Pith. sign in

REVIEW 3 major objections 5 minor 40 references

DiffAttack: Diffusion-based Timbre-reserved Adversarial Attack in Speaker Identification

T0 review · 3 major / 5 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read DiffAttack embeds adversarial constraints in the reverse diffusion process of a voice-conversion model, claiming 65.76% targeted attack success on a speaker identification system while keeping generated speech natural and close to the…

desk verdict The empirical comparison is clear, but the paper never writes down the actual training loss with the adversarial term, so the central mechanism is unsubstantiated as written. read the letter →

arxiv 2501.05127 v1 pith:ZFSN6ZVG submitted 2025-01-09 cs.SD eess.AS

Qing Wang , Jixun Yao , Zhaokai Sun , Pengcheng Guo , Lei Xie , John H.L. Hansen This is my paper · ORCID
classification cs.SDeess.AS
keywords adversarialattackspeakeridentificationdiffusionmodelvoiceconversiontimbrepreservationtargetedreversespeechbiometrics
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that a speaker identification system can be attacked by fake audio that is generated, not perturbed after the fact. The proposed method, DiffAttack, folds adversarial constraints into the training of a diffusion-based voice conversion model, guiding the reverse diffusion process toward a chosen target speaker's distribution. On LibriTTS, the attack succeeds in 65.76% of trials, up from 28.40% for the unmodified DiffVC model and 57.30% for the authors' earlier constraint-based attack. The generated speech keeps high perceived quality (MOS 3.88) and speaker similarity (MOS 3.85), close to the unmodified model's 3.92 and 3.88. If correct, this shows a class of natural-sounding fake voices that are also machine-misdirecting.

What carries the argument

The central object is the reverse diffusion process of the DiffVC model, the gradual denoising stage that reconstructs a Mel-spectrogram from noise, with an added adversarial condition: at each timestep $t$ the current spectrogram $x_t$ is fed to a speaker classifier, and if the classifier does not output the target speaker label $y'$, a bounded perturbation $\delta$ is added to $x_t$ (Eq. 5) and an MSE loss $L_{\text{adv}}$ between the ground-truth and adversarial spectrograms (Eq. 6) guides the training. This is intended to make the score function $s_\theta(x_t, \bar{x}_0, t)$ push generated Mel-spectrograms toward the target speaker's distribution while still reconstructing natural speech. The paper states the training objective as the standard diffusion score-matching loss (Eq. 7); how $L_{\text{adv}}$ is combined with that loss is not written out.

What would settle it

Retrain DiffAttack with the adversarial loss set to zero and all other settings identical; if attack success remains near 65.76% rather than falling toward the 28.40% of vanilla DiffVC, the claimed mechanism is not what drives the result.

Watch

Extended reading notes

Core claim

DiffAttack is a targeted attack on speaker identification built on a diffusion-based voice conversion model (DiffVC). During training, a speaker classifier examines each intermediate Mel-spectrogram produced in the reverse diffusion process; when that spectrogram is not classified as the target speaker, a small bounded perturbation is added and an MSE loss pulls the generated spectrogram toward the adversarially modified version. This is meant to guide the reverse diffusion toward the target speaker's distribution without degrading timbre. The paper reports that this constraint-based training raises attack success from 28.40% for vanilla DiffVC to 65.76%, stays above the 57.30% of the prior VC+ADV Constraint method, and yields MOS scores (3.88 quality, 3.85 similarity) that nearly match the vanilla model. The central discovery claim is that embedding adversarial constraints inside the generative process, rather than perturbing finished audio, gives more natural and more effective fake speech for attacking speaker identification.

Load-bearing premise

The paper never writes out how the adversarial loss is combined with the diffusion training loss, so it is not demonstrated that the adversarial constraint is what teaches the model to misdirect the speaker identifier.

