-boundary disagreements.Source: Appendix H · p. 20

Appendix I. Complete Clinical and Lexical Results

The complete results separate lexical realization, retained identifiers, and clinical outcomes across their own populations and measurement stages. Similar aggregate clinical preservation coexists with a renderer contrast in realization and more model-labeled contradictions.

Appendix I. Complete Clinical and Lexical Results

  • 535/601 planned edits were realized by F5-TTS (89.0%), versus 453/601 by VoiceCraft (75.4%); the paired realization effect was +13.64 percentage points.Original sensitive terms were retained in 28 F5-TTS edits and 21 VoiceCraft edits; those outcomes are adjudicated separately and may overlap.Source: Appendix I · p. 20, Table 7 · p. 22
  • Within AegisVox, the VoiceCraft strict-CAP effect was −0.097 percentage points (95% conversation-cluster CI −0.606 to 0.422), indicating no detectable difference under the declared test, not equivalence.AegisVox (F5-TTS) preserved 19,929/25,778 propositions (77.3%), versus 20,089/25,778 (77.9%) for the speaker-path-only control.Source: Appendix I · pp. 20–21
  • Across four conditions, role preservation ranged 0.863–0.875, chronology 0.840–0.851, final-state preservation 0.871–0.883, and action recall 0.866–0.881; harmful-action-change rates were 0.006–0.007.Figure 8 aligns clinical and lexical endpoints without collapsing their different units.Source: Appendix I · p. 21, Figure 8 · p. 23

I.1. Fresh original-audio control

  • 96.974% of frozen source CAPs were strictly preserved in the fresh original-audio control, against which transformed conditions had paired changes of −19.043 to −19.664 percentage points.The original transcripts were freshly computed, but source ASR and extraction omissions remain outside the frozen inventory, and exact historical runtime identity could not be fully verified.Source: §I.1 · pp. 21–22

I.2. Paired contradiction and uncertainty

  • 479 F5-TTS versus 391 VoiceCraft CAPs were labeled contradicted, a +0.341 percentage-point difference; uncertainty bounds show this is a contrast in explicit model labels, not unknown clinical outcomes.The reported paired contrast had CI 0.150–0.542 and two-test Holm-adjusted p = 0.001700; identification bounds allow uncertain labels to vary.Source: §I.2 · p. 22

I.3. Retained identifiers in intended inputs

  • 12/28 F5-TTS and 12/21 VoiceCraft retained cases still contained an original literal, but intended transcripts cannot establish runtime compliance or the cause of each retained identifier.The focused benchmark and final-conversation reconstruction are separate populations; their failure counts are not interchangeable.Source: §I.3 · pp. 22–23

Appendix J. Acoustic, Timing, and Documentation Preservation

  • CLAP similarity ranged 0.725–0.732 and HeAR similarity 0.945–0.946; detector-defined event recall and precision were 0.405 and 0.240 for F5-TTS.These embedding measures are not diagnostic-accuracy or human-perceptual judgments; timing and speech-activity measures also changed across conditions.Source: Appendix J · p. 23, Figure 9 · p. 24

J.1. Transcript-only note generation

Transcript-only note comparisons are sensitive to missing outcomes and unresolved selection. Final-waveform tests show that conversation-wide speaker estimates can conceal greater linkage in planned edit regions, while frontend and acoustic changes also affect downstream results.

J.1. Transcript-only note generation

  • On 314 conversations, strict preservation was 71.85% for F5-TTS versus 72.22% for VoiceCraft, while contradictions were 1.82% versus 1.34%.Full-population bounds are [−16.30, 17.01] points for preservation and [−17.40, 15.91] for contradiction, and can reverse the observed direction. No causal numerical comparison is made with the earlier fact-conditioned note experiment because validated coverage and protocols differ.Source: §J.1 · p. 24, Table 10 · p. 25

K.1. Final-waveform protocol

  • In 291 matched planned-edit profiles, F5-TTS had 11.340-point lower EER than VoiceCraft (CI −15.910 to −6.688), indicating easier linkage under this test.The regions include retained converted audio after generation failure; six additional F5-TTS profiles lacked one second of eligible speech and were excluded. Enrollment uses assigned original speech from the same recording, and this sensitivity analysis is not a learned adaptive attack.Source: §K.1 · pp. 24–25

Population Strata

  • Chronology-safe endpoints were 56.5% for English and 26.2% for French; these language-associated differences are confounded by dataset and setting.The strict conversation-level no-major-error endpoint was 5/329 for English and 2/61 for French, because one major error fails the conversation.Source: Population Strata · pp. 25–26

K.2. Historical shared-stage protocol

  • For the shared SeedVC stage, attacker-optimal EER was 0.304 with ECAPA and 0.345 with x-vector, showing residual source linkability under those tests.These are not final-waveform scores for either renderer; the tests do not model external pseudo-speaker enrollment, repeated releases, stronger future attacks, or human recognition.Source: §K.2 · p. 25, Table 12 · p. 26

Propagation

  • Across eight frontend cells, CAP ranged from 0.771 to 0.807 and matched WER from 0.217 to 0.239; endpoints moved differently across cells.Every planned Canary edit lacked linked speaker-turn and edit-timing information, yielding replacement realization of 2/481 items with NeMo and 3/596 with pyannote; these are integration failures, not intrinsic editor quality.Source: Propagation · pp. 26–27

