Anonymized German voices fall to a 0.91% EER attack, Japanese hold at 9.91%, and MultiVC doubles the gap ratio

The best multilingual attacker re-identifies anonymized German at 0.91% EER and Japanese at 9.91%, and MultiVC doubles that ratio for the lazy attacker

In arXiv:2610.08107, posted on 6 October 2026 and accepted at IEEE SLT 2026, the strongest attacker (WavLM-ECAPA, semi-informed, fine-tuned on the new MultiVC corpus) breaks the VPC 2026 BM1 anonymizer at an average 1.44% EER across English, German, French and Spanish, against 8.10% across Chinese and Japanese (Table III, ID12, our averages). The paper says MultiVC "partially reduces the cross-lingual gap". In points it does for the lazy WavLM-ECAPA attacker on BM1 (19.38 down to 15.78), but the East Asian EER goes from 3.08x to 6.46x the European one, because the European side fell from 9.31% to 2.89%. Across all eight with/without-MultiVC pairs in Table III, that ratio rises in 6.

Two checks a reader cannot get from the abstract. The Avg cell for that same row reads 8.99% in the table and in the prose, but the six cells it summarises average 8.15%; the other 15 rows recompute to within 0.01. And the release promised in footnote 1 is real but partial: on 7 October 2026 the GitHub repository held the acoustic attacker only (37 files, 10 commits, MIT licence), with no code or checkpoint for the content-oriented w2v-BERT-MFA attacker, and the MultiVC dataset is a single 324 GiB (347,389,863,200-byte) all_splits.tar.gz on Google Drive with no licence statement.

For anyone releasing multilingual voice data under an anonymization promise, the per-language spread is the operational fact. On BM1, the anonymizer that keeps speech intelligible (5.4% WER in English, Table I), a tuned attacker matches anonymized German and Spanish speakers to their enrolment at under 1% EER. The paper's own reading is that the higher East Asian EERs track how badly anonymization damages those languages (Chinese CER 30.2% under BM1, 70.3% under BM2), so the extra "privacy" there is bought with broken speech.

What the Singapore, Wuhan and Duke Kunshan team posted on 6 October 2026

Exploiting Acoustic and Content-Oriented Speaker Verification Attacks Against Multilingual Voice Anonymization, arXiv:2610.08107v1 (cs.SD), by Ridwan Arefeen and Rong Tong (Singapore Institute of Technology), Ze Li (Wuhan University), Ming Li (The Chinese University of Hong Kong) and Xiaoxiao Miao (Duke Kunshan University, corresponding author). Version 1 is the only version as of 7 October 2026. The work is funded by a Singapore MOE AcRF Tier 1 grant. Miao and Arefeen are also authors of the VoicePrivacy 2026 Challenge evaluation plan, and the acoustic attacker studied here, DAST (arXiv:2603.12840), is the challenge's official attacker.

The setup: speech in six languages is anonymized by two VPC 2026 Track 2 baselines. BM1 swaps the speaker embedding of a HuBERT-based pipeline and resynthesises with HiFi-GAN; BM2 transcribes with Whisper, replaces the speaker with a GAN-generated embedding, perturbs F0 and energy per phoneme and resynthesises with the IMS Toucan TTS. Two attackers then try to verify speakers: WavLM-ECAPA ("acoustic-oriented") and a w2v-BERT 2.0 model with multi-scale feature aggregation and LoRA ("content-oriented"). Each is tested lazy-informed (never sees the target anonymizer) and semi-informed (fine-tuned on speech anonymized by the same system).

The new artefact is MultiVC: TidyVoiceX target voices (321,709 utterances, 4,474 speakers, about 40 languages, derived from Mozilla Common Voice) split into 10 folds of 34,022 utterances; each of seven voice-conversion systems (CosyVoice2, Seed-VC, YingMusic-SVC, FreeVC, KDVC, LVC-VC, TriAAN-VC) converts one fold against a pool of 70,113 source utterances, three sources per target, for 102,066 samples per system and 714,462 in total (Table II). Chinese evaluation uses AISHELL-3 (30 speakers, 150,648 trials) and Japanese uses JVS (48 speakers, 125,360 trials), with Common Voice Japanese for training.