Editorial extensions

If this is right

  • Fake audio for attacking a speaker-ID system can be produced natively by a voice conversion model, without adding perturbations to finished waveforms, which keeps quality close to the clean generator.
  • DiffAttack outperforms both the unmodified DiffVC (28.40% vs 65.76%) and the prior VC+ADV constraint attack (57.30% vs 65.76%), so placing the constraint inside the diffusion process is the source of the reported gain.
  • The attack works across a practical setup: source speech from LibriTTS converted to 10 target speakers fools a speaker identification model trained on VoxCeleb and finetuned on LibriTTS.
  • The generated audio remains similar to the target speaker (MOS 3.85), so the attack combines machine deception with human-level timbre matching.
  • Direct adversarial perturbation remains the reported upper bound (73.40% success), suggesting a ceiling for this constraint-based approach without additional post-hoc perturbation.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • One extension not pursued in the paper: if the mechanism is as described, the same constraint-in-reverse-diffusion recipe could transfer to other diffusion-based speech generators (for example text-to-speech or singing voice synthesis), turning them into targeted speaker-ID attackers without any post-hoc perturbation.
  • A testable operating curve is left implicit: varying the perturbation bound $\epsilon$ or the weight of $L_{\text{adv}}$ should trade attack success against perceived quality, and the paper does not report this trade-off.
  • Because Eq. (7) is written as the standard score-matching objective and the adversarial loss appears only in Eqs. (5)-(6), a reader cannot determine from the text alone how the two are combined; an explicit combination rule would be the most direct reproducibility check.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes DiffAttack, an adversarial attack on speaker identification that trains a diffusion-based voice conversion model with adversarial constraints in the reverse diffusion process, aiming to generate timbre-preserving fake audio that is classified as a target speaker. On LibriTTS with an ECAPA-TDNN SID model, the method reports a targeted attack success rate of 65.76%, outperforming vanilla DiffVC (28.40%), DiffVC+SPK Constraint (57.60%), and prior VC+ADV Constraint (57.30%), while maintaining comparable or better MOS and CMOS scores. The central claim is that adversarial constraints integrated into the reverse diffusion process improve attack success without degrading quality.

Significance. If the central mechanism were fully demonstrated, the work would be a useful contribution in the intersection of voice conversion and adversarial robustness for SID, particularly because it shows a path to timbre-preserving fake audio. The paper includes a reasonable set of baseline comparisons and both objective and subjective quality evaluations, and the comparisons with the authors' prior work [25] and with direct perturbation are informative. However, the missing specification of the training objective connecting Eqs. (5)-(7) prevents the reader from verifying that the adversarial constraint is actually responsible for the reported gains. No code or public implementation is provided, and the evaluation is limited to one architecture and one corpus, with no variance estimates.

major comments (3)
  1. [Section II-B, Eq. (7)] The decoder training objective in Eq. (7) is the standard diffusion score-matching loss and contains no adversarial term; Eqs. (5) and (6) introduce Ladv and an MSE constraint, but the paper never states how Ladv is combined with Eq. (7), which parameters are optimized (θ, δ, or both), or whether the adversarial constraint participates during inference. This is a load-bearing gap because the reported improvement over the 'DiffVC+SPK Constraint' baseline is attributed to the adversarial constraint; as written, the method collapses to an ordinary DiffVC model conditioned on the target speaker embedding, so the success-rate gain could be due to voice-conversion fidelity rather than the attack mechanism. Please provide the exact total loss, the optimization algorithm, and training details, or release the code.
  2. [Section II-B, Eq. (5)] The adversarial perturbation δ is not fully specified: it is claimed to be optimized via min LCE(f(xt+δ), y') subject to ∥δ∥<ϵ, but the paper does not state how this optimization is performed (e.g., number of PGD steps, step size), how the constraint is enforced, how ϵ is chosen, or whether δ is computed separately for each timestep t. Since the choice of ϵ is a free parameter and is never reported in the experiments, the reader cannot assess the strength of the attack or reproduce Table I.
  3. [Section IV-A, Table I] The attack success rates are reported as single numbers without error bars, and the evaluation uses only one SID model (ECAPA-TDNN) and one dataset (LibriTTS). Moreover, the same ECAPA-TDNN model is used both as the speaker classifier inside the diffusion training (white-box) and as the target SID model, so the reported success rate does not provide an independent measure of robustness against the target system. At a minimum, the authors should report variance over multiple runs, evaluate transferability to a different SID architecture, or include a black-box setting.
minor comments (5)
  1. [Section IV-A] Table I is referenced as 'Tabel I' in the text; correct the typo.
  2. [Section II-B, Eq. (7)] The denominator in the integral appears as '2 2' and should be formatted as a squared L2 norm; also the loss terms are not defined with respect to the adversarial examples.
  3. [Section III-B] The names 'DiffVC+SPK Constraint' and 'DiffVC+ADV Constraint' are used inconsistently; the final method is called 'DiffAttack' in the abstract but not in Table I.
  4. [Section IV-B] The CMOS and MOS results in Table II are reported with standard errors, but the number of listeners and the test protocol are not described; please provide this information for reproducibility.
  5. [References] Several references contain spacing issues (e.g., 'Y .' in Refs. [28], [30], [32]) and the arXiv identifiers are formatted inconsistently.

