Paper deep dive
Listen to the Features: Voice Anonymization Driven by Content Embedding Matching over Signal Reconstruction
Adrien Schneider, Kacper Zabkowski, Anderson Augusma, Frédérique Letué, Maria Camila Pinzon, Dominique Vaufreydaz
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 96%
Last extracted: 7/14/2026, 2:48:42 AM
Summary
The paper introduces a lightweight voice anonymization model that prioritizes preserving semantic content over generating realistic speech. It leverages a frozen wav2vec2 encoder to extract content embeddings, which are quantized via Factorized Vector Quantization and decoded into an anonymized waveform using a HiFi-GAN vocoder. An auxiliary speaker classifier with a gradient reversal layer discards speaker-specific information during training. Trained on LibriTTS, the model achieves a low Word Error Rate (2.53) and Equal Error Rate (13.39) for the Voice Privacy Challenge 2026, while partially preserving emotional content (UAR 43.91) without explicit supervision.
Entities (10)
Relation Signals (9)
Voice Anonymization Model â achieves â Word Error Rate
confidence 98% · Results show that this straightforward embedding-based approach achieves very low WER (2.53)
Voice Anonymization Model â uses â Wav2Vec2
confidence 98% · It relies on content embeddings extracted from a frozen pretrained wav2vec2 encoder.
Voice Anonymization Model â achieves â Equal Error Rate
confidence 97% · with an anonymization performance (EER 13.39) ranking within first level for VPC.
Voice Anonymization Model â utilizes â HiFi-GAN
confidence 97% · These embeddings are decoded into an anonymized signal using vector quantization and a HiFi-GAN vocoder
Voice Anonymization Model â achieves â Unweighted Average Recall
confidence 96% · Notably, emotions are partially preserved (UAR 43.91), even without a supporting training objective
Voice Anonymization Model â employs â Factorized Vector Quantization
confidence 96% · These embeddings are decoded into an anonymized signal using vector quantization and a HiFi-GAN vocoder
Voice Anonymization Model â trainson â LibriTTS
confidence 95% · both trained on LibriTTS without any waveform reconstruction loss or speaker embedding mapping.
Gradient Reversal Layer â usedin â
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:The paper presents a voice anonymization model focusing on preserving content rather than producing realistic speech. It relies on content embeddings extracted from a frozen pretrained wav2vec2 encoder. These embeddings are decoded into an anonymized signal using vector quantization and a HiFi-GAN vocoder, both trained on LibriTTS without any waveform reconstruction loss or speaker embedding mapping. The training objective enforces that embeddings of the anonymized signal match those of the original one. While training, an auxiliary speaker classification branch with a gradient reversal layer is used to discard speakerspecific information. Results show that this straightforward embedding-based approach achieves very low WER (2.53) with an anonymization performance (EER 13.39) ranking within first level for VPC. Notably, emotions are partially preserved (UAR 43.91), even without a supporting training objective, while the anonymized voice is audible without reconstruction loss.
Tags
Links
- Source: https://arxiv.org/abs/2607.09767v1
- Canonical: https://arxiv.org/abs/2607.09767v1
Trouble viewing inline? Open PDF directly â
Full Text
34,658 characters extracted from source content.
