REVIEW 3 major objections 6 minor 29 references
Do Not Mimic My Voice: Speaker Identity Unlearning for Zero-Shot Text-to-Speech
T0 review · 3 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash
Pith's one-line read The paper proposes the first machine-unlearning method for zero-shot TTS that makes a model generate random voices for forgotten speakers while preserving speech quality for everyone else.
desk verdict First to define speaker identity unlearning for ZS-TTS; TGU suppresses mimicry convincingly, but the 'random voice' claim rests on an unverified assumption and a circular metric. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The key mechanism is Teacher-Guided Unlearning: use the frozen pre-trained model as a teacher that, when fed only text $y$, synthesizes a target utterance $\bar{x} = \theta(y)$ whose voice depends on the random initial noise $x_0$. The unlearning student is trained with the flow-matching loss to map the forget prompt $x_f$ to this random-voice target, while a separate loss on retain-speaker data preserves normal cloning. The companion metric spk-ZRF compares the speaker embedding of the unlearned model's output to the teacher's text-only output using Jensen-Shannon divergence, quantifying how random the generated identity is on forget prompts.
What would settle it
Generate many samples of $\theta(y)$ for a fixed text $y$ with different initial noises, extract speaker embeddings, and measure the pairwise speaker-similarity distribution; if those pairs are as similar as same-speaker pairs rather than spread like different-speaker pairs, the teacher's text-only output is a single fixed voice, and both the TGU target and the spk-ZRF baseline collapse.
Extended reading notes
Core claim
The paper's central claim is that a zero-shot TTS model can be unlearned for specific speaker identities by guiding its output toward the pre-trained teacher's text-only generation. Formally, for a forget speaker's prompt $x_f$ and text $y$, the unlearned model $\theta_-$ is trained so that $\theta_-(x_f, y) \approx \theta(y)$, where $\theta(y)$ is the teacher's speech synthesized from text alone; because that text-only output varies with the initial noise $x_0$, the model learns to produce a random voice instead of the forget speaker's. In experiments on VoiceBox, TGU drops speaker similarity on the forget set to 0.169, near the different-speaker baseline, while keeping remain-set similarity at 0.631 (a 2.8% drop from the original) and WER essentially unchanged. The paper also shows that TGU outperforms sample-guided, gradient-ascent, and KL-divergence baselines, and that spk-ZRF captures the desired randomness in a way that raw SIM scores alone do not.
Load-bearing premise
The load-bearing assumption is that the teacher model, given only text, produces a distribution of many different random voices across different initial noises rather than collapsing to one fixed voice.
Editorial extensions
If this is right
- Voice-privacy opt-out requests can be acted on in the model weights themselves, not just by filtering or anonymizing speaker embeddings.
- A forgotten speaker's prompt will produce a different, untraceable voice on each call, so there is no consistent output identity to reverse-engineer.
- Remain speakers keep near-original similarity and intelligibility, so the model stays useful after unlearning.
- The method scales to removing multiple speakers at once and also works for speakers that were never in the pre-training data.
- spk-ZRF provides a way to audit whether an unlearned model is truly random on forget prompts rather than merely inconsistent-looking.
Reading between the lines
- If text-only teacher generations are truly diverse across initial noise, the same teacher-target recipe could transfer to other zero-shot TTS architectures that have a text-only conditioning path, replacing the flow-matching loss with the appropriate training objective.
- spk-ZRF could be repurposed as a black-box audit for TTS APIs: repeatedly query with a fixed text and no reference prompt, then check whether the returned speakers collapse to one identity.
- A natural adversarial test is to collect many generations from a forget prompt and attempt clustering; if the paper's randomness claim holds, the cluster structure should be no better than random speakers, not recoverable to the original voice.