Circularity Check

0 steps flagged · score 0.0 of 10

No circular derivation found; the reported attack success is an empirical result and not constructed from the method's inputs.

full rationale

DiffAttack's central claim is an empirical attack-success improvement, not a derived quantity. The method combines a DiffVC backbone (Eqs. 1–4, 7), an adversarial perturbation defined in Eqs. 5–6, and an evaluation against ECAPA-TDNN. None of these steps defines the reported success rate in terms of the inputs by construction: the attack success rate is measured independently on generated audio, and the baseline comparisons are external. The paper's self-citations ([14], [25]) are used as baselines and upper bounds, not as evidence that the method must work. The white-box use of the same ECAPA-TDNN for constraint and evaluation is a standard white-box attack setup; it is a limitation on generalization, not a circular derivation. However, there is a genuine internal gap: Eq. (7) is the ordinary diffusion score-matching loss and contains no Ladv from Eq. (6), so the paper does not actually specify how the adversarial constraint changes the learned score function. This missing total objective undermines the mechanism claim, but it is an omission of specification rather than an equivalence-by-construction between input and output. Therefore no circularity is identified.

Assumptions & free parameters 1 free parameters · 3 assumptions · 0 invented entities

The ledger contains the diffusion model assumption, the speaker classifier guidance assumption, and the unresolved training-objective assumption. No new physical entities are postulated. The perturbation bound epsilon is the only free parameter, and it is not reported.

free parameters (1)
  • Perturbation bound epsilon
    Appears in Eq. (5) as the constraint ||delta|| < epsilon but no value is reported anywhere in the experimental setup; the bound controls the strength of the adversarial constraint and could affect the attack-success-quality tradeoff.
assumptions (3)
  • domain assumption The DiffVC model is a scalable, high-quality voice conversion approach as described in [28], and its pretrained encoder/decoder can be modified with adversarial constraints.
    The paper relies on the DiffVC model's ability to generate high-quality converted speech; this is assumed from [28] and not reproduced or verified here.
  • domain assumption The speaker classifier (ECAPA-TDNN) trained on VoxCeleb and finetuned on LibriTTS provides reliable, differentiable signal for adversarial constraints at intermediate diffusion timesteps.
    The adversarial constraint uses gradients from the speaker classifier on partially denoised Mel-spectrograms xt; the paper assumes these gradients are meaningful for modifying the reverse diffusion output.
  • ad hoc to paper The reverse diffusion score matching objective Eq. (7) is the correct training objective even after adversarial constraints are introduced, despite no adversarial term appearing in the loss.
    The paper claims adversarial constraints are integrated into training, but Eq. (7) is the standard score-matching loss. The exact combination of Ladv with this loss is never stated.

how reviews work

0 comments
Cite this review

Pith. "Pith review of DiffAttack: Diffusion-based Timbre-reserved Adversarial Attack in Speaker Identification." pith.science (2026). https://pith.science/paper/ZFSN6ZVG

@misc{pith2026250105127,
  author       = {Pith},
  title        = {Pith review of: DiffAttack: Diffusion-based Timbre-reserved Adversarial Attack in Speaker Identification},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ZFSN6ZVG}},
  note         = {Machine review of arXiv:2501.05127}
}
read the original abstract

Being a form of biometric identification, the security of the speaker identification (SID) system is of utmost importance. To better understand the robustness of SID systems, we aim to perform more realistic attacks in SID, which are challenging for both humans and machines to detect. In this study, we propose DiffAttack, a novel timbre-reserved adversarial attack approach that exploits the capability of a diffusion-based voice conversion (DiffVC) model to generate adversarial fake audio with distinct target speaker attribution. By introducing adversarial constraints into the generative process of the diffusion-based voice conversion model, we craft fake samples that effectively mislead target models while preserving speaker-wise characteristics. Specifically, inspired by the use of randomly sampled Gaussian noise in conventional adversarial attacks and diffusion processes, we incorporate adversarial constraints into the reverse diffusion process. These constraints subtly guide the reverse diffusion process toward aligning with the target speaker distribution. Our experiments on the LibriTTS dataset indicate that DiffAttack significantly improves the attack success rate compared to vanilla DiffVC and other methods. Moreover, objective and subjective evaluations demonstrate that introducing adversarial constraints does not compromise the speech quality generated by the DiffVC model.