Expand or collapse full text
LISTEN TO THEFEATURES: VOICEANONYMIZATIONDRIVEN BY CONTENTEMBEDDINGMATCHING OVERSIGNALRECONSTRUCTION AUTHOR VERSION Adrien Schneider, 1, Kacper Zabkowski, 1 Anderson Augusma, 1,, FrĂ©dĂ©rique LetuĂ©, 2,, Maria Camila Pinzon, 1 Dominique Vaufreydaz 1, , 1 Univ. Grenoble Alpes, CNRS, Grenoble INP, LIG, 38000 Grenoble, France 2 Univ. Grenoble Alpes, CNRS, Grenoble INP, LJK, 38000 Grenoble, France ABSTRACT The paper presents a voice anonymization model focusing on preserving content rather than producing realistic speech. It relies on content embeddings extracted from a frozen pretrained wav2vec2 encoder. These embeddings are decoded into an anonymized signal using vector quantization and a HiFi-GAN vocoder, both trained on LibriTTS without any waveform reconstruction loss or speaker embedding mapping. The training objective enforces that embeddings of the anonymized signal match those of the original one. While training, an auxiliary speaker classification branch with a gradient reversal layer is used to discard speaker- specific information. Results show that this straightforward embedding-based approach achieves very low WER (2.53) with an anonymization performance (EER 13.39) ranking within first level for VPC. Notably, emotions are partially preserved (UAR 43.91), even without a supporting training objective, while the anonymized voice is audible without reconstruction loss. Keywords: voice anonymization, speech recognition, content embedding driven reconstruction 1 Introduction Reproducible research is important for accelerating scientific progress either in Artificial Intelligence, in Social Science research or in Computational Social Science.In these contexts, sharing data is as important as sharing source code but it becomes increasingly complex due to legal constraints, such as the GDPR and the AI Act in Europe, or the need to address ethical considerations. These rules are beyond discussion, as protecting the privacy of individuals is critical in the current numerical world but one must consider their impact on science discovery due to the limitations they impose on research data sharing. Among standard usages of privacy algorithms, anonymization of audio and video data is one way to leverage data sharing. Numerous high-value scientific datasets containing identifiable voices and faces are collected by researchers worldwide. If these data are sufficiently anonymized, they can be shared to the research community and thus can benefit many other researchers.To achieve this, anonymization must preserve the semantic content of speech, emotions, interpersonal interactions, and other social signals expressed in recorded videos, while maintaining the value of the collected data.A long-term objective for privacy-safe reproducible research would be to make available lightweight anonymization models capable of recording speech in an already anonymized form during corpus collection. This research on voice anonymization submitted to the Voice Privacy Challenge 2026 [1] is part of a broader project about social-aware video anonymization targeting both audio and video signals. In this first proposal, this research focuses on voice anonymization preserving what is said while evaluating preservation of voice emotions. The originality lies in the ability of the model to learn to generate an anonymized audio segment that, once processed by a given speech encoder, would give the same latent content representation than the original voice segment. There are no constraints nor losses within the training process to force the generation of a realistic, human-sounding speech signal. The motivation is that, with automated downstream tasks in mind, such as Automatic Speech Recognition (ASR) or Speech Emotion Recognition (SER), the anonymization model only needs to generate any signal that carries meaningful information, without expecting it to be clean speech. The proposed method also has the advantage of not using pseudo-speakers to do voice conversion-based voice anonymization.As such, it cannot be used to create deepfakes or impersonate the voice of another person without their consent. As per the Voice Privacy Challenge rules, the ability of the model to preserve useful information is evaluated on two tasks in the English language: ASR and SER. The metrics used are the Word Error Rate (WER) and the Unweighted Average Recall (UAR) respectively. The quality of anonymization is evaluated in the context of a semi-informed attacker trying to recover the speakerâs identity given an anonymized utterance. The attacker is said to be âsemi-informedâ because it uses an Automatic Speaker Verification (ASV) model fine-tuned on data anonymized with the anonymization system that it tries to attack. The privacy metric is the Equal Error Rate (EER), and challenge rankings are done at several EER thresholds. arXiv:2607.09767v1 [eess.SP] 7 Jul 2026 AUTHOR VERSION The