What Table III says per language, and where the prose and the table disagree

Paper values from arXiv:2610.08107v1 (6 October 2026). Averages, ratios, counts, the source-reuse simulation and the release checks are BLOMEGA computations, 7 October 2026.

The ID4 average is the one number we could not reconcile. The six cells (2.887, 4.526, 2.520, 1.636, 17.727, 19.622) sum to 48.918, so the mean is 8.153. Section IV-B1 repeats 8.99 ("from 15.77% to 8.99% for WavLM-ECAPA"), which means the prose was written from the Avg column, not from the cells. Either a cell or the average is wrong. With the cells as printed, the MultiVC gain on that row is 7.62 points, larger than the 6.78 the paper reports.

The English cell in ID13 is the second oddity. A content attacker fine-tuned on BM2 output scores 48.131% EER on English, close to the 50% of a coin flip and worse than the same model before fine-tuning (35.80%). Adding MultiVC then drops it to 26.270%, a 21.86-point change, the largest single move in the table. That one cell supplies about 71% of the 5.16-point average gain for that pair (21.86 / 6 = 3.64 points). We read it as a training failure on one run; the paper does not comment on it. A smaller curiosity: ID11 English (2.887) is identical to three decimals to ID4 English, from a different model and data condition. That can happen by chance with discrete trial counts, but it is worth a look when the scoring files appear.

The headline claims mostly survive the recompute. "WavLM-ECAPA consistently outperforms w2v-BERT-MFA" holds in all 48 cell pairs. "Incorporating multilingual data consistently improves performance" holds in 47 of 48 cells. The abstract's claim that the content and acoustic attackers converge when speech utility is preserved is true in points (semi-informed gap 4.43 on BM1 against 19.65 on BM2) and not in proportion: the content attacker's average EER is 2.21x the acoustic one on BM1 and 2.29x on BM2.

How a contributor's anonymized clip gets matched back to them

The threat model in Section II-C gives the attacker the anonymization system itself, several enrolment clips per speaker anonymized the same way, and public speech in the same language to anonymize and train on. A semi-informed attacker is that attacker after fine-tuning on the target system's output. MultiVC is a pre-training step that exposes the attacker to seven voice-conversion systems over many languages before it sees the target anonymizer.

The paper's explanation for the language spread is an "acoustic-linguistic coupling": anonymizers that damage a language's phonetic content also wash out the identity cues the attacker relies on. The authors call this a coupling, not a demonstrated causal link (Section II-E), and that caution is warranted. Our judgement is that there is a second, untested explanation: the East Asian rows are evaluated on different corpora from the European rows. Chinese uses AISHELL-3 for training and test; Japanese trains on Common Voice and tests on JVS, a studio corpus of 48 speakers. The European rows use the VPC 2026 Track 2 test sets. So "Chinese and Japanese are harder" mixes language with corpus, speaker count, recording conditions and trial design, and Table III cannot separate them.

The MultiVC arithmetic is internally consistent where it is deterministic (34,022 x 3 = 102,066; x 7 = 714,462; 102,066 - 70,113 = 31,953 backfill slots), but two descriptive statements do not follow from the procedure as written. Every system draws exactly 102,066 sources from the same 70,113-utterance pool, so the mean reuse is 1.456x for all seven, and a range of "1.35x to 1.46x" cannot occur unless some systems produced fewer samples than Table II says. And uniform backfill with replacement leaves about 63% of sources used once and 29% twice (Poisson with mean 0.456, confirmed by seven simulated runs), not "approximately 70%" and "20%". Neither affects Table III directly; both suggest the released archive may not match Table II exactly, which anyone downloading it can count.

What a team that promises contributors "anonymized" multilingual voice should change