Semantic Robustness

  • Room noise at 12-dB SNR reduced chronology safety by 0.121 (95% CI −0.175 to −0.064; Holm-adjusted p = 0.0006).Noise was applied to the source waveform before rerunning the full pipeline, including ASR and diarization; semantic-stress effects were compatible with no change after adjustment.Source: Semantic Robustness · p. 27

Appendix O. Limited Blinded Listener Panel

  • Five reviewers’ ratings were a limited qualitative check, not a population-wide estimate or formal system-superiority comparison.AegisVox (F5-TTS) had item-level means of 4.43 for meaning, 4.89 for clinical completeness, and 4.45 for naturalness; agreement varied by endpoint.Source: Appendix O · p. 27

Appendix P. Primary Effects and Privacy–Utility Projections

This appendix section documents the separation of privacy endpoints from clinical preservation, including endpoint-level projections, failure analysis, and operational and evaluation controls. It also specifies source-anchored and prompt-robustness assessment procedures for distinguishing identity replacement from clinical error and structuring clinical-outcome judgments.

Appendix P. Primary Effects and Privacy–Utility Projections

  • +13.644 percentage points was the item-weighted realization effect, while the strict CAP effect was −0.097 points; neither interval establishes equivalence.The 95% conversation-cluster CIs were 9.687–17.590 for realization and −0.606 to 0.422 for strict CAP; equal-conversation weighting gave a strict CAP contrast of −0.088 points (CI −0.797 to 0.593).Source: Appendix P · pp. 27–28, Figure 14 · p. 29

Appendix Q. Failure Taxonomy

  • 104 false-negative and 137 false-positive elements occurred in contract-primary ASQ-PHI detection; 148/601 VoiceCraft and 66/601 F5-TTS edits lacked realized replacements.Original sensitive terms remained in 21/601 (3.5%) VoiceCraft and 28/601 (4.7%) F5-TTS edits; uncertain evidence remained visible in 110/601 and 46/601, respectively. Failure totals include uncertain labels and one VoiceCraft failure, so explicit absence is not equivalent to one minus retained.Source: Appendix Q · p. 28, Appendix P · p. 28, Figure 15 · p. 29
  • 2,367 partial, 2,724 missing, 479 contradicted, and 279 uncertain judgments occurred among 25,778 F5-TTS CAPs.Harmful action change was near 0.6–0.7%, chronology not preserved near 14.9–16.0%, and role not preserved near 12.5–13.7%; Canary linkage failures and room noise create distinct upstream failure modes. These heterogeneous measures should not be summed into a global failure rate.Source: Appendix Q · p. 29

Appendix R. Operational Lessons

  • Complete-turn editing, document-consistent replacements, local reconstruction, and explicit failure accounting are operational controls for long-form processing.The artifact package records dataset rows and strata, model and software revisions, condition manifests, stage outputs, prompt snapshots, inference settings, and hashes; release remains subject to dataset licenses and redistribution restrictions. The prompts specify complete-transcript inputs and preserve clinical meaning, roles, chronology, and uncertainty rather than forcing uncertain lexical judgments to pass.Source: Appendix R · pp. 29–30, Appendix S · p. 30, Appendix T · p. 30

SYSTEM PROMPT

  • The action adjudicator freezes the source action inventory before target review and evaluates preservation and unsupported target actions without treating safe identifier replacement as an action error.It requires exact contiguous target quotes and cautions against recommending actions from world knowledge.Source: SYSTEM PROMPT · p. 36

T.1.7. Chronology adjudication

  • Chronology adjudication compares source-frozen relations for event order, state, duration, conditions, and planned-versus-completed status; safe identity replacement is not a chronology error.Target evidence must be quoted literally and contiguously.Source: SYSTEM PROMPT · pp. 36–37

T.1.8. Clinical-note generation

T.1.9. Clinical-note pair adjudication

  • The note-pair adjudicator checks CAP preservation across source and target notes against both transcripts, including modifiers, roles, final state, chronology, unsupported assertions, and section leakage.It also assesses medication, allergy, plan, final-state, and chronology exactness.Source: SYSTEM PROMPT · pp. 39–40

T.1.10. Clinical-judge qualification

  • Clinical-judge qualification varies the evidence format from transcript quotations to segment IDs and tests robustness to paraphrasing; these are judge variants, not different AegisVox systems.The initial prompt requires exact evidence from both transcripts and returns uncertain when a complete-pair decision is unsupported.Source: §T.1.10 · p. 40, Initial qualification prompt · p. 40, Prompt-robustness variant · p. 41
  • Identifier-only substitutions and meaning-preserving paraphrases count as preserved, while uncertainty, medication, role, timing, and other meaning changes do not.The segment-ID judge also requires an insufficient-evidence decision when transcripts are withheld or truncated.Source: Segment-ID qualification prompt · p. 40

Prompt-robustness variant

  • The prompt-robustness variant compares source and target transcript placeholders using structured outcome, clinical-impact, and corruption-family labels, with evidence quotes and a brief rationale.The schema also includes case identifiers and allows source/target evidence fields to be empty under specified conditions.Source: Prompt-robustness variant · p. 41

T.1.13. Fresh original-audio clinical adjudication

  • Fresh original-audio adjudication compares frozen source propositions against source and target transcripts while preserving modifiers, corrected final state, and speaker role.It uses the same frozen evaluator ASR for the target transcript and separately detects unsupported target assertions.Source: SYSTEM PROMPT · pp. 44–45

Related papers

Loading 2610.14643v1…