title of this article starts with âListen to the Featuresâ as the goal is to develop a straightforward, lightweight model based solely on the features from a pre-trained foundation model. The aim is to answer the research question: is it possible to âlisten to the featuresâ, i.e. to use them without any or with minimal anonymization supervision to achieve good speech recognition performance on anonymized speech. Remaining of this paper presents the following contributions: âą A lightweight neural architecture driven by content embedding for voice anonymization targeting good WER performance. As previously stated, the proposed model does not use a reconstruction loss, nor speaker embeddings. Inference model is lightweight with less than 99M parameters comprising 18M of trainable ones. âą Experiments showing that the best hyperparameter set performs very well on WER (2.53%), fair on UAR (43.91%) while being on the lowest anonymized EER challenge class (between 10 to 20%). âą Qualitative automated Mean Opinion Score (MOS) analysis of anonymized speech, highlighting that even if quality of anonymized signals is clearly degraded (MOS of 1.63), the generated signals remain usable for automatic speech recognition, and to some extent for emotion classification. This observation raises a relevant question regarding the required perceptual quality of anonymized signals as a function of the targeted downstream tasks. 2 Related work Voice anonymization aims to transform a voice signal in such a way as to conceal the identity of the original speaker whilst preserving the information required for downstream speech processing tasks. This objective has been formalised as part of the âVoicePrivacy Challengeâ series, in which anonymization systems are evaluated according to criteria relating to both privacy and utility [1â4].The VoicePrivacy Challenge 2026 edition further emphasizes stronger attacker models and multilingual anonymization, making the preservation of linguistic and paralinguistic information particularly important [1]. Several families of voice anonymization methods have been explored in previous research.Signal-processing approaches, such as transformations based on the McAdams coefficient, modify the spectral envelope of speech in order to reduce speaker identity while keeping the signal relatively intelligible [5].Other systems rely on speaker embedding replacement, often using x-vectors or similar speaker representations, where the original speaker embedding is substituted or modified before speech resynthesis [6, 7].Self-supervised speech representations have become increasingly important for speech anonymization because they can encode robust linguistic information without requiring explicit phonetic annotations.wav2vec2learns speech representations from raw audio using self-supervised pretraining and has shown strong performance for ASR after fine-tuning [8].Vector-quantized representations provide another mechanism for controlling the amount and type of information retained by an anonymization system. VQ-VAE introduced discrete latent representations learned through a codebook, creating a bottleneck between the encoder and decoder [9].In speech anonymization, this bottleneck is useful because it can force the model to preserve task- relevant content while discarding fine-grained speaker-specific details. Recent VoicePrivacy baselines also include systems based on vector-quantized acoustic bottlenecks, showing the relevance of discrete representations for privacy-preserving speech processing [1]. Neural vocoders are commonly used to reconstruct waveform audio from intermediate acoustic representations.HiFi-GAN is a generative adversarial vocoder designed for efficient and high-fidelity waveform synthesis [10]. In anonymization, such vocoders allow the system to generate an output waveform from modified or compressed representations, rather than directly manipulating the original waveform. In parallel, adversarial learning can be used to reduce the amount of speaker information encoded in the learned representation. Gradient reversal, originally introduced for domain-adversarial learning, enables a model to learn representations that are useful for the main task while being uninformative for an auxiliary classifier [11]. In the context of speaker anonymization, this principle can be used with an auxiliary speaker predictor to prevent the quantized representation from retaining speaker identity. In line with the literature, the proposed model in this article is meant to be straightforward and lightweight. The main focus is on content preservation, thus downstream ASR task, rather than on waveform reconstruction. No use is made of speaker embeddings or any kind of target speaker for reconstruction, although an auxiliary speaker predictor is employed to act as an incentive for the model to discard speaker-specific information at training time. 3 System description 