Figures

Figures reproduced from arXiv: 2501.05127 by the authors.

Figure 2
Figure 2. The architecture of the encoder, which is trained separately from the [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 1
Figure 1. An overview of diffusion-based timbre-reserved adversarial attack in [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 3
Figure 3. An overview of the reverse diffusion process. At each timestep [PITH_FULL_IMAGE:figures/full_fig_p003_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: The o-MOS of different kinds of generation methods. [PITH_FULL_IMAGE:figures/full_fig_p004_4.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

40 extracted references · 22 canonical work pages

  1. [25]

    Timbre-reserved adversarial attack in speaker identification,

    Q. Wang, J. Yao, L. Zhang, P. Guo, and L. Xie, “Timbre-reserved adversarial attack in speaker identification,” IEEE/ACM Transactions on Audio, Speech, and Language Processing , 2023

    work page 2023

  2. [1]

    Speaker recognition by machines and humans: A tutorial review,

    J. H. Hansen and T. Hasan, “Speaker recognition by machines and humans: A tutorial review,” IEEE Signal Processing Magazine , vol. 32, no. 6, pp. 74–99, 2015

    work page 2015

  3. [2]

    Robust text-independent speaker iden- tification using Gaussian mixture speaker models,

    D. A. Reynolds and R. C. Rose, “Robust text-independent speaker iden- tification using Gaussian mixture speaker models,” IEEE Transactions on Speech and Audio Processing , vol. 3, no. 1, pp. 72–83, 1995

    work page 1995

  4. [3]

    Detecting converted speech and natural speech for anti-spoofing attack in speaker recognition,

    Z. Wu, E. S. Chng, and H. Li, “Detecting converted speech and natural speech for anti-spoofing attack in speaker recognition,” in Proc. INTERSPEECH, 2012, pp. 1700–1703

    work page 2012

  5. [4]

    Spoofing and countermeasures for speaker verification: a survey,

    Z. Wu, N. Evans, T. Kinnunen, J. Yamagishi, F. Alegre, and H. Li, “Spoofing and countermeasures for speaker verification: a survey,” Speech Communication , vol. 66, pp. 130–153, 2015

    work page 2015

  6. [5]

    ASVspoof: the automatic speaker verification spoofing and countermeasures challenge,

    Z. Wu, J. Yamagishi, T. Kinnunen, C. Hanilc ¸i, M. Sahidullah, A. Sizov, N. Evans, M. Todisco, and H. Delgado, “ASVspoof: the automatic speaker verification spoofing and countermeasures challenge,” IEEE Journal of Selected Topics in Signal Processing , vol. 11, no. 4, pp. 588–604, 2017

    work page 2017

  7. [6]

    Explaining and harnessing adversarial examples,

    I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” arXiv preprint arXiv:1412.6572 , 2014

    arXiv 2014

  8. [7]

    Towards evaluating the robustness of neural networks,

    N. Carlini and D. Wagner, “Towards evaluating the robustness of neural networks,” in Proc. SP. IEEE, 2017, pp. 39–57

    work page 2017

Show all 40 references
  1. [8]

    Intriguing properties of neural networks,

    C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus, “Intriguing properties of neural networks,” arXiv preprint arXiv:1312.6199, 2013

    2013 arXiv

  2. [9]

    Adversarial examples in the physical world,

    A. Kurakin, I. Goodfellow, and S. Bengio, “Adversarial examples in the physical world,” arXiv preprint arXiv:1607.02533 , 2016

    2016 arXiv

  3. [10]

    The attacker’s perspective on automatic speaker verification: an overview,

    R. K. Das, X. Tian, T. Kinnunen, and H. Li, “The attacker’s perspective on automatic speaker verification: an overview,” Proc. INTERSPEECH, pp. 4213–4217, 2020

    2020

  4. [11]

    Fooling end-to-end speaker verification with adversarial examples,

    F. Kreuk, Y . Adi, M. Cisse, and J. Keshet, “Fooling end-to-end speaker verification with adversarial examples,” in Proc. ICASSP. IEEE, 2018, pp. 1962–1966

    2018

  5. [12]