• Report privacy per language, and treat English as a weak proxy in both directions. The paper reports that VPC 2026 results give English the lowest EER; its own Table III shows German, French and Spanish can be even easier for a tuned attacker on BM1 (0.91% to 1.07% against 2.79% for English, ID12). A single pooled EER hides a 10x spread between German and Japanese.
• Test against a semi-informed attacker before you publish. On BM1 the lazy WavLM-ECAPA attacker averages 15.77%; fine-tuned on BM1 output plus MultiVC it averages 3.66% (IDs 3 and 12). The code and checkpoint for that attacker are public under MIT, so assume anyone downloading your release can do the same. Our judgement: any anonymization claim in a contributor consent form or dataset card should name the attacker setting it was measured against.
• Do not count a high East Asian EER as protection until utility is checked. BM2's 26.79% (Chinese) and 28.41% (Japanese) EER for the best attacker coincide with 70.3% and 45.1% CER on the same audio (Table I). If your downstream use is ASR or dubbing training data, that output is of limited use, so the trade you are making is utility for privacy, not privacy for free.
• Expect your voices to end up in someone's attack corpus. MultiVC's 4,474 target voices come from Common Voice (released CC0) via TidyVoiceX, and are now cloned onto other speakers' content by seven systems in a 324 GiB public archive with no licence or datasheet attached. Common Voice's download page asks users to agree "to not attempt to determine the identity of speakers"; speaker-verification research does not name anyone, but it is the capability that clause is about. We covered the same pattern in CVSS-X cloning 9,851 Common Voice volunteers into 28 languages. Consent language for new collections should say whether contributors' voices may be used to train voice conversion and speaker re-identification.
• Check the licence stack before reusing the kit commercially. The DAST attacker code is MIT. The content attacker's base repo (LI-MSV-TidyVoice2026) carries CC BY-NC-SA 4.0. JVS audio is limited to academic and non-commercial research. Seed-VC, one of the seven converters, is GPL-3.0; CosyVoice is Apache-2.0; FreeVC, LVC-VC, TriAAN-VC and YingMusic-SVC are MIT; we did not find a repository for KDVC. AISHELL-3 is Apache 2.0 on OpenSLR. This is a reading of licence files, not legal advice, but it means a commercial privacy audit cannot simply adopt MultiVC plus both attackers as released.

For the dubbing side of the same tension, cloned voices that sound right but carry the wrong content, see the IWSLT 2026 voice-cloning track result.

Check it yourself

The Table III recompute parses the paper's own text, so no values are retyped. It needs pypdf (we used a fresh virtualenv) and prints the Avg check, the per-row European and East Asian means, the MultiVC effect per cell and the source-reuse simulation:

curl -sL https://arxiv.org/pdf/2610.08107v1 -o p.pdf
python3 -m venv .venv && .venv/bin/pip -q install pypdf
.venv/bin/python -I extract_plain.py p.pdf 5 > p_plain.txt   # pages 5 to 7, plain text
.venv/bin/python -I analyze.py p_plain.txt
# expect: "ID 4 Lazy-BM1  WavLM-ECAPA   paper=  8.99 recomputed=  8.15 diff=+0.84 MISMATCH"
# expect: "ID3->4 ... gap 19.38->15.78pt, ratio 3.08x->6.46x"

The release checks are plain GitHub API and Drive calls:

curl -s https://api.github.com/repos/monkeyDarefeen/DAST | grep -E '"(created_at|pushed_at|spdx_id)"'
curl -s 'https://api.github.com/repos/monkeyDarefeen/DAST/commits?per_page=100' | python3 -c 'import json,sys;print(len(json.load(sys.stdin)))'   # 10
curl -s 'https://api.github.com/repos/monkeyDarefeen/DAST/git/trees/HEAD?recursive=1' | grep -ciE 'w2v|bert|lora'   # 0
curl -s https://raw.githubusercontent.com/monkeyDarefeen/DAST/main/pretrained_ckpt_multiVC/MultiVC-Dataset.md
curl -sL 'https://drive.google.com/file/d/1X2dhZYO94eKrcwHC3idpDedeQ9OzY_GN/view' | grep -o '\[null,null,"[0-9]*"\]'
# 7 Oct 2026: pushed_at 2026-09-28T20:21:22Z, MIT; Drive size 347389863200 bytes

Fields to look at: the Avg column and the Cn and Ja columns of Table III (page 5 of the PDF), Table I (page 4), and Sections III-C and III-E for the fold and reuse statements. The README of the repository lists SLT_2026_post(1).pdf in its tree, but that file is not in the repository; the arXiv PDF is the reference.

What would prove this wrong

Our claim is that the East Asian versus European spread in this paper is at least partly a corpus effect, and that MultiVC does not shrink it in relative terms. It would be wrong if an evaluation that holds the corpus constant (for example Common Voice test speakers in all six languages, or the VPC 2026 organisers adding Chinese and Japanese test sets built the same way as the European ones) still shows the best semi-informed attacker at 5x or more East Asian over European EER. We predict that by 30 June 2027 any such corpus-matched result will show a ratio under 3x for the best BM1 attacker.