3.1 Architecture During training, as depicted on figure 1, the model uses a two- branch approach with different functions. The first branch uses a pre-trained encoder meant to extract latent content representations from a speech signal.Embeddings transit into a quantization module followed by a waveform generator to reconstruct an anonymized speech from quantized latent representation. This branch corresponds to the final inference model. The second branch is used only at training time. It inflects training to optimize network weights to avoid keeping speaker information.These modules are described in the remainder of this section. The first branch of the model uses a frozen pretrained wav2vec2[8] model for speech encoding. It is the standard version of the model, trained on 960 hours of speech data from the LibriSpeech dataset [12]. The latent representations are extracted from the ninth hidden layer of the model. The content embeddings coming from the wav2vec2 encoder go through a trainable upsampling layer, designed to match the operating needs of the HiFiGAN vocoder (160 samples per frame vs. roughly 320 output bywav2vec2[8]). This layer 2 AUTHOR VERSION Figure 1:Schematic diagram of model. The network architecture has 2 branches. The first one starts with a frozenwav2vec2 encoder. Then embeddings transit thought a Factorized Vector Quantization followed by a bi-GRU/HiFi-GAN process to generate the anonymized waveform. This waveform output is passed again into the frozen content encoder to generate output content embedding. MSE and cosine similarity losses are used between input and output content embeddings to train this branch. The second network branch enforces the system to be unaware of the current speaker thanks to gradient reversal, a speaker predictor network and a cross-entropy between input and predicted speaker labels. is a 1-dimensional transposed convolution. The upsampled content embeddings are then quantized by the Factorized Vector Quantization (FVQ) module inspired by the quantizer- vocoder combination for voice conversion proposed in [7]. As it employs a single codebook, the proposed architecture does not differentiate between linguistic content and other features such as emotional content as the referenced model did. It also differs by codebook size and codeword length. The core idea is to create a bottleneck forcing the model to retain features that are useful for the downstream task and to discard the rest. In section 4, different values of codebook size and codeword length, and their impact on challenge metrics are investigated. The quantized content representations are then processed by a Bi-directional Gated Recurrent Unit (bi-GRU) before being fed to a HifiGAN vocoder, which generates an acoustic signal of approximately the same length as the input signal. A second branch is added to the network architecture at training time to prevent the model from retaining information about the specific voice of the original speaker.Derived from the adversarial classifiers proposed in [13], this branch consists of an auxiliary speaker predictor combined with a gradient reversal module.The speaker classifier consists of successive weight-normalized 1D-convolutional layers followed by Snake-Beta activation functions [14, 15]. The speaker predictor takes the quantized latent representations produced by the FVQ as input and outputs a speaker id, i.e. a number. 3.2 Training process During the training phase, all the weights of both network branches are optimized except for the frozenwav2vec2 encoder.Branch divergence starts after the FVQ output. From these projected content embeddings, the first branch uses the Hifi-GAN generator fully retrained to generate the output audio signal. The discriminators of the original Hifi- GAN are not used. The generated signal is then fed to the frozenwav2vec2encoder to get its content embeddings. The objective loss of the model targets producing output-signal embeddings that match the original ones as closely as possible. Inspired by the speaker embedding generation loss used by Liu at al. in IDmap [16], the difference between generated and original embeddings is measured using a content loss function L c , which is an equally weighted sum of Mean Squared Error (MSE) and cosine similarity losses between the original and generated embeddings. The loss of the first branch is computed as L c = 0.5·|xây| 2 2 + 0.5· 1â x †y |x| 2 |y| 2 (1) wherexandyare respectively embeddings of input and generated audio signals. For the second branch, a cross-entropy lossL s is used to compare the output of the auxiliary speaker predictor with the ground-truth speaker labels. The total loss is the weighted sum ofL c andL s as L=λ s L s +λ c L c (2) whereλ s andλ c are weight factors for the speaker and content losses respectively. 