    Adversarial regularization for end-to-end robust speaker verification,

    Q. Wang, P. Guo, S. Sun, L. Xie, and J. H. Hansen, “Adversarial regularization for end-to-end robust speaker verification,” in Proc. IN- TERSPEECH, 2019, pp. 4010–4014

    2019

  6. [13]

    Practical hidden voice attacks against speech and speaker recognition systems,

    H. Abdullah, W. Garcia, C. Peeters, P. Traynor, K. R. Butler, and J. Wilson, “Practical hidden voice attacks against speech and speaker recognition systems,” arXiv preprint arXiv:1904.05734 , 2019

    1904 arXiv

  7. [14]

    Inaudible adversarial perturbations for targeted attack in speaker recognition,

    Q. Wang, P. Guo, and L. Xie, “Inaudible adversarial perturbations for targeted attack in speaker recognition,” Proc. INTERSPEECH, pp. 4228– 4232, 2020

    2020

  8. [15]

    Universal adversarial perturbations generative network for speaker recognition,

    J. Li, X. Zhang, C. Jia, J. Xu, L. Zhang, Y . Wang, S. Ma, and W. Gao, “Universal adversarial perturbations generative network for speaker recognition,” in Proc. ICME. IEEE, 2020, pp. 1–6

    2020

  9. [16]

    Real-time, universal, and robust adversarial attacks against speaker recognition systems,

    Y . Xie, C. Shi, Z. Li, J. Liu, Y . Chen, and B. Yuan, “Real-time, universal, and robust adversarial attacks against speaker recognition systems,” in Proc. ICASSP. IEEE, 2020, pp. 1738–1742

    2020

  10. [17]

    Practical adversarial attacks against speaker recognition systems,

    Z. Li, C. Shi, Y . Xie, J. Liu, B. Yuan, and Y . Chen, “Practical adversarial attacks against speaker recognition systems,” in Proc. HOTMOBILE , 2020, pp. 9–14

    2020

  11. [18]

    Adversarial attacks on GMM i-vector based speaker verification systems,

    X. Li, J. Zhong, X. Wu, J. Yu, X. Liu, and H. Meng, “Adversarial attacks on GMM i-vector based speaker verification systems,” in Proc. ICASSP. IEEE, 2020, pp. 6579–6583

    2020

  12. [19]

    Who is real bob? adversarial attacks on speaker recognition systems,

    G. Chen, S. Chenb, L. Fan, X. Du, Z. Zhao, F. Song, and Y . Liu, “Who is real bob? adversarial attacks on speaker recognition systems,” in Proc. SP. IEEE, 2021, pp. 694–711

    2021

  13. [20]

    Adversarial attack and defense strategies for deep speaker recognition systems,

    A. Jati, C.-C. Hsu, M. Pal, R. Peri, W. AbdAlmageed, and S. Narayanan, “Adversarial attack and defense strategies for deep speaker recognition systems,” Computer Speech & Language , vol. 68, p. 101199, 2021

    2021

  14. [21]

    Pseudo-Siamese Net- work based Timbre-reserved Black-box Adversarial Attack in Speaker Identification,

    Q. Wang, J. Yao, Z. Wang, P. Guo, and L. Xie, “Pseudo-Siamese Net- work based Timbre-reserved Black-box Adversarial Attack in Speaker Identification,” in Proc. INTERSPEECH. 2023, pp. 3994–3998

    2023

  15. [22]

    X-vectors: Robust DNN embeddings for speaker recognition,

    D. Snyder, D. Garcia-Romero, G. Sell, D. Povey, and S. Khudanpur, “X-vectors: Robust DNN embeddings for speaker recognition,” in Proc. ICASSP. IEEE, 2018, pp. 5329–5333

    2018

  16. [23]

    Generalized end-to- end loss for speaker verification,

    L. Wan, Q. Wang, A. Papir, and I. L. Moreno, “Generalized end-to- end loss for speaker verification,” in Proc. ICASSP . IEEE, 2018, pp. 4879–4883

    2018

  17. [24]

    ECAPA-TDNN: Emphasized channel attention, propagation and aggregation in TDNN based speaker verification,

    B. Desplanques, J. Thienpondt, and K. Demuynck, “ECAPA-TDNN: Emphasized channel attention, propagation and aggregation in TDNN based speaker verification,” arXiv preprint arXiv:2005.07143 , 2020

    2005 arXiv

  18. [26]