- A practical extension would be to make the randomness intensity a tunable knob, varying how far the forget output moves from the original voice, which the current binary forget/remain setup does not expose.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper proposes the first machine unlearning framework for zero-shot text-to-speech (ZS-TTS), applied to VoiceBox. Two methods are introduced: Sample-Guided Unlearning (SGU), which pairs a forget-speaker prompt with a remain-speaker audio target, and Teacher-Guided Unlearning (TGU), which uses the pre-trained teacher's text-only generation θ(y) as the target for forget-speaker prompts. The paper also introduces a metric, spk-ZRF, that measures the similarity between student outputs on forget prompts and the teacher's text-only outputs, interpreting high similarity as high randomness. Experiments report that TGU reduces SIM-F to 0.169 while maintaining SIM-R at 0.631, with competitive WER, and includes scalability, out-of-domain, human evaluation, robustness, recovery, and reproducibility experiments.
Significance. The task of speaker identity unlearning for ZS-TTS is timely and practically important, and the paper is the first to address it directly. TGU is a simple and principled way to steer the model away from reproducing a forget speaker's voice, and the experimental suite is unusually broad for a first paper on the topic, including human listening tests, recovery attacks, robustness to similar-sounding remain speakers, and out-of-domain forgetting. The method's ability to reduce SIM-F to near the different-speaker baseline is a concrete and useful result. However, the headline claim that forgotten identities become 'untraceable' through 'random voice generation' rests entirely on the unverified assumption that the teacher's text-only output θ(y) produces diverse speaker identities; the proposed metric spk-ZRF inherits this assumption. The significance of the paper is therefore conditional on an additional, directly testable measurement that the manuscript does not provide.
major comments (3)
- [§4.2, Eq. (7); §4.3, Eqs. (10)-(12)] The central claim that TGU produces random speaker identities for forget prompts is asserted but never measured. Section 4.2 states that θ(y) 'varies depending on the initialization of x0,' and Section 4.3 states that each θ(y_i) 'will synthesize a random speaker's identity,' but no experiment reports the dispersion of speaker embeddings, pairwise SIM scores, or effective number of distinct voices among repeated θ(y) samples, nor compares these against the different-speaker baseline in Appendix C. If θ(y) instead collapses to a single or narrow set of voices, then the TGU target in Eq. (7) is a fixed pseudo-speaker, and the spk-ZRF metric in Eqs. (10)-(12) simply rewards the student for matching the same quantity that the training loss already pushes it toward; the high spk-ZRF-F of 0.871 would then indicate consistency with a fixed pseudo-voice, not randomness. The t-SNE in Figure 3 cannot distinguish a broad random scatter from one tight cluster centered at a pseudo-voice. Please add direct measurements of θ(y) diversity, such as the distribution of WavLM embedding similarities for multiple θ(y) samples for the same and different texts, compared with the same-speaker and different-speaker reference distributions in Figure 4, and report the resulting variance or cluster count. In addition, calibrate spk-ZRF by reporting its value for a deliberately non-random baseline, such as a model that always outputs a fixed voice for forget prompts.
- [Table 1; Appendix E, Table 5] The key quantitative comparisons lack measures of uncertainty and pairwise significance tests. Appendix E reports a one-way ANOVA, which tests whether the method factor has any effect at all, but it does not establish that the crucial differences reported in Table 1 are significant: TGU vs. SGU on SIM-F (0.169 vs. 0.194) and on spk-ZRF-F (0.871 vs. 0.866) could easily be within sampling noise. No error bars or confidence intervals are reported for any SIM, WER, or spk-ZRF value, and the number of evaluation samples per cell is not stated. Please report standard errors or confidence intervals computed over evaluation samples (or over multiple unlearning runs), and add pairwise tests, such as paired bootstrap or Tukey's HSD, for the TGU vs. SGU comparisons that support the paper's main claims.
- [§4.1; Figure 2(b)] The SGU formulation does not actually implement random-speaker guidance. Concatenating (x_f, y_f) and (x_r, y_r), then masking only the x_r portion, trains the model to infill the remain speaker's audio using the forget speaker's audio as context; this is a copying or style-transfer objective, not a randomness objective. The substantial SIM-R drop for SGU (0.523 vs. the original 0.649 in Table 1) is plausibly a consequence of the artificial concatenation artifacts described in Section 4.1, rather than a property of guided unlearning. A controlled comparison, for example training SGU with different mask positions or with a randomized target speaker, would clarify which mechanism causes the observed forgetting effect.
minor comments (6)
- [Appendix E, Table 5 caption] The caption contains the typo 'ANOV AF'; it should read 'ANOVA'.
