Title: De-AntiFake: Rethinking the Protective Perturbations Against Voice Cloning Attacks Show Chinese title

Title: 去防伪：重新思考针对语音克隆攻击的保护性扰动

Abstract: The rapid advancement of speech generation models has heightened privacy and security concerns related to voice cloning (VC). Recent studies have investigated disrupting unauthorized voice cloning by introducing adversarial perturbations. However, determined attackers can mitigate these protective perturbations and successfully execute VC. In this study, we conduct the first systematic evaluation of these protective perturbations against VC under realistic threat models that include perturbation purification. Our findings reveal that while existing purification methods can neutralize a considerable portion of the protective perturbations, they still lead to distortions in the feature space of VC models, which degrades the performance of VC. From this perspective, we propose a novel two-stage purification method: (1) Purify the perturbed speech; (2) Refine it using phoneme guidance to align it with the clean speech distribution. Experimental results demonstrate that our method outperforms state-of-the-art purification methods in disrupting VC defenses. Our study reveals the limitations of adversarial perturbation-based VC defenses and underscores the urgent need for more robust solutions to mitigate the security and privacy risks posed by VC. The code and audio samples are available at https://de-antifake.github.io. Show Chinese abstract

Abstract: 语音生成模型的快速发展引发了与语音克隆（VC）相关的隐私和安全问题。 最近的研究通过引入对抗性扰动来干扰未经授权的语音克隆。 然而，有决心的攻击者可以减轻这些保护性扰动，并成功执行VC。 在本研究中，我们在包含扰动净化的现实威胁模型下，首次对这些保护性扰动进行了系统评估。 我们的研究结果表明，尽管现有的净化方法可以中和相当一部分保护性扰动，但它们仍然会导致VC模型特征空间中的失真，从而降低VC的性能。 从这个角度来看，我们提出了一种新的两阶段净化方法：（1）净化受扰的语音；（2）使用音素指导对其进行优化，使其与干净语音分布对齐。 实验结果表明，我们的方法在破坏VC防御方面优于最先进的净化方法。 我们的研究揭示了基于对抗性扰动的VC防御的局限性，并强调了迫切需要更稳健的解决方案来缓解VC带来的安全和隐私风险。 代码和音频样本可在 https://de-antifake.github.io 获取。