4 Experiments and results 4.1 Hyperparameter exploration Several experiments were conducted to identify the best combination of hyperparameters, notably codebook size and loss weights. All experiments described in this section were conducted by training the models on NVidia A100 GPUs. The AdamW optimizer was used, with betas of 0.8 and 0.99. An exponential learning rate decay of 0.999 was applied. For training, audio data was resampled to 16 kHz and split into random 16640-samples-long segments, which gives 52 frames of audio data per sample. The number of parameters of the model is summarized in table 1. Training was done 3 AUTHOR VERSION on LibriTTS [17] using train-clean-100 and train-clean-360 subsets. Table 1:Number of model parameters (in millions). For the encoder, only parameters until hidden layer 9 are included. The speaker predictor is not used at inference time, hence the additional total in the last line. ComponentTotal (M)Trainable (M) Generator18.5418.54 Upsampling + FVQ2.382.38 BiGRU + HifiGAN16.1716.17 Speaker predictor14.2114.21 Encoder80.200.00 Total112.9432.75 Total (inference model)98.73â Results for the different experiments are summarized in table 2, along with their average score on the challenge metrics. Some evaluation results were not available at the time of submission because of errors occurring during ASV inference. Those errors could not be investigated on time. Those missing results are marked with dashes in the aforementioned table. 4.1.1 Content-only experiments The first reported results are from experiments where the speaker loss was set to 0, i.e. only the content information was taken into consideration. The goals are to (i) verify that the model is actually able to generate a signal that conveys what the speech encoder identifies as content, and (i) get a first idea of the impact of the size of the codebook. Two different codebook sizes are evaluated: 2048 (with a codeword length of 8) and 65536 (with a codeword length of 16). The first configuration is intended to test a strong bottleneck, while the latter is meant to match the combined codebook sizes of [7]. Their respective experiment codes in table 2 arecb2048and cb65536. They were both trained with a batch size of 128 for about 50 epochs. Results show that the target performance on downstream task, i.e. automatic speech recognition, is reached. Thecb65536 model (65536 codewords of length 16) reaches a WER of 2.53, thus a small 0.69 absolute loss from baseline on clean speech. The second model with fewer codewords had a WER of around 11%. One interesting result is thatcb65536reaches 43.91 UAR without any supervision on emotion (around 27% below baseline). It confirms thatwav2vec2embeddings also encode emotional information. As there is no supervision for anonymization in these experiments, the resulting EER (13.39%) is in the lower considered rank for the challenge (between 10 and 20%). 4.1.2 Experiments including the speaker predictor The experiments with a code consisting of a single lowercase letter fromatoein table 2 represent experiments where the speaker loss is not null. They have been designed to see what kind of impact light speaker anonymization supervision has on WER performance when using foundation embeddings. In all these runs, the contribution of the speaker loss to the total loss is lower than 10%, more than 90% remaining for the content loss. They were all conducted for 100 epochs, with a batch size of 128. The evaluated content loss to speaker loss weight ratio were 10/1, 20/1 and 40/1. In the gathered results, one can see in table 2 that the anonymization supervision has a strong impact on the proposed model. Indeed, WER increases up to 100 except for theeconfiguration (same number of codewords ascb65536, former best model) with 60% of WER using a 40/1 ratios between respectively content and speaker losses. In this last case, even if speaker loss contributes to less than 4% to total loss, it degrades drastically WER performance. The same reasoning applies to UAR results. Adding the anonymization supervision degrades UAR performance but in a smaller margin that WER, the best system (e) remaining at 38.68 UAR. 4.2 MOS evaluation The strong voluntary bias of this research is to focus training objectives on downstream tasks, mainly ASR, and to avoid using reconstruction or signal quality losses. However, it is still interesting to see to what extent the reconstructed signal happen to look like natural speech. Informal listening tests highlighted that the anonymized utterances sounded âroboticâ, but most of the words could still be recognized by a human ear. ASR evaluation system (see table 2) are also able to deal with the anonymized signals. One needs to quantify the former perceptive results and to provide a more complete qualitative evaluation. An evaluation of the Mean Opinion Score (MOS) is provided. As its name suggests, MOS consists of mean quality score given by several humans ranging on a scale from 1 (bad quality) to 5 (high quality). As conducting a