- [Appendix H] The text 'The y-aixs was then obtained' contains a typo; it should be 'y-axis'.
- [§4.3] The word 'uncertainity' is misspelled; it should be 'uncertainty'.
- [Throughout] The model name 'VoiceBox' is inconsistently spaced as 'V oiceBox' in many places; please standardize the formatting.
- [§2.2] The reference for the AND framework, cited as '(Wu et al.)', is incomplete: it lacks a year, venue, and page information.
- [§5.1; Appendix K] The sentence 'For the experiment in Table 13' refers to a table that appears only in Appendix K; please renumber or cross-reference more clearly so the main text does not point to a table before it is introduced.
Circularity Check
TGU's 'random voice' result is circular: spk-ZRF (Eqs. 10-12) scores forget-set outputs by their closeness to the teacher's text-only output θ(y), which Eq. (7) already trains θ− to match; high randomness is therefore guaranteed by construction, not independently measured.
-
self definitional
[Section 4.2, Eq. (7); Section 4.3, Eqs. (10)-(12)]
"Using θ(y) as target guidance thus assures that at each initialization, the model generates varying voice styles, reducing the risk of reproducing identifiable information on forget speaker's voice: θ−(xf , y) ≈ θ(y). (6) ... To evaluate an unlearned model θ− on a given a test dataset DS = {(xs yi , yi)}n i=1, we generate two comparable speech for each i-th sample (xs i , yi) : θ−(xs i , yi) and θ(yi). Across n samples, each θ(yi) will synthesize a random speaker's identity, forming a random probability distribution."
Eq. (7) defines the unlearning target as x̄ = θ(y), the teacher's text-only output, and minimizes the CFM loss so that θ−(xf , y) matches that target. The spk-ZRF metric then defines randomness as small JSD between θ−'s output and the same θ(y) reference (Eqs. 10-12). A student that fully minimizes Eq. (7) will by construction score spk-ZRF ≈ 1 on forget prompts, even if θ(y) collapses to a single fixed pseudo-voice; the metric cannot distinguish 'random identity distribution' from 'faithful mimicry of the training target'. The claimed random-voice behavior is thus the training objective renamed as an evaluation outcome, with no independent measurement of θ(y) diversity (e.g., pairwise embedding spread of repeated θ(y) samples) provided.
full rationale
The core randomness claim is not independently demonstrated: the 'random voice' property is defined through θ(y), which is simultaneously the TGU training target. High spk-ZRF-F for TGU is therefore expected by construction, and it cannot support the headline claim that forget speakers are untraceable. The paper also asserts without measurement that text-only generation θ(y) yields varying voices across x0 initializations; if this assumption fails, TGU simply imprints a fixed pseudo-voice and spk-ZRF still reports 'randomness'. However, several parts of the paper are externally anchored and not circular: remain-set SIM/WER retention, low SIM-F on forget prompts against the different-speaker baseline, human CMOS/SMOS, OOD generalization, recovery, and reproducibility experiments all use independent references. The circularity is concentrated in the randomness/untraceability claim and the spk-ZRF metric, but that is a central advertised contribution, so a score of 7 is appropriate.
Assumptions & free parameters
free parameters (3)
- lambda loss weight =
0.2
- forget sample sampling probability =
20%
- CFG guidance scale alpha =
0.7
assumptions (3)
- domain assumption Teacher text-only generation theta(y) produces a distribution of random speaker identities, not a single fixed voice.
- domain assumption WavLM-TDCNN speaker embeddings reliably capture speaker identity for both similarity and JSD-based randomness measurement.
- standard math Flow matching / conditional flow matching formulation of VoiceBox is accepted as given.