    Fastspeech 2: Fast and high-quality end-to-end text to speech,

    Y . Ren, C. Hu, X. Tan, T. Qin, S. Zhao, Z. Zhao, and T.-Y . Liu, “Fastspeech 2: Fast and high-quality end-to-end text to speech,” in Proc. ICLR, 2021

    2021

  19. [27]

    HiFi-VC: High quality asr- based voice conversion,

    A. Kashkin, I. Karpukhin, and S. Shishkin, “HiFi-VC: High quality asr- based voice conversion,” arXiv preprint arXiv:2203.16937 , 2022

    2022 arXiv

  20. [28]

    Diffusion-based voice conversion with fast maximum likelihood sam- pling scheme,

    V . Popov, I. V ovk, V . Gogoryan, T. Sadekova, M. Kudinov, and J. Wei, “Diffusion-based voice conversion with fast maximum likelihood sam- pling scheme,” arXiv preprint arXiv:2109.13821 , 2021

    2021 arXiv

  21. [29]

    Denoising diffusion probabilistic models,

    J. Ho, A. Jain, and P. Abbeel, “Denoising diffusion probabilistic models,” Advances in neural information processing systems , vol. 33, pp. 6840– 6851, 2020

    2020

  22. [30]

    Libritts: A corpus derived from librispeech for text-to-speech,

    H. Zen, V . Dang, R. Clark, Y . Zhang, R. J. Weiss, Y . Jia, Z. Chen, and Y . Wu, “Libritts: A corpus derived from librispeech for text-to-speech,” arXiv preprint arXiv:1904.02882 , 2019

    1904 arXiv

  23. [31]

    HiFi-GAN: Generative adversarial net- works for efficient and high fidelity speech synthesis,

    J. Kong, J. Kim, and J. Bae, “HiFi-GAN: Generative adversarial net- works for efficient and high fidelity speech synthesis,” Proc. NeurIPS , vol. 33, pp. 17 022–17 033, 2020

    2020

  24. [32]

    Grad- tts: A diffusion probabilistic model for text-to-speech,

    V . Popov, I. V ovk, V . Gogoryan, T. Sadekova, and M. Kudinov, “Grad- tts: A diffusion probabilistic model for text-to-speech,” in International Conference on Machine Learning . PMLR, 2021, pp. 8599–8608

    2021

  25. [33]

    Montreal forced aligner: Trainable text-speech alignment using kaldi

    M. McAuliffe, M. Socolof, S. Mihuc, M. Wagner, and M. Sonderegger, “Montreal forced aligner: Trainable text-speech alignment using kaldi.” in Interspeech, vol. 2017, 2017, pp. 498–502

    2017

  26. [34]

    U-net: Convolutional networks for biomedical image segmentation,

    O. Ronneberger, P. Fischer, and T. Brox, “U-net: Convolutional networks for biomedical image segmentation,” in Medical Image Computing and Computer-Assisted Intervention–MICCAI 2015: 18th International Conference, Munich, Germany, October 5-9, 2015, Proceedings, Part III

    2015

  27. [35]

    Springer, 2015, pp. 234–241

    2015

  28. [36]

    P. E. Kloeden, E. Platen, P. E. Kloeden, and E. Platen, Stochastic differential equations. Springer, 1992

    1992

  29. [37]

    V oxceleb: a large-scale speaker identification dataset,

    A. Nagrani, J. S. Chung, and A. Zisserman, “V oxceleb: a large-scale speaker identification dataset,” arXiv preprint arXiv:1706.08612 , 2017

    2017 arXiv

  30. [38]

    V oxceleb2: Deep speaker recognition,

    J. S. Chung, A. Nagrani, and A. Zisserman, “V oxceleb2: Deep speaker recognition,” arXiv preprint arXiv:1806.05622 , 2018

    2018 arXiv

  31. [39]

    Distance-based weight transfer for fine-tuning from near-field to far- field speaker verification,

    L. Zhang, Q. Wang, H. Wang, Y . Li, W. Rao, Y . Wang, and L. Xie, “Distance-based weight transfer for fine-tuning from near-field to far- field speaker verification,” in ICASSP 2023-2023 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) . IEEE, ...

    2023

  32. [40]

    Mosnet: Deep learning based objective assessment for voice conversion,

    C.-C. Lo, S.-W. Fu, W.-C. Huang, X. Wang, J. Yamagishi, Y . Tsao, and H.-M. Wang, “Mosnet: Deep learning based objective assessment for voice conversion,” arXiv preprint arXiv:1904.08352 , 2019

    1904 arXiv

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.