full human MOS evaluation during the challenge time is not feasible, automated MOS estimation is performed. To comply with MOS formalism, the decision was made to get MOS from three different models and compute their mean score: UTMOS [18], SHEET [19] and RAMP+ [20]. The Results are depicted in table 3. MOS is evaluated on both the originalLibriSpeechtrain-clean-360 and its anonymized counterpart using the best model from the experiments previously presented (cb65536). One can see that for original clean dataset, the MOS score is slightly over 4, even if some sentences have bad score (min MOS down to 1.38, 1.65 in average on the three models). The anonymized counterpart dataset has lower MOS scores. While min MOS values are not strongly impacted, they are nevertheless getting closer to 1. In contrast, MOS score lost 2.48 in absolute, down to 1.63. The max MOS value is also greatly impacted with 2.49. These results corroborate the perception of a âroboticâ voice for anonymized speech signals. 4 AUTHOR VERSION Table 2:Experimental configurations and evaluation metrics. Config name represents the configuration name associated to official VPC submission, except for the first four lines which display the metrics measured on the original data for the evaluation datasets. Codebook size and Codeword length for each model are listed. Loss weights and the percentage contribution of the content loss to the total loss are provided. Metrics are an unweighted average over all evaluation datasets. EER is computed with the ASV system retrained on anonymized data. Dashes indicate results that were not available 2 . Config 1 CodebookCodewordContentSpeaker lossλ c contrib.EERâEER 2 (anon)âWERâUARâ namesizelengthloss(λ c )weight(λ s )to loss(%)(%)(%)(%) LibriSpeech-Dev7.341.80 LibriSpeech-Test3.911.84 IEMOCAP-Dev69.08 IEMOCAP-Test71.06 cb2048204881â100.0024.4413.8810.9040.63 cb6553665536161â100.0023.7513.392.5343.91 a2048810190.9135.5021.91104.2733.38 b2048820195.2434.88â123.3530.85 c655361610190.9146.55â99.9825.97 d655361620195.2445.43â100.0023.64 e655361640197.5628.28â59.3838.68 1 The prefix_mpsi_can be added to the configuration codes to retrieve the anonymization suffixes used for results submission to the challenge. 2 The evaluation tools converge toNaNvalues failing training of the attacker. Table 3:Automated Mean Opinion Score (MOS) using 3 automated MOS annotators. Values range from 1 (bad quality) to 5 (high quality). Values are reported for original and anonymized LibriSpeech train-clean-360 using thecb65536 model. Model OriginalLibriSpeechAnonymizedLibriSpeech minavgmaxminavgmax UTMOS [18]1.384.104.571.291.802.67 SHEET [19]2.024.224.611.241.352.29 RAMP+ [20]1.564.004.451.111.752.51 Mean1.654.114.541.211.632.49 5 Discussion The configuration yielding the best results w.r.t. the challenge metrics iscb65536, i.e. a codebook size of 65536, codeword size of 16 and no loss for speaker prediction. It obtains a WER that is quite close to that on the original data, while not degrading UAR too much and achieving an EER above 10%, hence placing it in the lowest ranking category of the challenge (10% - 20%). Those results suggest that even with no incentive to conceal the speakerâs voice, the bottleneck and quantization enable the model to retain most of the useful information â at least as far as ASR is concerned â while already discarding speaker-specific information. Even without supervision, some emotion information is preserved as UAR reaches 43.91, meaning that using foundation models, even those not trained with vocal emotion in mind, is relevant for anonymization. The addition of anonymization supervision using the speaker predictor did not have the expected effect of improving privacy preservation, at least with the configurations that have been tested. As shown on table 2, the models trained with a speaker supervision yield very bad WERs.This suggests that the loss on speaker prediction also prevents the model from properly capturing content. Indeed, in listening tests, anonymized utterances were completely unintelligible, except for configuratione, where some words could be recognized.This hints towards testing other content-to- speaker loss ratios. Moreover, the speaker predictor used in anonymization supervision is taken from former research [7, 21]. Other speaker anonymization approaches deserve to be explored. Nevertheless, as we do not want to provide deepfake tools, models using speaker embeddings for anonymization should be avoided. On the topic of the quality of anonymized signals, the MOS scores factually highlight that the quality is drastically impacted, in line with perception tests made on subsets of the dataset. Nevertheless, speech recognition and emotion classification are still possible. In the context of reproducible research, this raises the question of the target quality of the anonymized signals.Indeed, in a pure machine learning or computational social