Cite this review
Pith. "Pith review of Do Not Mimic My Voice: Speaker Identity Unlearning for Zero-Shot Text-to-Speech." pith.science (2026). https://pith.science/paper/663PEULL
@misc{pith2026250720140,
author = {Pith},
title = {Pith review of: Do Not Mimic My Voice: Speaker Identity Unlearning for Zero-Shot Text-to-Speech},
year = {2026},
howpublished = {\url{https://pith.science/paper/663PEULL}},
note = {Machine review of arXiv:2507.20140}
}
read the original abstract
The rapid advancement of Zero-Shot Text-to-Speech (ZS-TTS) technology has enabled high-fidelity voice synthesis from minimal audio cues, raising significant privacy and ethical concerns. Despite the threats to voice privacy, research to selectively remove the knowledge to replicate unwanted individual voices from pre-trained model parameters has not been explored. In this paper, we address the new challenge of speaker identity unlearning for ZS-TTS systems. To meet this goal, we propose the first machine unlearning frameworks for ZS-TTS, especially Teacher-Guided Unlearning (TGU), designed to ensure the model forgets designated speaker identities while retaining its ability to generate accurate speech for other speakers. Our proposed methods incorporate randomness to prevent consistent replication of forget speakers' voices, assuring unlearned identities remain untraceable. Additionally, we propose a new evaluation metric, speaker-Zero Retrain Forgetting (spk-ZRF). This assesses the model's ability to disregard prompts associated with forgotten speakers, effectively neutralizing its knowledge of these voices. The experiments conducted on the state-of-the-art model demonstrate that TGU prevents the model from replicating forget speakers' voices while maintaining high quality for other speakers. The demo is available at https://speechunlearn.github.io/
Figures
Figures from the paper (5 more)
Reference graph
Works this paper leans on
-
[2]
Additionally, forget samples xf and remain samples xr were selected and trained in a 2:8 ratio. B.3. Exact Unlearning & Fine-Tuning The Exact Unlearning method was trained with the same configuration as the pre-training, except that only the dataset Dr was used. Similarly, the Fine Tuning method involved additional training for 145K steps, exclusively usi...
work page 2022
-
[5]
ISBN 978-1-57735-880-0. doi: 10.1609/aaai.v37i6.25879. D´efossez, A., Copet, J., Synnaeve, G., and Adi, Y . High fidelity neural audio compression. Transactions on Ma- chine Learning Research,
-
[7]
doi: 10.18653/v1/2023.acl-long.805
Association for Computa- tional Linguistics. doi: 10.18653/v1/2023.acl-long.805. Ju, Z., Wang, Y ., Shen, K., Tan, X., Xin, D., Yang, D., Liu, Y ., Leng, Y ., Song, K., Tang, S., et al. Naturalspeech 3: Zero-shot speech synthesis with factorized codec and diffusion models. International Confernce on Machine Learning,
-
[8]
Libri-light: A benchmark for asr with limited or no supervision
Kahn, J., Riviere, M., Zheng, W., Kharitonov, E., Xu, Q., Mazar´e, P.-E., Karadayi, J., Liptchinsky, V ., Collobert, R., Fuegen, C., et al. Libri-light: A benchmark for asr with limited or no supervision. In ICASSP 2020-2020 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 7669–7673. IEEE,
work page 2020
-
[9]
doi: 10.1109/ICASSP48485.2024.10447120. Kong, J., Kim, J., and Bae, J. Hifi-gan: Generative ad- versarial networks for efficient and high fidelity speech synthesis. Advances in neural information processing systems, 33:17022–17033,
arXiv 2024
-
[11]
Eight methods to evaluate robust unlearning in llms
Lynch, A., Guo, P., Ewart, A., Casper, S., and Hadfield- Menell, D. Eight methods to evaluate robust unlearning in llms. arXiv preprint arXiv:2402.16835,
-
[12]
Maini, P., Feng, Z., Schwarzschild, A., Lipton, Z. C., and Kolter, J. Z. TOFU: A task of fictitious unlearning for LLMs. In ICLR 2024 Workshop on Navigating and Ad- dressing Data Problems for Foundation Models,
work page 2024
-
[15]
Nautsch, A., Jasserand, C., Kindt, E., Todisco, M., Tran- coso, I., and Evans, N. The gdpr & speech data: Re- flections of legal and technology communities, first steps towards a common understanding. arXiv preprint arXiv:1907.03458, 2019a. Nautsch, A., Jim´enez, A., Treiber, A., Kolberg, J., Jasserand, C., Kindt, E., Delgado, H., Todisco, M., Hmani, M. A...