Two smaller, checkable predictions: a v2 of arXiv:2610.08107 or the SLT 2026 camera-ready will change either the ID4 average (to 8.15) or one of its cells; and counting all_splits.tar.gz will give a converted-sample total different from 714,462 or per-system mean reuse below 1.456x for at least one system. If the archive matches Table II exactly and v2 keeps 8.99 with the same cells, we were wrong about the second point.

Sources

1. Ridwan Arefeen, Ze Li, Rong Tong, Ming Li, Xiaoxiao Miao. Exploiting Acoustic and Content-Oriented Speaker Verification Attacks Against Multilingual Voice Anonymization. arXiv:2610.08107v1, 6 October 2026, accepted at IEEE SLT 2026. Sections II to IV, Tables I to III.
2. github.com/monkeyDarefeen/DAST, checked through api.github.com on 7 October 2026: created 16 March 2026, last push 28 September 2026, MIT, 10 commits, 37 files.
3. MultiVC archive on Google Drive (all_splits.tar.gz, 347,389,863,200 bytes), linked from the repository on 28 September 2026, checked 7 October 2026.
4. Arefeen et al. DAST: A Dual-Stream Voice Anonymization Attacker with Staged Training. arXiv:2603.12840, 2026.
5. Miao et al. The VoicePrivacy 2026 Challenge, evaluation plan and Track 2 baselines, 2026.
6. Farhadipour et al. TidyVoice 2026 Challenge evaluation plan. arXiv:2601.21960, 29 January 2026 (TidyVoiceX, derived from Mozilla Common Voice).
7. Mozilla Common Voice, dataset download agreement string confirm-no-identify, common-voice/common-voice, datasets.ftl, read 7 October 2026.
8. JVS corpus terms of use (audio for academic and non-commercial research) and AISHELL-3 on OpenSLR (Apache 2.0), read 7 October 2026.
9. ZXHY-82/LI-MSV-TidyVoice2026, the w2v-BERT-MFA base model cited in footnote 5, License.md CC BY-NC-SA 4.0, read 7 October 2026.
10. Voice-conversion repositories and licences via the GitHub API, 7 October 2026: CosyVoice (Apache-2.0), Seed-VC (GPL-3.0), FreeVC (MIT), LVC-VC (MIT), TriAAN-VC (MIT), YingMusic-SVC (MIT).
11. BLOMEGA computations, 7 October 2026: Table III averages, European and East Asian means and ratios, cell-level counts, ID13 contribution, MultiVC fold and reuse arithmetic and a seven-run simulation of the backfill procedure.

FAQ

Does voice anonymization protect speakers equally in every language?

Not in this study. Against the VPC 2026 BM1 anonymizer, the best attacker in arXiv:2610.08107 reaches 0.91% EER on German, 0.99% on Spanish, 1.07% on French and 2.79% on English, against 6.29% on Chinese and 9.91% on Japanese (Table III, ID12). The authors tie the higher East Asian EERs to worse speech utility after anonymization; the Chinese and Japanese rows also use different evaluation corpora (AISHELL-3, JVS) from the European ones, so language and corpus are not separated.

Is the MultiVC dataset available, and under what licence?

The repository github.com/monkeyDarefeen/DAST links one Google Drive file, all_splits.tar.gz, of 347,389,863,200 bytes (324 GiB), linked from the repository on 28 September 2026. Neither the repository nor the paper states a licence for MultiVC; the repository's MIT licence covers its code. MultiVC's target voices come from TidyVoiceX, derived from Mozilla Common Voice, and its converters range from MIT and Apache-2.0 to GPL-3.0.

Does MultiVC close the cross-lingual gap for attackers?

Partly, in points: for the lazy WavLM-ECAPA attacker on BM1 the gap between East Asian and European mean EER goes from 19.38 to 15.78 points. In proportion it widens, from 3.08x to 6.46x, because European EER falls faster. Across the eight paired rows in Table III the gap in points shrinks in 5 and the ratio rises in 6 (our arithmetic). The table's average for that row is printed as 8.99% but its six cells average 8.15%.