science approaches, losing hearing quality of the signal is not a problem as far as downstream tasks can be applied successfully. In social science research where human annotation is still important, anonymization must not degrade quality of speech. The trade-off between anonymization and signal quality is therefore important in the context of reproducible research, not only in terms of metric performance but also in terms of the target application. Last, regarding number of parameters of the model (table 1), the total size is 112.94M at training time.Most of the parameters are in thewav2vec2encoder (80.M). Only 32.75M are trainable parameters including speaker predictor model. At 5 AUTHOR VERSION inference time, the model size is less than 99M parameters, comprising 18.54M trained ones.Regarding the target automatic speech recognition task and the corresponding WER, size of the model is very competitive and in line with our long-term reproductive research and privacy-preserving goal: be able to record directly anonymized speech while collecting corpora. 6 Conclusion This article introduces a straightforward lightweight voice anonymization model that focuses on preserving linguistic content rather than producing high-quality human-like speech signals. The model operates entirely in the latent space of a frozenwav2vec2encoder and relies on vector quantization and a HiFi-GAN vocoder to generate the anonymized signal. No reconstruction loss nor speaker embedding mapping are used in this proposal. For the VoicePrivacy 2026 evaluation, the best configuration achieves word error rates close to those obtained on the original data, maintains a fair level of emotion recognition performance and reaches privacy scores that fall within the lowest ranking category of the challenge (10 to 20%). These results show that for automated downstream tasks such as ASR and SER, generating a high-quality natural signal is not strictly necessary as long as the anonymized waveform carries a stable and informative content representation. The strong degradation of perceptual quality, stated by informal listening tests and by automated MOS estimation, confirms that the anonymized speech sounds âroboticâ, yet remaining usable for machine learning.These results raise again the relevant question for privacy-preserving reproducible research: the target quality of anonymized signals should be defined in relation to the intended application, whether it is fully automatic processing or human annotation for instance in social science research. Results also suggest that a simple bottleneck based on factorized vector quantization can discard part of the speaker-specific information without anonymization supervision.On the contrary, adding a speaker prediction loss as supervision excessively damage content preservation in the proposed setup. These findings call for more nuanced training objectives and alternative anonymization strategies that balance privacy, intelligibility and emotional content.These strategies must not rely on pseudo-speakers or speaker embeddings to avoid being misused for deepfake generation.Future research will investigate better trade-off between anonymization and signal quality, exploring multilingual data and more diverse corpora. Last, considering this research within the context of models for privacy-preserving data sharing for reproducible research, one must analyze the systemsâ usability in terms of computational cost.While WER, UAR, and EER performance metrics are certainly important, anonymization models must not be resource-intensive, always requiring powerful servers and high-performance GPUs.This is even more true if one plans to directly record anonymous speech during corpus collection. Based on this premise, the proposed architecture was designed to use a model with around 99M parameters which is relatively small regarding todayâs standards. Yet, the model performs very well in terms of word error rate but needs to improve in terms of anonymization without drastically increasing the number of its parameters. There is also a trade- off between metric performance and computational cost that must be carefully questioned in future research, with potential solutions adaptable to different scales. 7 Acknowledgments This research is built upon previous research from Sotheara Leang [7], a former member of the M-PSI Team and a former participant of the VPC Challenge. This research was supported by the TALISMAN project (ANR-22-CE38-0007). 8 Generative AI Use Disclosure Some authors of the paper are using RAGs as complementary tools for literature review. Generative AI tools were used for some latex table formatting tweaks and some sentence rephrasing. AI has been employed to check for orthographic and grammar correctness. References [1] X. Miao, N. Tomashenko, R. Arefeen, S. Meyer, M. Panariello, X. Wang, E. Vincent, N. Evans, J. Yamagishi, and M. Todisco, âThe voiceprivacy 2026 challenge evaluation plan,â Ph.D. dissertation, Duke Kunshan University, China; UniversitĂ© de Lorraine, CNRS, Inria, LORIA . . . , 2026. [2] N. Tomashenko, X. Wang, E. Vincent, J. Patino, B. M. L. Srivastava, P.