arXiv 1907
Show all 29 references
-
[17]
Librispeech: An asr corpus based on public domain au- dio books
Panayotov, V ., Chen, G., Povey, D., and Khudanpur, S. Librispeech: An asr corpus based on public domain au- dio books. In 2015 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 5206–5210,
2015
-
[19]
Regulation (eu) 2016/679 of the european parliament and of the council
Regulation, P. Regulation (eu) 2016/679 of the european parliament and of the council. Regulation (eu), 679:2016,
2016
-
[20]
Unrolling sgd: Understanding factors influencing ma- chine unlearning
Thudi, A., Deza, G., Chandrasekaran, V ., and Papernot, N. Unrolling sgd: Understanding factors influencing ma- chine unlearning. In 2022 IEEE 7th European Symposium on Security and Privacy (EuroS&P), pp. 303–319. IEEE,
2022
-
[21]
Tomashenko, N., Wang, X., Vincent, E., Patino, J., Sri- vastava, B. M. L., No ´e, P.-G., Nautsch, A., Evans, N., Yamagishi, J., O’Brien, B., et al. The voiceprivacy 2020 challenge: Results and findings. Computer Speech & Language, 74:101362,
2020
-
[22]
The voiceprivacy 2024 challenge evaluation plan
11 Do Not Mimic My Voice: Speaker Identity Unlearning for Zero-Shot Text-to-Speech Tomashenko, N., Miao, X., Champion, P., Meyer, S., Wang, X., Vincent, E., Panariello, M., Evans, N., Yamagishi, J., and Todisco, M. The voiceprivacy 2024 challenge evaluation plan. 4th Symposium...
2024
-
[23]
Ma- chine unlearning of features and labels
Warnecke, A., Pirch, L., Wressnegger, C., and Rieck, K. Ma- chine unlearning of features and labels. The Network and Distributed System Security Symposium (NDSS) 2022 ,
2022
-
[24]
Forget- me-not: Learning to forget in text-to-image diffusion models
Zhang, G., Wang, K., Xu, X., Wang, Z., and Shi, H. Forget- me-not: Learning to forget in text-to-image diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 1755– 1764, 2024a. Zhang, Y ., Jia, J., Chen, X., Chen, A., Zhang,...
2024
-
[25]
to phonemize and force-align the transcripts, utilizing the MFA phone set, a modified version of the International Phonetic Alphabet (IPA), while also applying word position prefixes. A.3. Model Configurations We applied both baseline machine unlearning methods and the propose...
2024
-
[26]
English speech dataset, is employed to convert the spectrogram into a time-domain waveform. A.5. Pre-training Following (Le et al., 2024), we trained the original V oice model for 500K steps. Each mini-batch consisted of 75-second audio segments, and the Adam optimizer was emp...
2024
-
[28]
From LibriSpeech test-clean dataset samples of durations 4 to 10 seconds, we construct noise at a -10dB signal-to-noise ratio over half of each sample’s duration
to analyze how TGU unlearned model performs on the task of transient noise removal. From LibriSpeech test-clean dataset samples of durations 4 to 10 seconds, we construct noise at a -10dB signal-to-noise ratio over half of each sample’s duration. Table 10 suggests that TGU pro...