-G. NoĂ©, A. Nautsch, N. Evans, J. Yamagishi, B. OâBrienet al., âThe voiceprivacy 2020 challenge: Results and findings,âComputer Speech & Language, vol. 74, p. 101362, 2022. [3] N. Tomashenko, X. Miao, P. Champion, S. Meyer, M. Panariello, X. Wang, N. Evans, E. Vincent, J. Yamagishi, and M. Todisco, âThe third voiceprivacy challenge:Preserving emotional expressiveness and linguistic content in voice anonymization,âarXiv preprint arXiv:2601.11846, 2026. [4] N. Tomashenko, X. Miao, P. Champion, S. Meyer, X. Wang, E. Vincent, M. Panariello, N. Evans, J. Yamagishi, and M. Todisco, âThe Voice Privacy 2024 Challenge Evaluation Plan,â Inria ; Eurecom ; NII, Tech. Rep., Mar. 2024. [Online]. Available: https://inria.hal.science/hal-04531444 [5] J. Patino, N. Tomashenko, M. Todisco, A. Nautsch, and N. Evans, âSpeaker Anonymisation Using the McAdams Coefficient,â inInterspeech 2021, 2021, p. 1099â1103. [6] D. Snyder, D. Garcia-Romero, G. Sell, D. Povey, and S. Khudanpur, âX-vectors: Robust dnn embeddings for speaker recognition,â in2018 IEEE international conference on acoustics, speech and signal processing (ICASSP). IEEE, 2018, p. 5329â5333. 6 AUTHOR VERSION [7] S. Leang, âToward robust representation for low- resourceautomaticspeechrecognition,âPh.D. dissertation, University Grenoble Alpes, 2025. [8] A. Baevski, Y. Zhou, A. Mohamed, and M. Auli, âwav2vec 2.0:A framework for self-supervised learning of speech representations,âAdvances in neural information processing systems, vol. 33, p. 12 449â 12 460, 2020. [9] A. Van Den Oord, O. Vinyalset al., âNeural discrete representation learning,âAdvances in neural information processing systems, vol. 30, 2017. [10] J. Kong, J. Kim, and J. Bae, âHifi-gan: Generative adversarial networks for efficient and high fidelity speech synthesis,âAdvances in neural information processing systems, vol. 33, p. 17 022â17 033, 2020. [11] Y. Ganin and V. Lempitsky, âUnsupervised domain adaptation by backpropagation,âinInternational conference on machine learning.PMLR, 2015, p. 1180â1189. [12] V. Panayotov, G. Chen, D. Povey, and S. Khudanpur, âLibrispeech: an asr corpus based on public domain audio books,âinAcoustics,Speech and Signal Processing(ICASSP),2015IEEEInternational Conference on. IEEE, 2015, p. 5206â5210. [13] Z. Ju, Y. Wang, K. Shen, X. Tan, D. Xin, D. Yang, Y. Liu, Y. Leng, K. Song, S. Tang, Z. Wu, T. Qin, X.-Y. Li, W. Ye, S. Zhang, J. Bian, L. He, J. Li, and S. Zhao, âNaturalspeech 3:zero-shot speech synthesis with factorized codec and diffusion models,â inProceedings of the 41st International Conference on Machine Learning, ser. ICMLâ24. JMLR.org, 2024. [14] S. gil Lee, W. Ping, B. Ginsburg, B. Catanzaro, and S. Yoon,âBigVGAN: A universal neural vocoder with large-scale training,â inThe Eleventh International Conference on Learning Representations, 2023. [Online]. Available: https://openreview.net/forum? id=iTtGCMDEzS_ [15] L. Ziyin, T. Hartwig, and M. Ueda, âNeural networks fail to learn periodic functions and how to fix it,â in Advances in Neural Information Processing Systems, H. Larochelle, M. Ranzato, R. Hadsell, M. Balcan, and H. Lin, Eds., vol. 33.Curran Associates, Inc.,2020,p. 1583â1594. [Online]. Available: https://proceedings.neurips.c/paper_files/paper/2020/ file/1160453108d3e537255e9f7b931f4e90-Paper.pdf [16] Z. Liu, L. Chen, K. A. Lee, and Z. Ling, âIdmap: A pseudo-speaker generator framework based on speaker identity index to vector mapping,âIEEE Transactions on Audio, Speech and Language Processing, vol. 34, p. 2327â2339, 2026. [17] H. Zen, V. Dang, R. Clark, Y. Zhang, R. J. Weiss, Y. Jia, Z. Chen, and Y. Wu, âLibriTTS: A Corpus Derived from LibriSpeech for Text-to-Speech,â inInterspeech 2019, 2019, p. 1526â1530. [18] T. Saeki, D. Xin, W. Nakata, T. Koriyama, S. Takamichi, and H. Saruwatari, âUTMOS: UTokyo-SaruLab System for VoiceMOS Challenge 2022,â inInterspeech 2022, 2022, p. 4521â4525. [Online]. Available:https: //github.com/tarepan/SpeechMOS [19] W.-C. Huang, E. Cooper, and T. Toda, âSHEET: A Multi-purpose Open-source Speech Human Evaluation Estimation Toolkit,â inProc. Interspeech, 2025, p. 2355â2359. [Online]. Available:https://github.com/ unilight/sheet [20] H. Wang, S. Zhao, X. Zheng, J. Zhou, X. Wang, and Y. Qin, âRamp+: Retrieval-augmented mos prediction with prior knowledge integration,âIEEE Transactions on Audio, Speech and Language Processing, 2025. [Online]. Available: https://github.com/NKU-HLT/RAMP_MOS [21] S. Leang, A. Augusma, E. Castelli, F. LetuĂ©, S. Sam, and D. Vaufreydaz, âExploring VQ-VAE with Prosody Parameters for Speaker Anonymization,â inVoice Privacy Challenge 2024 at INTERSPEECH 2024, Kos Island, Greece, Sep. 2024. [Online]. Available: https://hal.science/hal-04706860 7