2024
-
[29]
WER and SIM evaluation follows the procedures of Table1
Quantitative results for recovery experiments on unlearned models. WER and SIM evaluation follows the procedures of Table1. Methods Recover Steps Audio per Spk WER-R ↓ SIM-R ↑ WER-F ↓ SIM-F ↑ Original - 15 min 2.1 0.649 2.1 0.708 TGU - 15 min 2.5 0.631 2.4 0.169 TGU 36.25K 15 ...
2019
-
[2006]
doi: 10.1109/18.61115
ISSN 0018-9448. doi: 10.1109/18.61115. Lipman, Y ., Chen, R. T., Ben-Hamu, H., Nickel, M., and Le, M. Flow matching for generative modeling. The Eleventh International Conference on Learning Representations,
-
[2013]
Montreal forced aligner: Trainable text- speech alignment using kaldi
McAuliffe, M., Socolof, M., Mihuc, S., Wagner, M., and Sonderegger, M. Montreal forced aligner: Trainable text- speech alignment using kaldi. In Interspeech 2017, pp. 498–502,
2017
-
[2015]
Press, O., Smith, N
doi: 10.1109/ICASSP.2015.7178964. Press, O., Smith, N. A., and Lewis, M. Train short, test long: Attention with linear biases enables input length extrapolation. The Tenth International Conference on Learning Representations,
2015
-
[2017]
the right to be forgotten
doi: 10.21437/Interspeech.2017-1386. Mirzasoleiman, B., Karbasi, A., and Krause, A. Deletion- robust submodular maximization: Data summarization with “the right to be forgotten”. In International Con- ference on Machine Learning , pp. 2449–2458. PMLR,
2017 doi
-
[2018]
Wavlm: Large-scale self-supervised pre- training for full stack speech processing
Chen, S., Wang, C., Chen, Z., Wu, Y ., Liu, S., Chen, Z., Li, J., Kanda, N., Yoshioka, T., Xiao, X., Wu, J., Zhou, L., Ren, S., Qian, Y ., Qian, Y ., Wu, J., Zeng, M., Yu, X., and Wei, F. Wavlm: Large-scale self-supervised pre- training for full stack speech processing. IEEE J...
1941
-
[2019]
A., Jia, H., Travers, A., Zhang, B., Lie, D., and Papernot, 9 Do Not Mimic My Voice: Speaker Identity Unlearning for Zero-Shot Text-to-Speech N
Bourtoule, L., Chandrasekaran, V ., Choquette-Choo, C. A., Jia, H., Travers, A., Zhang, B., Lie, D., and Papernot, 9 Do Not Mimic My Voice: Speaker Identity Unlearning for Zero-Shot Text-to-Speech N. Machine unlearning. In 2021 IEEE Symposium on Security and Privacy (SP), pp. ...
2021
-
[2022]
Five years of the right to be forgotten
Bertram, T., Bursztein, E., Caro, S., Chao, H., Chin Feman, R., Fleischer, P., Gustafsson, A., Hemerly, J., Hibbert, C., Invernizzi, L., et al. Five years of the right to be forgotten. In Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, pp...
2019
-
[2023]
Graph unlearning
Chen, M., Zhang, Z., Wang, T., Backes, M., Humbert, M., and Zhang, Y . Graph unlearning. InProceedings of the 2022 ACM SIGSAC conference on computer and commu- nications security, pp. 499–513, 2022a. Chen, M., Gao, W., Liu, G., Peng, K., and Wang, C. Bound- ary unlearning: Rap...
2022
-
[2024]
and Salimans, T
Ho, J. and Salimans, T. Classifier-free diffusion guidance. arXiv preprint arXiv:2207.12598,
-
[2025]
doi: 10.1145/3749987
ISSN 2157-6904. doi: 10.1145/3749987. URL https://doi.org/10.1145/3749987. Panariello, M., Tomashenko, N., Wang, X., Miao, X., Cham- pion, P., Nourtel, H., Todisco, M., Evans, N., Vincent, E., and Yamagishi, J. The voiceprivacy 2022 chal- lenge: Progress and perspectives in vo...
Reviewed August 6, 2026 · model on record in the stance chip above.
Discussion (0). Sign in to comment.